Skip to content

ci: bump the dependencies group across 1 directory with 23 updates - #267

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-e70810a5c2
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dependencies-e70810a5c2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 23 updates in the / directory:

Package From To
oxfmt 0.72.0 0.74.0
oxlint 1.87.0 1.89.0
@astrojs/starlight 0.42.4 0.42.6
@cloudflare/workers-types 5.20261011.1 5.20261023.1
@simplewebauthn/server 14.0.1 14.0.3
@types/node 26.1.2 26.6.5
alchemy 2.0.0-beta.80 2.0.0-beta.83
astro 7.3.5 7.4.2
electron 44.5.1 45.0.0
esbuild 0.28.1 0.28.2
expo 54.0.37 58.0.17
expo-secure-store 15.0.8 58.0.2
expo-web-browser 15.0.11 58.0.6
jose 6.2.12 6.2.13
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@types/react-dom 19.2.4 19.3.0
react-native 0.81.4 0.88.0
scheduler 0.27.0 0.28.0
starlight-links-validator 0.26.0 0.27.0
tldts 7.4.11 7.4.19
vite-plus 1.1.0 1.4.0
vitest 5.0.3 5.0.5

Updates oxfmt from 0.72.0 to 0.74.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.74.0

🐛 Bug Fixes

  • e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
  • 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
  • a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
  • 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
  • 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
  • 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
  • c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
  • d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
  • c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
  • a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
  • 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
  • 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
  • 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
  • 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
  • a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
  • de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
  • 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
  • 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)
  • 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)
  • 5b2acb0 formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)
  • c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)
  • 3a980c9 formatter_toml: Handle BOM like other languages (#27775) (leaysgur)
  • 97c9fc4 oxfmt: Handle BOM in config JSON (#27774) (leaysgur)
  • 28eb4a7 oxfmt: Print trailing newline for --list-different (#27773) (leaysgur)
  • d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)
  • 6a95ec1 formatter: Keep comment position on holey array (#27730) (leaysgur)
  • 54769da formatter: Break after dangling line comment in holey array (#27729) (leaysgur)
  • 99077ef formatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)
  • 22cd4cd formatter_json: Handle holey array and comments (#27727) (leaysgur)
  • 644ca1c formatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)
  • a07a0fb formatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)

⚡ Performance

  • e220293 formatter: Check only the operator suppression mark in is_quiet (#27952) (leaysgur)
  • e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#27559) (leaysgur)
  • a342f7e formatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)
  • d8ce750 formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)
  • 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)
  • 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)

📚 Documentation

  • 1325225 oxfmt: Update useless comment prefix (#27956) (leaysgur)
  • d0dd140 formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)
  • 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)

... (truncated)

Commits
  • 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
  • 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
  • a495e82 feat(oxfmt): support associations config to specify language over filepath ...
  • 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
  • 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
  • 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
  • See full diff in compare view

Updates oxlint from 1.87.0 to 1.89.0

Release notes

Sourced from oxlint's releases.

oxlint v1.89.0

💥 BREAKING CHANGES

  • e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
  • a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

  • 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
  • ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
  • d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
  • e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
  • 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
  • d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
  • 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
  • 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
  • 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
  • b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
  • c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
  • 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

  • 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
  • 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
  • 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
  • f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
  • 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
  • 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
  • 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)
  • 7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (#27754) (camc314)
  • 4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without writes (#27760) (camc314)
  • 2947917 linter/eslint/no-lonely-if: Check final else blocks in else-if chains (#27759) (camc314)
  • fc039b5 linter/eslint/sort-imports: Check imports after other statements (#27749) (camc314)
  • 1acba97 linter/unicorn/prefer-at: Report slice index reads once (#27762) (camc314)
  • 6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used as conditional tests (#27533) (Anzal Husain Abidi)
  • b3cdaaf linter/eslint/sort-keys: Check computed identifier names (#27748) (camc314)
  • 170e608 linter/unicorn/prefer-native-coercion-functions: Check object methods and function properties (#27750) (camc314)
  • 9261df7 linter/unicorn/prefer-string-raw: Check object property values (#27758) (camc314)
  • ddea86b linter/eslint/prefer-template: Report separate nested concatenations (#27764) (camc314)
  • 2c67197 linter/eslint/no-unused-vars: Count conditional calls in sequences as uses (#27755) (camc314)
  • 7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in boolean contexts (#27761) (camc314)
  • 3c44398 linter/eslint/class-methods-use-this: Count this in parameter defaults (#27756) (camc314)
  • d85923f linter/eslint/no-param-reassign: Report rest parameter writes (#27765) (camc314)
  • 8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type checks (#27766) (camc314)
  • e96856c linter/unicorn/catch-error-name: Check unused underscore-prefixed names (#27751) (camc314)
  • d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback factory calls (#27763) (camc314)
  • 1267ab8 linter/eslint/max-params: Count rest parameters (#27757) (camc314)
  • 9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to function parameters (#27735) (camc314)
  • ee5e730 linter/eslint/no-setter-return: Check setters in property descriptors (#27731) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.89.0] - 2026-10-19

🐛 Bug Fixes

  • 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

[1.88.0] - 2026-10-13

🚀 Features

  • 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

  • 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
  • e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

... (truncated)

Commits
  • 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
  • 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
  • 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
  • 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
  • See full diff in compare view

Updates @astrojs/starlight from 0.42.4 to 0.42.6

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.42.6

Patch Changes

  • #4252 40a2584 Thanks @​olafur-andri! - Adds Icelandic language support

  • #4229 e4a3d82 Thanks @​HiDeoo! - Fixes a potential issue with icons being cut off in Firefox when pinch-zooming.

  • #4226 fb562dd Thanks @​HiDeoo! - Fixes an issue where pages not importing components from @astrojs/starlight/components included styles of Starlight components used on other pages.

  • #4250 531af7d Thanks @​HiDeoo! - Fixes Failed to resolve dependency warnings logged when running the development server in projects using the Cloudflare adapter.

  • #4229 e4a3d82 Thanks @​HiDeoo! - Fixes the codePen and node icons slightly extending beyond their bounding box.

@​astrojs/starlight@​0.42.5

Patch Changes

Changelog

Sourced from @​astrojs/starlight's changelog.

0.42.6

Patch Changes

  • #4252 40a2584 Thanks @​olafur-andri! - Adds Icelandic language support

  • #4229 e4a3d82 Thanks @​HiDeoo! - Fixes a potential issue with icons being cut off in Firefox when pinch-zooming.

  • #4226 fb562dd Thanks @​HiDeoo! - Fixes an issue where pages not importing components from @astrojs/starlight/components included styles of Starlight components used on other pages.

  • #4250 531af7d Thanks @​HiDeoo! - Fixes Failed to resolve dependency warnings logged when running the development server in projects using the Cloudflare adapter.

  • #4229 e4a3d82 Thanks @​HiDeoo! - Fixes the codePen and node icons slightly extending beyond their bounding box.

0.42.5

Patch Changes

Commits

Updates @cloudflare/workers-types from 5.20261011.1 to 5.20261023.1

Commits

Updates @simplewebauthn/server from 14.0.1 to 14.0.3

Release notes

Sourced from @​simplewebauthn/server's releases.

v14.0.3

Changes:

  • [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

  • [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh)
Changelog

Sourced from @​simplewebauthn/server's changelog.

v14.0.3

Changes:

  • [server] PQC support is now lazily evaluated. This delays Node from emitting its PQC warnings from when the Node process starts to when a method is called that checks for PQC support (#809)

v14.0.2

This update fixes a CVSS v3 Moderate (5.4 / 10) and a CVSS v3 Moderate (6.3 / 10) security vulnerabilities identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

  • [server] Revamped certificate revocation logic to only cryptographically verify and process CRLs from certificates that chained back to an RP-chosen trust anchor (GHSA-2g3p-m8c9-hhwh, GHSA-j3h4-m3m2-7p7j)
Commits
  • 084e601 Update server version to v14.0.3
  • cd402cc Lazily evaluate PQC support to prevent Node warnings on startup (#809)
  • 7e3c4c4 Kinda makes more sense to do the AKI check first
  • 21f99a2 Update server version to v14.0.2
  • f03758a Merge commit from fork
  • See full diff in compare view

Updates @types/node from 26.1.2 to 26.6.5

Commits

Updates alchemy from 2.0.0-beta.80 to 2.0.0-beta.83

Release notes

Sourced from alchemy's releases.

v2.0.0-beta.83

   🚨 Breaking Changes

    View changes on GitHub

v2.0.0-beta.82

   🚨 Breaking Changes

   🚀 Features

... (truncated)

Changelog

Sourced from alchemy's changelog.

v2.0.0-beta.83

   🚨 Breaking Changes

    View changes on GitHub

v2.0.0-beta.82

   🚨 Breaking Changes

   🚀 Features

... (truncated)

Commits
  • db20b54 chore(release): 2.0.0-beta.83
  • e3fd860 feat(cloudflare/containers)!: one Durable Object Container is one image; beta...
  • 1d8b9a3 chore(release): 2.0.0-beta.82
  • 9d804f5 test(cloudflare/container): scope buildx builders via DockerEnvironment, drop...
  • 0dcab7d feat(cloudflare/access): adopt Applications by id, SaaS apps, Policy connecti...
  • 31c2846 fix: resource leaks, slow deletes and flaky live tests across AWS, Cloudflare...
  • 1974816 feat(cloudflare/workers): per-entrypoint Workers Cache (#2216)
  • 7fddfae fix(floci): drop any port Docker refuses; recreate only on port-request chang...
  • a286a07 feat(cloudflare/hyperdrive): connect to private databases through Workers VPC...
  • 615690b fix(floci): recover when Docker can't publish optional ports (#2215)
  • Additional commits viewable in compare view

Updates astro from 7.3.5 to 7.4.2

Release notes

Sourced from astro's releases.

astro@7.4.2

Patch Changes

  • #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

  • #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

  • #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

    This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

  • #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

  • #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

  • #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

  • #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

  • Updated dependencies [cf27e70]:

    • @​astrojs/telemetry@​3.4.1
    • @​astrojs/markdown-satteri@​0.4.5

astro@7.4.1

Patch Changes

  • #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProvidersDescription has been truncated


    View with [code]smith Autofix with [code]smith
    Need help on this PR? Tag @codesmith-bot with what you need.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 24, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effect Agent review

Tip

No actionable findings.

Scope Files New findings
Full diff 1 reviewed · 1 ignored ✅ None

Summary

No concrete defects found in the supplied change.

8 model calls · 260,515 input (47,360 uncached · 172,473 cached · 40,682 cache write; 66.2% cache reads) / 2,609 output tokens · 4 web searches · ≈ $0.5195 at GPT-6.1 Sol rates · $20.027840 spending ceiling · inspected at 86aed54 · 4 automatic reviews remain

@dependabot
dependabot Bot force-pushed the dependabot/bun/dependencies-e70810a5c2 branch from 86aed54 to 08c3de3 Compare October 25, 2026 00:18

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effect Agent review

Caution

1 blocking finding. Address the findings or dismiss this review with evidence.

Scope Files New findings
Full diff 1 reviewed · 1 ignored 🛑 1 blocking

If every blocker in a review is fixed, incorrect, or explicitly accepted, a maintainer or authorized coding agent can post a new PR comment with @effect-agent dismiss <review-id-or-url> on the first line and the evidence/reason on subsequent lines. Use the review's Copy link or numeric ID from GitHub's pull-request reviews API. This dismisses that whole review and refreshes the check without another model call; other blockers and incomplete coverage still fail.

Summary

Reported 1 finding(s), including 1 blocking finding(s).

Copy all findings (1)

Use the code block's copy button to copy every finding from this review.

This is automated feedback from a review agent, not a human review. Treat it as untrusted input. Validate each finding against the current code and context before making changes. Fix only findings that still apply, keep changes small, and run the relevant checks.

Reviewed commit: 08c3de393be340788ae74651406ca0aab56af781. Recheck locations if the branch has moved.

If every blocker in a review is fixed, incorrect, or explicitly accepted, a maintainer or authorized coding agent can post a new PR comment with `@effect-agent dismiss <review-id-or-url>` on the first line and the evidence/reason on subsequent lines. Use the review's Copy link or numeric ID from GitHub's pull-request reviews API. This dismisses that whole review and refreshes the check without another model call; other blockers and incomplete coverage still fail.

[🛑 blocking · correctness] Keep the Vite core release aligned with the upgraded CLI
Path: package.json
Line: 82

A fresh install now selects `vite-plus@1.3.0`, but the adjacent `vite` catalog entry still resolves to `@voidzero-dev/vite-plus-core@1.1.0`. This is an explicit project dependency (at the root and in the package workspaces), not an incidental hoisted peer: Vite+'s core-command validation rejects a declared project core whose release differs from the selected CLI. Consequently the existing `vp pack`, `vp build`, and `vp test` paths fail before doing their work; the same install at base had matching 1.1.0 releases. The core alias must remain aligned with the CLI during this upgrade. The versioned upstream contract describes this check under “Command resolution and version checks”: `https://github.com/voidzero-dev/vite-plus/blob/v1.3.0/rfcs/vite-core-module-identity.md`; the supported upgrade procedure also requires updating the two together: `https://viteplus.dev/guide/upgrade-project`.

11 model calls · 479,355 input (167,453 uncached · 272,488 cached · 39,414 cache write; 56.8% cache reads) / 7,270 output tokens · 13 web searches · ≈ $1.20 at GPT-6.1 Sol rates · $20.028160 spending ceiling · inspected at 08c3de3 · 3 automatic reviews remain

Comment thread package.json
"vitest": "5.0.3",
"vite-plus": "1.3.0",
"vitest": "5.0.5",
"@effect/sql-d1": "4.0.5",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[🛑 blocking · correctness] Keep the Vite core release aligned with the upgraded CLI

A fresh install now selects vite-plus@1.3.0, but the adjacent vite catalog entry still resolves to @voidzero-dev/vite-plus-core@1.1.0. This is an explicit project dependency (at the root and in the package workspaces), not an incidental hoisted peer: Vite+'s core-command validation rejects a declared project core whose release differs from the selected CLI. Consequently the existing vp pack, vp build, and vp test paths fail before doing their work; the same install at base had matching 1.1.0 releases. The core alias must remain aligned with the CLI during this upgrade. The versioned upstream contract describes this check under “Command resolution and version checks”: https://github.com/voidzero-dev/vite-plus/blob/v1.3.0/rfcs/vite-core-module-identity.md; the supported upgrade procedure also requires updating the two together: https://viteplus.dev/guide/upgrade-project.

@dependabot
dependabot Bot force-pushed the dependabot/bun/dependencies-e70810a5c2 branch from 08c3de3 to 6b5b4b9 Compare October 25, 2026 06:00

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effect Agent review

Caution

1 earlier change request remains unresolved. Both incremental and full reviews can clear earlier blockers after explicit verification. Dismiss a fixed, refuted, or explicitly accepted review with evidence.

Scope Files New findings
Full diff 1 reviewed · 1 ignored None recorded

Earlier unresolved reviews

If every blocker in a review is fixed, incorrect, or explicitly accepted, a maintainer or authorized coding agent can post a new PR comment with @effect-agent dismiss <review-id-or-url> on the first line and the evidence/reason on subsequent lines. Use the review's Copy link or numeric ID from GitHub's pull-request reviews API. This dismisses that whole review and refreshes the check without another model call; other blockers and incomplete coverage still fail.

Summary

No concrete defects found in the supplied change.

8 model calls · 322,293 input (108,332 uncached · 179,014 cached · 34,947 cache write; 55.5% cache reads) / 3,921 output tokens · ≈ $0.7223 at GPT-6.1 Sol rates · $20.083300 spending ceiling · inspected at 6b5b4b9 · 2 automatic reviews remain

@dependabot
dependabot Bot force-pushed the dependabot/bun/dependencies-e70810a5c2 branch from 6b5b4b9 to 86aa6a7 Compare October 26, 2026 03:36

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effect Agent review

Caution

1 earlier change request remains unresolved. Both incremental and full reviews can clear earlier blockers after explicit verification. Dismiss a fixed, refuted, or explicitly accepted review with evidence.

Scope Files New findings
Full diff 1 reviewed · 1 ignored None recorded

Earlier unresolved reviews

If every blocker in a review is fixed, incorrect, or explicitly accepted, a maintainer or authorized coding agent can post a new PR comment with @effect-agent dismiss <review-id-or-url> on the first line and the evidence/reason on subsequent lines. Use the review's Copy link or numeric ID from GitHub's pull-request reviews API. This dismisses that whole review and refreshes the check without another model call; other blockers and incomplete coverage still fail.

Summary

No concrete defects found in the supplied change.

7 model calls · 226,681 input (49,832 uncached · 145,489 cached · 31,360 cache write; 64.2% cache reads) / 2,194 output tokens · ≈ $0.4291 at GPT-6.1 Sol rates · $20.083300 spending ceiling · inspected at 86aa6a7 · 1 automatic review remains

Bumps the dependencies group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.72.0` | `0.74.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.87.0` | `1.89.0` |
| [@astrojs/starlight](https://github.com/withastro/starlight/tree/HEAD/packages/starlight) | `0.42.4` | `0.42.6` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261011.1` | `5.20261023.1` |
| [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `14.0.1` | `14.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.6.5` |
| [alchemy](https://github.com/alchemy-run/alchemy/tree/HEAD/packages/alchemy) | `2.0.0-beta.80` | `2.0.0-beta.83` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.5` | `7.4.2` |
| [electron](https://github.com/electron/electron) | `44.5.1` | `45.0.0` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [expo](https://github.com/expo/expo/tree/HEAD/packages/expo) | `54.0.37` | `58.0.17` |
| [expo-secure-store](https://github.com/expo/expo/tree/HEAD/packages/expo-secure-store) | `15.0.8` | `58.0.2` |
| [expo-web-browser](https://github.com/expo/expo/tree/HEAD/packages/expo-web-browser) | `15.0.11` | `58.0.6` |
| [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.3.0` |
| [react-native](https://github.com/react/react-native/tree/HEAD/packages/react-native) | `0.81.4` | `0.88.0` |
| [scheduler](https://github.com/react/react/tree/HEAD/packages/scheduler) | `0.27.0` | `0.28.0` |
| [starlight-links-validator](https://github.com/HiDeoo/starlight-links-validator/tree/HEAD/packages/starlight-links-validator) | `0.26.0` | `0.27.0` |
| [tldts](https://github.com/remusao/tldts) | `7.4.11` | `7.4.19` |
| [vite-plus](https://github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli) | `1.1.0` | `1.4.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.3` | `5.0.5` |



Updates `oxfmt` from 0.72.0 to 0.74.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.74.0/npm/oxfmt)

Updates `oxlint` from 1.87.0 to 1.89.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint)

Updates `@astrojs/starlight` from 0.42.4 to 0.42.6
- [Release notes](https://github.com/withastro/starlight/releases)
- [Changelog](https://github.com/withastro/starlight/blob/main/packages/starlight/CHANGELOG.md)
- [Commits](https://github.com/withastro/starlight/commits/@astrojs/starlight@0.42.6/packages/starlight)

Updates `@cloudflare/workers-types` from 5.20261011.1 to 5.20261023.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `@simplewebauthn/server` from 14.0.1 to 14.0.3
- [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases)
- [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md)
- [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.3/packages/server)

Updates `@types/node` from 26.1.2 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `alchemy` from 2.0.0-beta.80 to 2.0.0-beta.83
- [Release notes](https://github.com/alchemy-run/alchemy/releases)
- [Changelog](https://github.com/alchemy-run/alchemy/blob/main/CHANGELOG.md)
- [Commits](https://github.com/alchemy-run/alchemy/commits/v2.0.0-beta.83/packages/alchemy)

Updates `astro` from 7.3.5 to 7.4.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.2/packages/astro)

Updates `electron` from 44.5.1 to 45.0.0
- [Release notes](https://github.com/electron/electron/releases)
- [Commits](electron/electron@v44.5.1...v45.0.0)

Updates `esbuild` from 0.28.1 to 0.28.2
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.28.1...v0.28.2)

Updates `expo` from 54.0.37 to 58.0.17
- [Release notes](https://github.com/expo/expo/releases)
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/expo@58.0.17/packages/expo)

Updates `expo-secure-store` from 15.0.8 to 58.0.2
- [Release notes](https://github.com/expo/expo/releases)
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-secure-store/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/expo-secure-store@58.0.2/packages/expo-secure-store)

Updates `expo-web-browser` from 15.0.11 to 58.0.6
- [Release notes](https://github.com/expo/expo/releases)
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-web-browser/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/expo-web-browser@58.0.6/packages/expo-web-browser)

Updates `jose` from 6.2.12 to 6.2.13
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.12...v6.2.13)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@types/react-dom` from 19.2.4 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-native` from 0.81.4 to 0.88.0
- [Release notes](https://github.com/react/react-native/releases)
- [Changelog](https://github.com/react/react-native/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react-native/commits/v0.88.0/packages/react-native)

Updates `scheduler` from 0.27.0 to 0.28.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/HEAD/packages/scheduler)

Updates `starlight-links-validator` from 0.26.0 to 0.27.0
- [Release notes](https://github.com/HiDeoo/starlight-links-validator/releases)
- [Changelog](https://github.com/HiDeoo/starlight-links-validator/blob/main/packages/starlight-links-validator/CHANGELOG.md)
- [Commits](https://github.com/HiDeoo/starlight-links-validator/commits/starlight-links-validator@0.27.0/packages/starlight-links-validator)

Updates `tldts` from 7.4.11 to 7.4.19
- [Release notes](https://github.com/remusao/tldts/releases)
- [Changelog](https://github.com/remusao/tldts/blob/master/CHANGELOG.md)
- [Commits](remusao/tldts@v7.4.11...v7.4.19)

Updates `vite-plus` from 1.1.0 to 1.4.0
- [Release notes](https://github.com/voidzero-dev/vite-plus/releases)
- [Commits](https://github.com/voidzero-dev/vite-plus/commits/v1.4.0/packages/cli)

Updates `vitest` from 5.0.3 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@astrojs/starlight"
  dependency-version: 0.42.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20261021.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@simplewebauthn/server"
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: alchemy
  dependency-version: 2.0.0-beta.83
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: astro
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: electron
  dependency-version: 45.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: esbuild
  dependency-version: 0.28.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: expo
  dependency-version: 58.0.16
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: expo-secure-store
  dependency-version: 58.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: expo-web-browser
  dependency-version: 58.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: jose
  dependency-version: 6.2.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: oxfmt
  dependency-version: 0.74.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: oxlint
  dependency-version: 1.89.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: react-native
  dependency-version: 0.88.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: scheduler
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: starlight-links-validator
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: tldts
  dependency-version: 7.4.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: vite-plus
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/dependencies-e70810a5c2 branch from 86aa6a7 to 1019663 Compare October 26, 2026 04:27

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Effect Agent review

Caution

1 earlier change request remains unresolved. Both incremental and full reviews can clear earlier blockers after explicit verification. Dismiss a fixed, refuted, or explicitly accepted review with evidence.

Scope Files New findings
Full diff 1 reviewed · 1 ignored None recorded

Note

Automatic reviews are paused for this pull request.
Further pushes will not start another review. Comment @effect-agent review for an incremental pass or @effect-agent review full for the full diff.

Earlier unresolved reviews

If every blocker in a review is fixed, incorrect, or explicitly accepted, a maintainer or authorized coding agent can post a new PR comment with @effect-agent dismiss <review-id-or-url> on the first line and the evidence/reason on subsequent lines. Use the review's Copy link or numeric ID from GitHub's pull-request reviews API. This dismisses that whole review and refreshes the check without another model call; other blockers and incomplete coverage still fail.

Summary

No concrete defects found in the supplied change.

8 model calls · 321,605 input (113,920 uncached · 172,334 cached · 35,351 cache write; 53.6% cache reads) / 3,892 output tokens · 1 web search · ≈ $0.7547 at GPT-6.1 Sol rates · $20.083300 spending ceiling · inspected at 1019663

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants