chore(deps): bump the cli-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the cli-dependencies group with 7 updates in the /cli directory:

Package	From	To
@clack/prompts	1.7.0	1.8.1
oauth4webapi	3.8.7	3.8.8
yaml	2.9.0	2.9.1
knip	6.32.2	6.35.1
oxfmt	0.63.0	0.68.0
oxlint	1.78.0	1.83.0
typescript	6.0.3	7.0.2

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.8.1

Patch Changes

• 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

• Updated dependencies [8bd9129]:

  • @​clack/core@​1.5.1

@​clack/prompts@​1.8.0

Minor Changes

• #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

• #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

• #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

• #588 6506135 Thanks @​danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

• #599 0547d6f Thanks @​43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

• Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

  • @​clack/core@​1.5.0

Changelog

Sourced from @​clack/prompts's changelog.

1.8.1

Patch Changes

• 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

• Updated dependencies [8bd9129]:

  • @​clack/core@​1.5.1

1.8.0

Minor Changes

• #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

• #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

• #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

• #588 6506135 Thanks @​danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

• #599 0547d6f Thanks @​43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

• Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

  • @​clack/core@​1.5.0

Commits

• da44e23 [ci] release (#605)
• 8bd9129 fix: correctly specify return type of CANCEL_SYMBOL (#601)
• de1ef16 [ci] release (#589)
• 0547d6f fix: output submit gap only when guide enabled (#599)
• ae636dd feat: add async validation (#583)
• 37fca4e feat(prompts): add tab-completion to path prompt (#594)
• caa32e8 feat: export CANCEL_SYMBOL (#592)
• 8d81248 chore: stop publishing CHANGELOG.md to npm (#591)
• e238070 test(box): remove redundant test (#590)
• 6506135 fix(prompts): style box guide bar to match other gutters (#588)
• See full diff in compare view

Updates oauth4webapi from 3.8.7 to 3.8.8

Release notes

Sourced from oauth4webapi's releases.

v3.8.8

Fixes

• accept space runs in Bearer and DPoP credentials (3414db5)
• decode HTTP authentication quoted pairs correctly (bd7fcb0)
• forward arguments to AVA test runners (b898ba5)
• honor explicit auth-time skips in authorization responses (656d762)
• recognize DPoP nonce errors among multiple challenges (70bd8a1)
• release: separate changelog sections (a827c39)
• validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

• consolidate ID Token validation policy (53900cc)

Performance

• cache imported issuer verification keys by algorithm (fbe6c02)
• coalesce compatible in-flight JWKS requests (e64849e)

Changelog

Sourced from oauth4webapi's changelog.

3.8.8 (2026-09-05)

Fixes

• accept space runs in Bearer and DPoP credentials (3414db5)
• decode HTTP authentication quoted pairs correctly (bd7fcb0)
• forward arguments to AVA test runners (b898ba5)
• honor explicit auth-time skips in authorization responses (656d762)
• recognize DPoP nonce errors among multiple challenges (70bd8a1)
• release: separate changelog sections (a827c39)
• validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

• consolidate ID Token validation policy (53900cc)

Performance

• cache imported issuer verification keys by algorithm (fbe6c02)
• coalesce compatible in-flight JWKS requests (e64849e)

Commits

• 916b979 chore(release): 3.8.8
• eb564a4 test: accept WebCrypto DOMException rejections on Node 20
• fbe6c02 perf: cache imported issuer verification keys by algorithm
• e64849e perf: coalesce compatible in-flight JWKS requests
• 53900cc refactor: consolidate ID Token validation policy
• edbebeb fix: validate ID Token subjects and DPoP identifiers as strings
• bd7fcb0 fix: decode HTTP authentication quoted pairs correctly
• 3414db5 fix: accept space runs in Bearer and DPoP credentials
• 656d762 fix: honor explicit auth-time skips in authorization responses
• b898ba5 fix: forward arguments to AVA test runners
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates knip from 6.32.2 to 6.35.1

Release notes

Sourced from knip's releases.

Release 6.35.1

• Exit with code 2 when a plugin config file fails to load (#1947) (37b26426694380ef70ee45f63358faf63355a58d) - thanks @​WooWan!
• Fix sponsorship income calculations (0d9cf344b8cc0104c06d11e2c78f3f01b1df548b)
• Update sponsors page (2659063d87f558b4fc18369a4b143849eaa7543e)
• Fix npm alias attribution under Yarn PnP (resolve #2024) (7be11aa4fd50b8a3d6e276f03efb450d6d142c26)

Release 6.35.0

• fix: track pnpm workspace override catalogs (#1999) (c6497a18c6534ee914b27bb459d7778a7b93a914) - thanks @​gioboa!
• fix: track spreads under string-literal keys (#2003) (9ce68ed42a3c22fa4f4711b06d6d80a0e7f2ba13) - thanks @​gioboa!
• fix: don't flag a tag that suppresses member issues (#2004) (2e7d498cf1e53f0bbad5e16c335c5e1417432ffd) - thanks @​devYRPauli!
• fix: resolve Nuxt Virtual Component Imports (#2006) (a21f972ed68aaa6d145dd883b4ce4d68c71e6afb) - thanks @​gioboa!
• Update raw transfer problems doc with low RAM machines (#2014) (31789404cca5a8ba119b4ae97b959b7e2c595345) - thanks @​s-h-a-d-o-w!
• fix: recognize pnpm stage as built-in (#2015) (aaab35a948b458e3031989c13c13d099fdd6f229) - thanks @​gioboa!
• fix: support object-form Rstest test environments (#2010) (6c27aab20de5b6d31d71513b016548e74fc494ba) - thanks @​gioboa!
• fix: honor explicit entry export analysis (#2012) (a092e4075a6a37107c0da05c8e59343d5a7c8fab) - thanks @​gioboa!
• Document that pnpm.overrides is read from the root manifest only (f69a7f6d4fa2c68f76a9ba91fb876c5963a9e978)
• Compile source on demand (resolve #1906) (3662c9545e8bb980a5503fdea48ecc6f7e2ad3b3)
• Update dependency bun to v1.4.2 (#2019) (90b384da25203c07acb9303336622f794d77b575) - thanks @​renovate[bot]!
• feat: support configuring preprocessors in knip.json (#1920) (16d03f75ae752cb419684868ff14d89b01e84e62) - thanks @​bytedoe!
• Fix Windows paths in cache persistence and test fixtures (a4c7a93a81e04afde09d7977298b397cee9a68c2)
• fix: add a fallback to seach for lock file at cwd if its missing at the root level (#2020) (f66c9f1631347f0256f2276748de89b0d8448017) - thanks @​JayaKrishnaNamburu!
• fix: ignore raw Vite import globs (#2017) (75d56286b41ba3e3b4aad53b603736ec357fac75) - thanks @​gioboa!
• Edit docs re. cycles issue type/reporter (resolve #2021) (f1e690b5a4d8f2b3d13388aa3a95216b9691becb)
• Update dependencies (e2bd3fcc2274b52d35adf0eaec2c555d74873433)
• Resolve Vite public script entries (resolve #2023) (1cc979b7e37a4dcde5e8e9e75a8d79cf663c606e)
• Add mise plugin (resolve #2001) (db6d8919af4e870432cdda205e6271a166c84645)
• Add editor severity setting for diagnostics (resolve #1955) (4afbbcf8b16454a1d1c201d50cf8e8bd28d2cb91)

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!

... (truncated)

Commits

• 68a5344 Release knip@6.35.1
• 7be11aa Fix npm alias attribution under Yarn PnP (resolve #2024)
• 37b2642 Exit with code 2 when a plugin config file fails to load (#1947)
• c2d652c Release knip@6.35.0
• 4afbbcf Add editor severity setting for diagnostics (resolve #1955)
• db6d891 Add mise plugin (resolve #2001)
• 1cc979b Resolve Vite public script entries (resolve #2023)
• e2bd3fc Update dependencies
• 75d5628 fix: ignore raw Vite import globs (#2017)
• a4c7a93 Fix Windows paths in cache persistence and test fixtures
• Additional commits viewable in compare view

Updates oxfmt from 0.63.0 to 0.68.0

Commits

• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
• fed6681 docs(oxfmt): skip expanding overrides options (#25572)
• See full diff in compare view

Updates oxlint from 1.78.0 to 1.83.0

Release notes

Sourced from oxlint's releases.

oxlint v1.83.0 & oxfmt v0.68.0

Table of Contents

• Oxlint v1.83.0
• Oxfmt v0.68.0

Oxlint v1.83.0

🚀 Features

• afe950d linter/react: Update lint rules to accomodate changes in React 19.3 (#26571) (Connor Shea)

🐛 Bug Fixes

• fb87ed7 linter/unicorn/prefer-array-flat-map: Report .filter().flatMap() chains (#26626) (camc314)
• 336b654 linter/unicorn/prefer-at: Report single-character substring calls (#26623) (camc314)
• a5bba6d linter/eslint/no-unused-vars: Respect rest params after-used option (#26579) (Bartok)
• c1470a2 linter/eslint/no-unused-vars: Preserve ambient implicit exports (#26582) (Dex Hunter)
• 9a469d2 linter/unicorn/prefer-global-this: Preserve window event method references (#26611) (Dex Hunter)
• aaff758 linter/unicorn/prefer-default-parameters: Report violation for ??= and ||= (#26607) (Bartok)
• 2bed25a linter/unicorn/prefer-array-flat: Skip plain concat normalization (#26604) (im10furry)
• 72bc7f2 oxlint: Replace backlashes path for "no js runtime" diagnostic (#26599) (Sysix)
• 1aa5ec1 linter/typescript/prefer-for-of: Handle computed collections (#26584) (camc314)
• 1e90019 linter/typescript: Mark no-unnecessary-type-parameters and prefer-find suggestions as implemented (#26586) (Mikhail Baev)
• 4231536 linter: Compare label text in runtime optimization assertion (#26526) (camc314)
• 36d5534 linter: Include file path in diagnostic assertion (#26525) (camc314)
• 31508b1 parser: Reject return types on constructor overloads (#26523) (camc314)

⚡ Performance

• 1d681b0 linter/react/jsx-pascal-case: Avoid temporary name segment vector (#26531) (camc314)
• 2ad7d49 linter/promise/catch-or-return: Avoid temporary formatting vectors (#26505) (camc314)
• 203235b linter/jsx-a11y/no-static-element-interactions: Avoid role vector (#26504) (camc314)
• 2e95167 linter/jsx-a11y/anchor-is-valid: Avoid temporary attribute vector (#26501) (camc314)
• deafdba linter/react/exhaustive-deps: Avoid temporary dependency vector (#26502) (camc314)
• 4f1627f linter/oxc/branches-sharing-code: Compute deletion spans lazily (#26500) (camc314)
• c068fd2 linter/react/jsx-curly-brace-presence: Avoid newline position allocation (#26499) (camc314)
• ed4357c linter/eslint/no-restricted-properties: Skip empty configurations (#26497) (camc314)
• 92e41b7 linter/oxc/no-barrel-file: Iterate module requests directly (#26498) (camc314)
• 5255ee3 linter/unicorn/prefer-single-call: Avoid temporary argument vector (#26494) (camc314)
• 96ef365 linter/unicorn/prefer-includes: Reduce suggestion allocations (#26492) (camc314)
• a71fd7f linter/unicorn/no-new-buffer: Avoid temporary argument vector (#26491) (camc314)
• 11085e7 linter/jsdoc/require-yields: Short-circuit JSDoc checks (#26488) (camc314)
• 9b1aff8 linter/unicorn/no-useless-undefined: Skip calls without trailing undefined (#26481) (camc314)
• 1e5d5d7 linter/eslint/no-unused-vars: Skip absent global declaration checks (#26457) (camc314)
• 403f899 linter/eslint/no-undef: Check globals once per unresolved name (#26456) (camc314)
• 118adb0 linter/eslint/no-restricted-imports: Avoid redundant import scans (#26455) (camc314)
• ab848f2 linter/eslint/no-useless-assignment: Skip tracking exported symbols (#26449) (camc314)
• 1b6e409 linter/unicorn/prefer-object-from-entries: Avoid allocating configured paths (#26448) (camc314)
• 2206875 linter/eslint/new-cap: Avoid unnecessary callee name allocations (#26447) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

Commits

• 7bf68f7 release(apps): oxlint v1.83.0 && oxfmt v0.68.0 (#26631)
• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

[albert20260301]

Stacked compatibility fix: #114 keeps TypeScript at 6.0.3, updates the changed YAML contract assertion, and replaces the cancellation narrowing that fails under TypeScript 6. Please merge #114 before this dependency PR.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.