chore(deps): bump the cli-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the cli-dependencies group with 8 updates in the /cli directory:

Package	From	To
@clack/prompts	1.7.0	1.8.1
oauth4webapi	3.8.7	3.8.8
yaml	2.9.0	2.9.1
@types/bun	1.4.0	1.4.2
knip	6.32.2	6.35.1
oxfmt	0.63.0	0.67.0
oxlint	1.78.0	1.82.0
typescript	6.0.3	7.0.2

Updates @clack/prompts from 1.7.0 to 1.8.1

Release notes

Sourced from @​clack/prompts's releases.

@​clack/prompts@​1.8.1

Patch Changes

• 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

• Updated dependencies [8bd9129]:

  • @​clack/core@​1.5.1

@​clack/prompts@​1.8.0

Minor Changes

• #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

• #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

• #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

• #588 6506135 Thanks @​danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

• #599 0547d6f Thanks @​43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

• Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

  • @​clack/core@​1.5.0

Changelog

Sourced from @​clack/prompts's changelog.

1.8.1

Patch Changes

• 8bd9129 Thanks @​gameroman! - Return type for prompts now correctly specifies CANCEL_SYMBOL instead of symbol

• Updated dependencies [8bd9129]:

  • @​clack/core@​1.5.1

1.8.0

Minor Changes

• #592 caa32e8 Thanks @​gameroman! - Export CANCEL_SYMBOL constant from @clack/core and @clack/prompts

• #594 37fca4e Thanks @​dreyfus92! - Add tab-completion to the path prompt: pressing Tab fills the input with the focused suggestion, so you can quickly descend into deep directories (type / and Tab again). Powered by a new opt-in completeOnTab option on autocomplete, which also shows a Tab: complete hint in the instructions footer. Default autocomplete behavior is unchanged.

• #583 ae636dd Thanks @​43081j! - Add async validation support to prompts, and validation state rendering to text prompts.

Patch Changes

• #588 6506135 Thanks @​danielroe! - Style the guide bar rendered by box({ withGuide: true }) in grey so it matches the gutter drawn by log, note and the spinner

• #599 0547d6f Thanks @​43081j! - Fixes a withGuide rendering issue leaving extra spaces in text prompts.

• Updated dependencies [227583e, caa32e8, 37fca4e, ae636dd, b20fa2b]:

  • @​clack/core@​1.5.0

Commits

• da44e23 [ci] release (#605)
• 8bd9129 fix: correctly specify return type of CANCEL_SYMBOL (#601)
• de1ef16 [ci] release (#589)
• 0547d6f fix: output submit gap only when guide enabled (#599)
• ae636dd feat: add async validation (#583)
• 37fca4e feat(prompts): add tab-completion to path prompt (#594)
• caa32e8 feat: export CANCEL_SYMBOL (#592)
• 8d81248 chore: stop publishing CHANGELOG.md to npm (#591)
• e238070 test(box): remove redundant test (#590)
• 6506135 fix(prompts): style box guide bar to match other gutters (#588)
• See full diff in compare view

Updates oauth4webapi from 3.8.7 to 3.8.8

Release notes

Sourced from oauth4webapi's releases.

v3.8.8

Fixes

• accept space runs in Bearer and DPoP credentials (3414db5)
• decode HTTP authentication quoted pairs correctly (bd7fcb0)
• forward arguments to AVA test runners (b898ba5)
• honor explicit auth-time skips in authorization responses (656d762)
• recognize DPoP nonce errors among multiple challenges (70bd8a1)
• release: separate changelog sections (a827c39)
• validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

• consolidate ID Token validation policy (53900cc)

Performance

• cache imported issuer verification keys by algorithm (fbe6c02)
• coalesce compatible in-flight JWKS requests (e64849e)

Changelog

Sourced from oauth4webapi's changelog.

3.8.8 (2026-09-05)

Fixes

• accept space runs in Bearer and DPoP credentials (3414db5)
• decode HTTP authentication quoted pairs correctly (bd7fcb0)
• forward arguments to AVA test runners (b898ba5)
• honor explicit auth-time skips in authorization responses (656d762)
• recognize DPoP nonce errors among multiple challenges (70bd8a1)
• release: separate changelog sections (a827c39)
• validate ID Token subjects and DPoP identifiers as strings (edbebeb)

Refactor

• consolidate ID Token validation policy (53900cc)

Performance

• cache imported issuer verification keys by algorithm (fbe6c02)
• coalesce compatible in-flight JWKS requests (e64849e)

Commits

• 916b979 chore(release): 3.8.8
• eb564a4 test: accept WebCrypto DOMException rejections on Node 20
• fbe6c02 perf: cache imported issuer verification keys by algorithm
• e64849e perf: coalesce compatible in-flight JWKS requests
• 53900cc refactor: consolidate ID Token validation policy
• edbebeb fix: validate ID Token subjects and DPoP identifiers as strings
• bd7fcb0 fix: decode HTTP authentication quoted pairs correctly
• 3414db5 fix: accept space runs in Bearer and DPoP credentials
• 656d762 fix: honor explicit auth-time skips in authorization responses
• b898ba5 fix: forward arguments to AVA test runners
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

• See full diff in compare view

Updates knip from 6.32.2 to 6.35.1

Release notes

Sourced from knip's releases.

Release 6.35.1

• Exit with code 2 when a plugin config file fails to load (#1947) (37b26426694380ef70ee45f63358faf63355a58d) - thanks @​WooWan!
• Fix sponsorship income calculations (0d9cf344b8cc0104c06d11e2c78f3f01b1df548b)
• Update sponsors page (2659063d87f558b4fc18369a4b143849eaa7543e)
• Fix npm alias attribution under Yarn PnP (resolve #2024) (7be11aa4fd50b8a3d6e276f03efb450d6d142c26)

Release 6.35.0

• fix: track pnpm workspace override catalogs (#1999) (c6497a18c6534ee914b27bb459d7778a7b93a914) - thanks @​gioboa!
• fix: track spreads under string-literal keys (#2003) (9ce68ed42a3c22fa4f4711b06d6d80a0e7f2ba13) - thanks @​gioboa!
• fix: don't flag a tag that suppresses member issues (#2004) (2e7d498cf1e53f0bbad5e16c335c5e1417432ffd) - thanks @​devYRPauli!
• fix: resolve Nuxt Virtual Component Imports (#2006) (a21f972ed68aaa6d145dd883b4ce4d68c71e6afb) - thanks @​gioboa!
• Update raw transfer problems doc with low RAM machines (#2014) (31789404cca5a8ba119b4ae97b959b7e2c595345) - thanks @​s-h-a-d-o-w!
• fix: recognize pnpm stage as built-in (#2015) (aaab35a948b458e3031989c13c13d099fdd6f229) - thanks @​gioboa!
• fix: support object-form Rstest test environments (#2010) (6c27aab20de5b6d31d71513b016548e74fc494ba) - thanks @​gioboa!
• fix: honor explicit entry export analysis (#2012) (a092e4075a6a37107c0da05c8e59343d5a7c8fab) - thanks @​gioboa!
• Document that pnpm.overrides is read from the root manifest only (f69a7f6d4fa2c68f76a9ba91fb876c5963a9e978)
• Compile source on demand (resolve #1906) (3662c9545e8bb980a5503fdea48ecc6f7e2ad3b3)
• Update dependency bun to v1.4.2 (#2019) (90b384da25203c07acb9303336622f794d77b575) - thanks @​renovate[bot]!
• feat: support configuring preprocessors in knip.json (#1920) (16d03f75ae752cb419684868ff14d89b01e84e62) - thanks @​bytedoe!
• Fix Windows paths in cache persistence and test fixtures (a4c7a93a81e04afde09d7977298b397cee9a68c2)
• fix: add a fallback to seach for lock file at cwd if its missing at the root level (#2020) (f66c9f1631347f0256f2276748de89b0d8448017) - thanks @​JayaKrishnaNamburu!
• fix: ignore raw Vite import globs (#2017) (75d56286b41ba3e3b4aad53b603736ec357fac75) - thanks @​gioboa!
• Edit docs re. cycles issue type/reporter (resolve #2021) (f1e690b5a4d8f2b3d13388aa3a95216b9691becb)
• Update dependencies (e2bd3fcc2274b52d35adf0eaec2c555d74873433)
• Resolve Vite public script entries (resolve #2023) (1cc979b7e37a4dcde5e8e9e75a8d79cf663c606e)
• Add mise plugin (resolve #2001) (db6d8919af4e870432cdda205e6271a166c84645)
• Add editor severity setting for diagnostics (resolve #1955) (4afbbcf8b16454a1d1c201d50cf8e8bd28d2cb91)

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)
• 💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @​DreamLongYT!
• Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)
• Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)
• Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)
• Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)
• fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @​devYRPauli!
• fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @​gioboa!
• Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @​DreamLongYT!
• Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)
• Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)
• Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!

... (truncated)

Commits

• 68a5344 Release knip@6.35.1
• 7be11aa Fix npm alias attribution under Yarn PnP (resolve #2024)
• 37b2642 Exit with code 2 when a plugin config file fails to load (#1947)
• c2d652c Release knip@6.35.0
• 4afbbcf Add editor severity setting for diagnostics (resolve #1955)
• db6d891 Add mise plugin (resolve #2001)
• 1cc979b Resolve Vite public script entries (resolve #2023)
• e2bd3fc Update dependencies
• 75d5628 fix: ignore raw Vite import globs (#2017)
• a4c7a93 Fix Windows paths in cache persistence and test fixtures
• Additional commits viewable in compare view

Updates oxfmt from 0.63.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
• fed6681 docs(oxfmt): skip expanding overrides options (#25572)
• See full diff in compare view

Updates oxlint from 1.78.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

• Oxlint v1.82.0
• Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

• aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
• 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
• 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
• 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
• 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
• 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
• 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
• 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
• a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
• 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
• b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
• 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
• 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
• 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

• 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

• f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
• 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
• 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
• aa49d86 fix(linter): allow spread rule options in config types (#25675)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[albert20260301]

TypeScript 7 is incompatible with the retained openapi-typescript 7.13.0 dependency. I opened #111 as a stacked fix that keeps TypeScript at 6.0.3 and adds the narrowing required for the CLI to typecheck under that version. It preserves the other seven updates in this group.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.