[dependabot]

Bumps the development-dependencies group with 5 updates:

Package	From	To
@types/bun	1.4.2	1.4.3
lefthook	2.2.1	2.2.2
oxfmt	0.72.0	0.73.0
oxlint	1.87.0	1.88.0
ultracite	8.0.0	8.0.1

Updates @types/bun from 1.4.2 to 1.4.3

Commits

• See full diff in compare view

Updates lefthook from 2.2.1 to 2.2.2

Release notes

Sourced from lefthook's releases.

v2.2.2

Changelog

• 4aeffd72a6e3ea846c2054cffd6294c943fd7fbb fix: cleanup only current stash hash (#1597)
• db62412c82ddac71cf536e60e50edb2826624870 packaging: add support for android (#1591)
• e3fa81b1f01881829ef95e37211da7923a4fd6df refactor(filter): simplify mimetype matching (#1596)

Changelog

Sourced from lefthook's changelog.

2.2.2

• fix: cleanup only current stash hash (#1597) by @​mrexox
• refactor: simplify mimetype matching (#1596) by @​scop
• packaging: add support for android (#1591) by @​mrexox

Commits

• eb4e504 2.2.2: keep backups for worktree flows and release android NPM package
• 4aeffd7 fix: cleanup only current stash hash (#1597)
• e3fa81b refactor(filter): simplify mimetype matching (#1596)
• db62412 packaging: add support for android (#1591)
• See full diff in compare view

Updates oxfmt from 0.72.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

• 1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)
• c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

• ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)
• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)
• c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)
• 4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

• 76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)
• 99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)
• 372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)
• da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)
• 21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)
• b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)
• 5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)
• 676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)
• d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

• 4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)
• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)
• 37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• See full diff in compare view

Updates oxlint from 1.87.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

• bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

• 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
• 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
• 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

• 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
• c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
• c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
• 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
• 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

• 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
• 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
• 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
• See full diff in compare view

Updates ultracite from 8.0.0 to 8.0.1

Release notes

Sourced from ultracite's releases.

ultracite@8.0.1

Patch Changes

• 40d646a: ultracite fix --claude and --codex hand agents better information and report results more accurately:

  • Rule names reach the agent as they're written in the config, such as no-unused-vars and typescript/no-explicit-any, instead of Oxlint's eslint(no-unused-vars).
  • ESLint diagnostics now carry the rule's description and documentation URL, read with the json-with-metadata formatter. Biome diagnostics carry the rule's documentation URL and its description from biome explain, since Biome's JSON reporter includes no help text.
  • The prompt tells the agent that the run is non-interactive, so it explains a decision it can't make in its final message instead of asking a question and waiting for an answer that can't come.
  • Files are handed over in path order, so the same project gets its fix in the same file on every run. Before each file after the first, Ultracite lints it again: an earlier file's fix can clear its issues (breaking an import cycle fixes both files), and the agent was being handed diagnostics that no longer applied. A file with nothing left is skipped.
  • A file the agent deleted, or one that no longer parses, now counts as unfixed. Before, its issues could disappear from the report and show as fixed.

• 2543859: Update the vendored anti-slop Oxlint plugin to upstream commit 13909c9 and enable its three new rules in the ultracite/oxlint/anti-slop preset. require-readable-spacing restores blank lines around structural boundaries — top-level declarations, multiline bindings, control flow, returns, and blocks — a pattern AI-generated code tends to pack together, while consecutive single-line bindings stay grouped at any scope (dmmulroy/anti-slop#45). Its autofix only inserts whitespace and never removes existing blank lines, so ultracite fix restores the spacing without fighting the formatter. no-array-filter-map rejects adjacent eager filter/map passes over arrays, and no-reduce-accumulator-copy rejects reducers that copy their accumulator on every iteration. Expect a one-time whitespace-only diff from ultracite fix after upgrading if you extend the preset (#803).

• 0a671cc: On the ESLint toolchain, ultracite fix --hook no longer deletes an import an agent has just added. A post-edit hook runs between the agent's edits, so the import is unused until the code that uses it lands, and unused-imports/no-unused-imports removed it first. The hook run now turns that rule off, as the Biome hook already skips noUnusedImports (#483). no-unused-vars still reports the import if it stays unused.

• de08bd3: The ESLint core preset no longer configures a node resolver for import-x, which needed eslint-import-resolver-node, a package init never installed. The TypeScript resolver it keeps resolves JavaScript files too.

• c13e042: react/jsx-no-target-blank now checks forms as well as links (forms: true) in the Oxlint and ESLint React presets, as Biome's noBlankTarget already does. The rules file init writes for agents now says to add rel="noopener noreferrer" to target="_blank" links instead of rel="noopener", which Oxlint and ESLint report because it still sends the referrer. It also says to avoid import cycles again, which the Oxlint and ESLint core presets report.

• 9853406: The oxlint.config.ts that ultracite init writes now sets env: core.env. Oxlint doesn't carry env through extends, so the browser globals the core preset declares never reached projects, and rules that depend on them stayed quiet: no-implied-eval didn't report setTimeout("…") or setInterval("…"), and no-eval didn't report window.eval(…). Workspace configs written by init now repeat env: root.env alongside ignorePatterns and settings, and an .oxlintrc.json that init migrates keeps its env on top of core's. Re-run ultracite init to update an existing config, or add env: core.env to it yourself.

• 7984c6e: The Oxlint js-plugins preset now enables the 32 SonarJS rules that the ESLint core preset already runs without type information, including the security rules sonarjs/slow-regex, sonarjs/sql-queries, sonarjs/disabled-auto-escaping and sonarjs/dompurify-unsafe-config. SonarJS marks these rules requiresTypeChecking, but they also check the syntax tree, so they work through Oxlint's JS plugin bridge. The preset had left out every marked rule.

Commits

• 367d908 Version Packages (#849)
• 2543859 Update the vendored anti-slop plugin and enable require-readable-spacing (#811)
• ac533c7 Bump turbo to 2.11.8
• e9c264b Give each research post a share card with its own description
• 7f71068 Color the share cards like the homepage call to action
• 8f6d546 Keep a bare bun test out of research and tmp
• 4ea170b Document restriction rules, cycle reports and unused exports
• de08bd3 Drop the uninstalled node resolver from the ESLint core preset
• c13e042 Check forms for target="_blank" and fix the agent rules on it
• 7984c6e Run sonarjs's syntactic rules in Oxlint js-plugins and fix the parity check
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Polylane reviews this pull request when you ask:

---

Summary by cubic

Updates five development dependencies: @types/bun to 1.4.3, lefthook to 2.2.2, oxfmt to 0.73.0, oxlint to 1.88.0, and ultracite to 8.0.1.

• ultracite adds lint rules that may produce a one-time whitespace-only diff if the project extends its anti-slop preset.
• oxfmt includes breaking changes to its Prettier migration behavior.

^{Written for commit bccc176. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 16bc6fa5-15a3-42d0-a5df-5e3b1f94d565

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: bccc176

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.4.2 ⏵ 1.4.3
	oxfmt@​0.72.0 ⏵ 0.73.0			+1	+1
	oxlint@​1.87.0 ⏵ 1.88.0	+1		+1	+2
	lefthook@​2.2.1 ⏵ 2.2.2				+1
	ultracite@​8.0.0 ⏵ 8.0.1	+1		+1	+1

View full report

[pkg-pr-new]

Open in StackBlitz

bun add https://pkg.pr.new/@mynameistito/codex-usage@bccc176

commit: bccc176

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml