chore(deps): bump the all-dependencies group with 106 updates

[dependabot]

Bumps the all-dependencies group with 106 updates:

Package	From	To
@octokit/request-error	7.1.0	7.1.1
@toon-format/toon	4.1.0	4.1.1
fastmcp	4.12.1	4.12.6
js-yaml	5.2.2	5.2.3
@anthropic-ai/claude-agent-sdk	0.3.220	0.3.223
@openrouter/sdk	1.1.22	1.2.11
knip	6.29.0	6.31.0
lint-staged	17.2.0	17.3.0
oxfmt	0.61.0	0.62.0
oxlint	1.76.0	1.77.0
repomix	1.17.0	1.18.0
tsx	4.23.1	4.23.8
vite	8.1.5	8.2.0
@anthropic-ai/claude-agent-sdk-darwin-arm64	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-darwin-x64	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-linux-arm64-musl	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-linux-arm64	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-linux-x64-musl	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-linux-x64	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-win32-arm64	0.3.220	0.3.223
@anthropic-ai/claude-agent-sdk-win32-x64	0.3.220	0.3.223
@emnapi/core	1.11.1	1.11.2
@emnapi/runtime	1.11.1	1.11.2
@napi-rs/wasm-runtime	1.1.6	1.2.1
@oxc-parser/binding-android-arm-eabi	0.140.0	0.142.0
@oxc-parser/binding-android-arm64	0.140.0	0.142.0
@oxc-parser/binding-darwin-arm64	0.140.0	0.142.0
@oxc-parser/binding-darwin-x64	0.140.0	0.142.0
@oxc-parser/binding-freebsd-x64	0.140.0	0.142.0
@oxc-parser/binding-linux-arm-gnueabihf	0.140.0	0.142.0
@oxc-parser/binding-linux-arm-musleabihf	0.140.0	0.142.0
@oxc-parser/binding-linux-arm64-gnu	0.140.0	0.142.0
@oxc-parser/binding-linux-arm64-musl	0.140.0	0.142.0
@oxc-parser/binding-linux-ppc64-gnu	0.140.0	0.142.0
@oxc-parser/binding-linux-riscv64-gnu	0.140.0	0.142.0
@oxc-parser/binding-linux-riscv64-musl	0.140.0	0.142.0
@oxc-parser/binding-linux-s390x-gnu	0.140.0	0.142.0
@oxc-parser/binding-linux-x64-gnu	0.140.0	0.142.0
@oxc-parser/binding-linux-x64-musl	0.140.0	0.142.0
@oxc-parser/binding-openharmony-arm64	0.140.0	0.142.0
@oxc-parser/binding-wasm32-wasi	0.140.0	0.142.0
@oxc-parser/binding-win32-arm64-msvc	0.140.0	0.142.0
@oxc-parser/binding-win32-ia32-msvc	0.140.0	0.142.0
@oxc-parser/binding-win32-x64-msvc	0.140.0	0.142.0
@oxc-project/types	0.139.0	0.142.0
@oxfmt/binding-android-arm-eabi	0.61.0	0.62.0
@oxfmt/binding-android-arm64	0.61.0	0.62.0
@oxfmt/binding-darwin-arm64	0.61.0	0.62.0
@oxfmt/binding-darwin-x64	0.61.0	0.62.0
@oxfmt/binding-freebsd-x64	0.61.0	0.62.0
@oxfmt/binding-linux-arm-gnueabihf	0.61.0	0.62.0
@oxfmt/binding-linux-arm-musleabihf	0.61.0	0.62.0
@oxfmt/binding-linux-arm64-gnu	0.61.0	0.62.0
@oxfmt/binding-linux-arm64-musl	0.61.0	0.62.0
@oxfmt/binding-linux-ppc64-gnu	0.61.0	0.62.0
@oxfmt/binding-linux-riscv64-gnu	0.61.0	0.62.0
@oxfmt/binding-linux-riscv64-musl	0.61.0	0.62.0
@oxfmt/binding-linux-s390x-gnu	0.61.0	0.62.0
@oxfmt/binding-linux-x64-gnu	0.61.0	0.62.0
@oxfmt/binding-linux-x64-musl	0.61.0	0.62.0
@oxfmt/binding-openharmony-arm64	0.61.0	0.62.0
@oxfmt/binding-win32-arm64-msvc	0.61.0	0.62.0
@oxfmt/binding-win32-ia32-msvc	0.61.0	0.62.0
@oxfmt/binding-win32-x64-msvc	0.61.0	0.62.0
@oxlint/binding-android-arm-eabi	1.76.0	1.77.0
@oxlint/binding-android-arm64	1.76.0	1.77.0
@oxlint/binding-darwin-arm64	1.76.0	1.77.0
@oxlint/binding-darwin-x64	1.76.0	1.77.0
@oxlint/binding-freebsd-x64	1.76.0	1.77.0
@oxlint/binding-linux-arm-gnueabihf	1.76.0	1.77.0
@oxlint/binding-linux-arm-musleabihf	1.76.0	1.77.0
@oxlint/binding-linux-arm64-gnu	1.76.0	1.77.0
@oxlint/binding-linux-arm64-musl	1.76.0	1.77.0
@oxlint/binding-linux-ppc64-gnu	1.76.0	1.77.0
@oxlint/binding-linux-riscv64-gnu	1.76.0	1.77.0
@oxlint/binding-linux-riscv64-musl	1.76.0	1.77.0
@oxlint/binding-linux-s390x-gnu	1.76.0	1.77.0
@oxlint/binding-linux-x64-gnu	1.76.0	1.77.0
@oxlint/binding-linux-x64-musl	1.76.0	1.77.0
@oxlint/binding-openharmony-arm64	1.76.0	1.77.0
@oxlint/binding-win32-arm64-msvc	1.76.0	1.77.0
@oxlint/binding-win32-ia32-msvc	1.76.0	1.77.0
@oxlint/binding-win32-x64-msvc	1.76.0	1.77.0
@rolldown/binding-android-arm64	1.1.5	1.2.1
@rolldown/binding-darwin-arm64	1.1.5	1.2.1
@rolldown/binding-darwin-x64	1.1.5	1.2.1
@rolldown/binding-freebsd-x64	1.1.5	1.2.1
@rolldown/binding-linux-arm-gnueabihf	1.1.5	1.2.1
@rolldown/binding-linux-arm64-gnu	1.1.5	1.2.1
@rolldown/binding-linux-arm64-musl	1.1.5	1.2.1
@rolldown/binding-linux-ppc64-gnu	1.1.5	1.2.1
@rolldown/binding-linux-s390x-gnu	1.1.5	1.2.1
@rolldown/binding-linux-x64-gnu	1.1.5	1.2.1
@rolldown/binding-linux-x64-musl	1.1.5	1.2.1
@rolldown/binding-openharmony-arm64	1.1.5	1.2.1
@rolldown/binding-wasm32-wasi	1.1.5	1.2.1
@rolldown/binding-win32-arm64-msvc	1.1.5	1.2.1
@rolldown/binding-win32-x64-msvc	1.1.5	1.2.1
brace-expansion	5.0.7	5.0.9
mcp-proxy	6.5.5	6.6.0
minimatch	10.2.5	10.2.6
oxc-parser	0.140.0	0.142.0
picospinner	3.0.0	3.1.2
rolldown	1.1.5	1.2.1
tar	7.5.21	7.5.22
unbash	4.0.3	4.0.6

Updates @octokit/request-error from 7.1.0 to 7.1.1

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.1

7.1.1 (2026-08-01)

Bug Fixes

• deps: update dependency @​octokit/types to v17 (#569) (960f081)

Commits

• 960f081 fix(deps): update dependency @​octokit/types to v17 (#569)
• 2be455a chore(deps): update dependency esbuild to ^0.28.0 [security] (#562)
• 4013f20 ci(action): update actions/checkout action to v7 (#564)
• bf1a7eb build(deps): lock file maintenance (#563)
• 81a8d78 build(deps): lock file maintenance (#549)
• 78c94bb chore(deps): update dependency prettier to v3.7.4 (#547)
• 1517a0d chore(deps): update dependency prettier to v3.7.1 (#546)
• 786ec41 build(deps): lock file maintenance (#544)
• 1f821c4 ci(action): update actions/checkout action to v6 (#543)
• 297cd3e build(deps): lock file maintenance (#539)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/request-error since your current version.

Updates @toon-format/toon from 4.1.0 to 4.1.1

Release notes

Sourced from @​toon-format/toon's releases.

v4.1.1

   🐞 Bug Fixes

• Write CLI diagnostics to stderr so stdout carries results only  -  by @​johannschopplich (46757)
• Terminate the last line of file output with a newline  -  by @​johannschopplich (c3d7c)
• Treat a tab-indented hash line as content, not a comment  -  by @​johannschopplich (6e822)
• Reject a raw string whose comment marker follows a byte-order mark  -  by @​johannschopplich (bde6e)

    View changes on GitHub

Commits

• a9e6d97 chore: release v4.1.1
• 349941c chore: update @​toon-format/spec to v4.1.1
• bfca235 docs: list the misplaced scalar line among the both-mode decode errors
• bde6eae fix: reject a raw string whose comment marker follows a byte-order mark
• 6e822b3 fix: treat a tab-indented hash line as content, not a comment
• 1ab9e43 style: trim package and docs comments to intent and constraints
• 0d9945b style: mark benchmark question sections with regions
• c702deb style: trim benchmark comments to intent and constraints
• 96c53e5 style: open shared boundary docs with a verb and name values as nouns
• 05adaf3 build: update the lockfile after dropping the runtime dependencies
• Additional commits viewable in compare view

Updates fastmcp from 4.12.1 to 4.12.6

Release notes

Sourced from fastmcp's releases.

v4.12.6

4.12.6 (2026-08-05)

Bug Fixes

• auth: consume refresh token mappings atomically in swap mode (reported by @​JosephDoUrden) (ce809e1)

v4.12.5

4.12.5 (2026-08-05)

Bug Fixes

• auth: handle aborted and oversized bodies in OAuth proxy endpoints (#306) (70e4f3c)

v4.12.4

4.12.4 (2026-08-04)

Bug Fixes

• add timeout to image and audio content fetch (#305) (1fea124)

v4.12.3

4.12.3 (2026-08-04)

Bug Fixes

• allow contents write (f1311e6)
• auth: add timeout to upstream OAuth and discovery fetch calls (#304) (83e0725)
• auth: normalize scope in JWKS claim mapping (#309) (180dfb1), closes #308
• force new release (887a652)
• report unsupported tool schemas early (#307) (7a604df)

v4.12.2

4.12.2 (2026-08-01)

Bug Fixes

• auth: use timing-safe comparison for JWT and consent signatures (#301) (f0d8e69)

Commits

• ce809e1 fix(auth): consume refresh token mappings atomically in swap mode (reported b...
• 70e4f3c fix(auth): handle aborted and oversized bodies in OAuth proxy endpoints (#306)
• c0f7ed3 docs: fix the advanced OAuth example so it compiles (#311)
• 1fea124 fix: add timeout to image and audio content fetch (#305)
• f1311e6 fix: allow contents write
• 887a652 fix: force new release
• 180dfb1 fix(auth): normalize scope in JWKS claim mapping (#309)
• 7a604df fix: report unsupported tool schemas early (#307)
• 83e0725 fix(auth): add timeout to upstream OAuth and discovery fetch calls (#304)
• 973192a Sentinel: harden CI/CD (1 security issue, 6 best practices) (#303)
• Additional commits viewable in compare view

Updates js-yaml from 5.2.2 to 5.2.3

Changelog

Sourced from js-yaml's changelog.

[5.2.3] - 2026-08-01

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #782.
• Resolve !!timestamp years 0000-0099 correctly, #775.
• Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
• Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

Commits

• 6740445 5.2.3 released
• 94e766d Update changelog
• c3bd7ca Polish previous commit, #780
• 00209b6 presenter: treat a tab-indented line in a folded scalar as more-indented (#780)
• 40fcb4f Fix missing mapping values before document markers and reject unpaired mappin...
• 49280f3 Fix !!timestamp resolution for years 0000-0099, #775
• 355dc96 fix: prevent prototype fallback in tag and harden object lookups, #782 (than...
• d524f83 docs: add contributing guidelines
• See full diff in compare view

Updates @anthropic-ai/claude-agent-sdk from 0.3.220 to 0.3.223

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.223

What's changed

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.223
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.223
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.223
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.223

v0.3.222

What's changed

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.222
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.222
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.222
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.222

v0.3.221

What's changed

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.221
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.221
# or
</tr></table> 

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.223

• Added resumeDropsTurn option: with resumeSessionAt, declares the turn a truncating resume intends to drop; the CLI refuses the resume if anything else would be discarded
• Result messages for repeated 529 overload failures now include api_error_status: 529, so SDK consumers can detect overload terminations structurally instead of matching message text
• Bare headless (-p / SDK query() without canUseTool) now emits system/permission_denied stream events when a tool call is auto-denied
• Documented usage vs modelUsage on stream-json results: usage is main-loop-only and per-turn; modelUsage is cumulative, covers all query-pipeline calls, and is the field for cost accounting

0.3.222

• Fixed query({ sessionStore, resume }) not carrying user settings.json (apiKeyHelper, env, hooks, permissions) into the resumed subprocess

0.3.221

• Improved skills option validation: malformed names (delimiters or control characters) and wildcard-form names are rejected with a clear error; use skills: 'all' to enable every skill
• Fixed external MCP servers passed via the mcpServers option not being connected before the first turn, which caused the model to emit tool calls as literal text

Commits

• 064793e chore: Update CHANGELOG.md
• 6e143f4 chore: Update CHANGELOG.md
• 31fbbfd chore: Update CHANGELOG.md
• See full diff in compare view

Updates @openrouter/sdk from 1.1.22 to 1.2.11

Release notes

Sourced from @​openrouter/sdk's releases.

typescript - v1.2.11 - 2026-08-05 15:55:46

Generated by Speakeasy CLI

2026-08-05 15:55:46

Changes

Based on:

• OpenAPI Doc 1.0.0
• Speakeasy CLI 1.787.0 (2.914.0) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v1.2.11] .

Releases

• [NPM v1.2.11] https://www.npmjs.com/package/@​openrouter/sdk/v/1.2.11 - .

Publishing Completed

typescript - v1.2.10 - 2026-08-05 15:24:47

Generated by Speakeasy CLI

2026-08-05 15:24:47

Changes

Based on:

• OpenAPI Doc 1.0.0
• Speakeasy CLI 1.787.0 (2.914.0) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v1.2.10] .

Releases

• [NPM v1.2.10] https://www.npmjs.com/package/@​openrouter/sdk/v/1.2.10 - .

Publishing Completed

typescript - v1.2.9 - 2026-08-04 21:12:35

Generated by Speakeasy CLI

@​openrouter/sdk 1.2.9

Typescript SDK Changes:

• openrouter.beta.analytics.queryAnalytics():
  • request.requestBody.filters[].includeUnset Added
• openrouter.presets.createPresetsMessages():
  • request.messagesRequest Changed

Generated with Speakeasy CLI 1.787.0

Publishing Completed

typescript - v1.2.8 - 2026-08-04 18:03:14

Generated by Speakeasy CLI

2026-08-04 18:03:14

Changes

Based on:

... (truncated)

Changelog

Sourced from @​openrouter/sdk's changelog.

2025-08-22 16:09:25

Changes

Based on:

• OpenAPI Doc
• Speakeasy CLI 1.606.2 (2.687.1) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v0.1.2] .

2025-09-23 21:23:27

Changes

Based on:

• OpenAPI Doc
• Speakeasy CLI 1.622.2 (2.711.4) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v0.0.0-beta.2] .

Releases

• [NPM v0.0.0-beta.2] https://www.npmjs.com/package/@​openrouter/sdk/v/0.0.0-beta.2 - .

2025-10-01 17:53:43

Changes

Based on:

• OpenAPI Doc
• Speakeasy CLI 1.631.5 (2.716.16) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v0.0.0-beta.17] .

Releases

• [NPM v0.0.0-beta.17] https://www.npmjs.com/package/@​openrouter/sdk/v/0.0.0-beta.17 - .

2025-10-18 05:44:43

Changes

Based on:

• OpenAPI Doc
• Speakeasy CLI 1.637.0 (2.727.4) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v0.0.0-beta.41] .

Releases

• [NPM v0.0.0-beta.41] https://www.npmjs.com/package/@​openrouter/sdk/v/0.0.0-beta.41 - .

2025-10-18 19:30:25

Changes

Based on:

• OpenAPI Doc
• Speakeasy CLI 1.637.0 (2.727.4) https://github.com/speakeasy-api/speakeasy

Generated

• [typescript v0.0.0-beta.42] .

Releases

• [NPM v0.0.0-beta.42] https://www.npmjs.com/package/@​openrouter/sdk/v/0.0.0-beta.42 - .

... (truncated)

Commits

• d2b037a chore: 🐝 Update SDK - Generate (spec change merged) 1.2.11 (#755)
• be8efa2 chore: update OpenAPI spec from monorepo (#754)
• 6b0b573 chore: 🐝 Update SDK - Generate (spec change merged) 1.2.10 (#753)
• 73e012c chore: update OpenAPI spec from monorepo (#752)
• 1fe627a chore: 🐝 Update SDK - Generate (spec change merged) 1.2.9 (#751)
• 7019de0 chore: update OpenAPI spec from monorepo (#750)
• c5ada2c chore: 🐝 Update SDK - Generate (spec change merged) 1.2.8 (#749)
• e85b0d1 chore: update OpenAPI spec from monorepo (#748)
• d2315d5 chore: 🐝 Update SDK - Generate (spec change merged) 1.2.7 (#747)
• 250a107 chore: update OpenAPI spec from monorepo (#746)
• Additional commits viewable in compare view

Updates knip from 6.29.0 to 6.31.0

Release notes

Sourced from knip's releases.

Release 6.31.0

• feat: Add basic support for Marko 6 and 5 (#1914) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks @​caseycarroll!
• Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)
• Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)
• Downgrade @​types/vscode to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)

Release 6.30.0

• docs: migrate to Starlight Blog plugin (#1854) (c89e3e3c9) - thanks @​trueberryless!
• Include workspace dependencies in scoped runs (resolve #1901) (a75309eda)
• Simplify workspace assembly (b3ac16411)
• Document export declaration safety (ef98a7682)
• Read object jsPlugin specifiers from Vite+ config (#1879) (3ea6a92d4) - thanks @​matchai!
• Compile gitignore negations once (6884cdb20)
• Cache Node test script detection (d970f67d8)
• Track only enabled workspace plugins (67d48268a)
• Skip unsupported Vite config command (545bb2d36)
• Add SARIF reporter (ce11cf5d4)
• Track catalog refs in pnpm dlx scripts (resolve #1885, close #1886) (102189a1a)
• Report unresolved catalog references (b2b86c3e5)
• Track catalog references across scoped runs (resolve #1905) (f0365bae0)
• Track script catalog references across scoped runs (9b3ab3778)
• Remove tsc from ignoreBinaries (a0a283040)
• fix: detect dynamic imports in Svelte component templates (#1908) (aa303fb04) - thanks @​firatciftci!
• fix(remark): support all types of dependency names (#1911) (3441bea3a) - thanks @​voxpelli!
• Update sanity snapshot (d04aa04e5)
• feat(stryker): add ts extensions (#1910) (cfc50886e) - thanks @​christopher-buss!
• Adopt @​e18e/eslint-plugin (adf2511ab)
• Remove Workleap from sponsors (d4f6af9ff)
• Update dependencies (3f61542f6)
• Add ES2023 array types to TypeScript 5 CI (360a47157)
• Update sentry snapshot (7defc1853)
• Analyze published type dependencies (resolve #1909) (#1912) (87d713e52)
• Update TanStack and Code Forge logos (39ed8c82b)
• Track assets referenced from SCSS URLs (resolve #1916) (cbe13bf87)
• Consume only the default export of inline dynamic import loaders (resolve #1915) (b90a299e2)
• Update ecosystem snapshots (3f6cdee15)
• Update dependencies (6cdb3a6ac)

Commits

• 69c6006 Release knip@6.31.0
• 5aadf47 Use Array.from in Marko compiler
• c6b1516 feat: Add basic support for Marko 6 and 5 (#1914)
• 837e52c Release knip@6.30.0
• 6cdb3a6 Update dependencies
• b90a299 Consume only the default export of inline dynamic import loaders (resolve #1915)
• cbe13bf Track assets referenced from SCSS URLs (resolve #1916)
• 87d713e Analyze published type dependencies (resolve #1909) (#1912)
• 360a471 Add ES2023 array types to TypeScript 5 CI
• 3f61542 Update dependencies
• Additional commits viewable in compare view

Updates lint-staged from 17.2.0 to 17.3.0

Release notes

Sourced from lint-staged's releases.

v17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Changelog

Sourced from lint-staged's changelog.

17.3.0

Minor Changes

• #1825 16b3f74 - It is now possible to run multiple tasks in parallel for a single glob by configuring it with an array of tasks (which run sequentially), and then placing another array inside it (where the tasks will run in parallel). The following demonstrates the order tasks will start in:

  {
    "*.ts": ["first", "second", ["third", "third"], "fourth"]
  }

  As a concrete example, lint-staged's own configuration is:

  /** @type {import('./lib/index.js').Configuration} */
  export default {
    "*": [
      [
        "oxfmt --check --no-error-on-unmatched-pattern",
        "oxlint --no-error-on-unmatched-pattern",
      ],
    ],
    "*.ts": () => "tsc",
  };

  which means:

  1. for all staged files, run the two commands in parallel with staged filenames appended, for example:
     • oxfmt --check --no-error-on-unmatched-pattern lib/index.js
     • oxlint --no-error-on-unmatched-pattern lib/index.js
  2. additionally, if any *.ts files are staged, run tsc without appending any arguments
  3. The two sets of commands also run in parallel

Patch Changes

• #1829 15f7e53 - During an in-progress merge, files that are unchanged from the branch being merged are now skipped. Technically, files are only included if there are staged changes against both HEAD and MERGE_HEAD.

Commits

• d153443 Merge pull request #1828 from lint-staged/changeset-release/main
• 5162c14 chore(changeset): release
• a4db9a4 Merge pull request #1831 from lint-staged/linter-updates
• ea96cab style: enable oxlint "suspicious" category
• 2fae007 style: add @e18e/eslint-plugin
• 2280c38 Merge pull request #1829 from lint-staged/fix-merge-conflict-files
• 1453ae6 test: relax assertion so that it passes in worktree
• 15f7e53 fix: lint only files changed against HEAD and MERGE_HEAD, during a merge
• dedfc31 Merge pull request #1825 from lint-staged/parallel-tasks-inside-sequence
• 286e25c feat: allow running parallel tasks by nesting arrays
• Additional commits viewable in compare view

Updates oxfmt from 0.61.0 to 0.62.0

Changelog

Sourced from oxfmt's changelog.

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

... (truncated)

Commits

• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
• e6e584b fix(oxfmt): type jsdoc. enum options (#25008)
• See full diff in compare view

Updates oxlint from 1.76.0 to 1.77.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

Commits

• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dyoshikawa]

@dependabot Thank you!