Skip to content

chore(deps): bump the cli-dependencies group in /cli with 6 updates - #105

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/cli/cli-dependencies-7101ef38b0
Closed

chore(deps): bump the cli-dependencies group in /cli with 6 updates#105
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/cli/cli-dependencies-7101ef38b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the cli-dependencies group in /cli with 6 updates:

Package From To
oauth4webapi 3.8.7 3.8.8
@types/bun 1.4.0 1.4.1
knip 6.32.2 6.34.0
oxfmt 0.63.0 0.66.0
oxlint 1.78.0 1.81.0
typescript 6.0.3 7.0.2

Updates oauth4webapi from 3.8.7 to 3.8.8

Release notes

Sourced from oauth4webapi's releases.

v3.8.8

Fixes

  • accept space runs in Bearer and DPoP credentials (3414db5)
  • decode HTTP authentication quoted pairs correctly (bd7fcb0)
  • forward arguments to AVA test runners (b898ba5)
  • honor explicit auth-time skips in authorization responses (656d762)
  • recognize DPoP nonce errors among multiple challenges (70bd8a1)
  • release: separate changelog sections (a827c39)
  • validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

  • consolidate ID Token validation policy (53900cc)

Performance

  • cache imported issuer verification keys by algorithm (fbe6c02)
  • coalesce compatible in-flight JWKS requests (e64849e)
Changelog

Sourced from oauth4webapi's changelog.

3.8.8 (2026-09-05)

Fixes

  • accept space runs in Bearer and DPoP credentials (3414db5)
  • decode HTTP authentication quoted pairs correctly (bd7fcb0)
  • forward arguments to AVA test runners (b898ba5)
  • honor explicit auth-time skips in authorization responses (656d762)
  • recognize DPoP nonce errors among multiple challenges (70bd8a1)
  • release: separate changelog sections (a827c39)
  • validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

  • consolidate ID Token validation policy (53900cc)

Performance

  • cache imported issuer verification keys by algorithm (fbe6c02)
  • coalesce compatible in-flight JWKS requests (e64849e)
Commits
  • 916b979 chore(release): 3.8.8
  • eb564a4 test: accept WebCrypto DOMException rejections on Node 20
  • fbe6c02 perf: cache imported issuer verification keys by algorithm
  • e64849e perf: coalesce compatible in-flight JWKS requests
  • 53900cc refactor: consolidate ID Token validation policy
  • edbebeb fix: validate ID Token subjects and DPoP identifiers as strings
  • bd7fcb0 fix: decode HTTP authentication quoted pairs correctly
  • 3414db5 fix: accept space runs in Bearer and DPoP credentials
  • 656d762 fix: honor explicit auth-time skips in authorization responses
  • b898ba5 fix: forward arguments to AVA test runners
  • Additional commits viewable in compare view

Updates @types/bun from 1.4.0 to 1.4.1

Commits

Updates knip from 6.32.2 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

  • fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
  • 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
  • Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
  • Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
  • Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
  • Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
  • fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
  • fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
  • Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
  • Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
  • Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
  • Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

  • Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
  • Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
  • Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
  • Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
  • Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
  • Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
  • fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
  • Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
  • Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
  • Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
  • Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
  • Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
  • Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
  • Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
  • Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
  • Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
  • fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
  • fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
  • Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
  • fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
  • Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
  • Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
  • Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
  • Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
  • Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
  • Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
  • Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
  • Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Release 6.32.3

  • Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)
  • Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)
  • Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)
  • fix(tsup): match config files with .cts and .mts extensions (#1938) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks @​codeAnqiang-ma!
  • fix(lefthook): match all config file names and extensions (#1940) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks @​codeAnqiang-ma!

... (truncated)

Commits
  • 4ffebb7 Release knip@6.34.0
  • f0cf11d Assert counters in targeted regression tests
  • 96ff2df Declare webpack directly instead of through @types/webpack
  • c4e0f08 Update dependencies
  • cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
  • 462ae45 fix: compile files with workspace-scoped compilers (#1997)
  • ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
  • 964085d Set an explicit Bun test timeout
  • 1c90b49 Make prop access consistent while at it
  • f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
  • Additional commits viewable in compare view

Updates oxfmt from 0.63.0 to 0.66.0

Commits

Updates oxlint from 1.78.0 to 1.81.0

Release notes

Sourced from oxlint's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

Oxlint v1.81.0

🚀 Features

  • 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

  • 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
  • baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
  • 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
  • fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
  • e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
  • d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
  • 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
  • 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
  • bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)
  • 3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)
  • 047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)
  • 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
  • dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

  • 464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)
  • 9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)
  • db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)
  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

  • 1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

  • 9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)
  • 769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)
  • 5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)
  • 2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)
  • 1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)
  • 57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)
  • e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)
  • a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)
  • 676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)
Commits
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
  • aa49d86 fix(linter): allow spread rule options in config types (#25675)
  • 8922381 refactor(linter): remove inactive react config rule (#25740)
  • 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
  • 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
  • Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits
  • 1e4744d Merge branch 'main' into ts7-release
  • a5a219cmicrosoft/typescript-go#4558
  • ecfe30d Update status localization
  • 5de25b5 Hide executable name in TypeScript status
  • d7ce74a Show bundled TypeScript version for packaged servers
  • 29be66a Correct TS 7 release version to 7.0.2
  • ed2bd1b Merge branch 'main' into ts7-release
  • 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
  • 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
  • d4eaca5microsoft/typescript-go#4549
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the cli-dependencies group in /cli with 6 updates
b6bfe35 
Bumps the cli-dependencies group in /cli with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [oauth4webapi](https://github.com/panva/oauth4webapi) | `3.8.7` | `3.8.8` |
| [@types/bun](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/bun) | `1.4.0` | `1.4.1` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.32.2` | `6.34.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.66.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.81.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |


Updates `oauth4webapi` from 3.8.7 to 3.8.8
- [Release notes](https://github.com/panva/oauth4webapi/releases)
- [Changelog](https://github.com/panva/oauth4webapi/blob/main/CHANGELOG.md)
- [Commits](panva/oauth4webapi@v3.8.7...v3.8.8)

Updates `@types/bun` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/bun)

Updates `knip` from 6.32.2 to 6.34.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.34.0/packages/knip)

Updates `oxfmt` from 0.63.0 to 0.66.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.66.0/npm/oxfmt)

Updates `oxlint` from 1.78.0 to 1.81.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.81.0/npm/oxlint)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v6.0.3...v7.0.2)

---
updated-dependencies:
- dependency-name: oauth4webapi
  dependency-version: 3.8.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: cli-dependencies
- dependency-name: "@types/bun"
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: cli-dependencies
- dependency-name: knip
  dependency-version: 6.34.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cli-dependencies
- dependency-name: oxfmt
  dependency-version: 0.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cli-dependencies
- dependency-name: oxlint
  dependency-version: 1.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: cli-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: cli-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 9, 2026
albert20260301
albert20260301 suggested changes Sep 9, 2026
View reviewed changes

@albert20260301 albert20260301 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The TypeScript 7 upgrade breaks the required canonical integration check: openapi-typescript calls ts.factory.createKeywordTypeNode, which is unavailable in this compiler release. Please keep TypeScript on a compatible version (or update openapi-typescript to a compatible release) and rerun the full verification matrix before this dependency group can merge.

@albert20260301 albert20260301 mentioned this pull request Sep 12, 2026
Closed
@albert20260301

albert20260301 commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

TypeScript 7 makes the generated-artifact check crash inside openapi-typescript@7.13.0 because ts.factory.createKeywordTypeNode is no longer available. I opened stacked PR #107 to retain TypeScript 6.0.3 while preserving the other five dependency updates. Its CI will validate the batch against the repository's pinned Bun 1.4.0 toolchain.

@dependabot @github

dependabot Bot commented on behalf of github Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 16, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/cli/cli-dependencies-7101ef38b0 branch September 16, 2026 19:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@albert20260301 albert20260301 albert20260301 requested changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@albert20260301