v0.18.2

Security

• Bundled dependencies moved past known denial-of-service advisories. smol-toml 1.8.0 →
  1.9.1 fixes quadratic-time parsing (GHSA-r4xh-jqrq-34v2);
  refs parses config.toml with it. brace-expansion 5.0.9 → 5.0.12, reached through
  minimatch, fixes unbounded recursion and quadratic expansion
  (GHSA-qhr7-859c-m2p7,
  GHSA-6j4f-fj2g-mc7p,
  GHSA-q2hr-2g5m-vwhr); refs matches
  workspace patterns read from a checkout with it, and a checkout is third-party content. zod
  4.6.2 → 4.6.7. All three are bundled into the published CLI.

Changed

• An invalid config.toml is reported in the new parser's words. The message still carries
  only the fault and its position, never a line of the file, but the fault is named differently
  and the column points at the offending character rather than the start of the line.
• Development moved to pnpm 12 and Node 24.21. The development toolchain moved too: oxlint, oxfmt,
  vitest, vite, tsdown, and @types/node within the 24 line. The published CLI has no pnpm
  requirement of its own.