Skip to content

chore(deps-dev): bump the dev-tooling group across 1 directory with 4 updates - #11

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a348a82013
Open

chore(deps-dev): bump the dev-tooling group across 1 directory with 4 updates#11
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/dev-tooling-a348a82013

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-tooling group with 4 updates in the / directory: knip, lefthook, react-doctor and vitest.

Updates knip from 6.38.0 to 6.40.0

Release notes

Sourced from knip's releases.

Release 6.40.0

  • Resolve local and scope-only extends in commitlint plugin (#2079) (e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks @​giaBaoJS!
  • Clarify worktree guides and plugin review preparation (dd02baf020d23af1d47c44c1a726a61014b270bd)
  • Document stale cache results and workarounds (#2078) (3573749a5d5bbee6305f207cc7d1b72c200c8c9b)
  • Exclude test files from package entries in production mode (resolve #2082) (b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks @​jonathanong!
  • Resolve Serverless file variables in plugins and functions (resolve #2074) (99cac789694ea8d76cd38184d2d7c95f34315224) - thanks @​SwastikTripathi!
  • Preserve locally referenced namespace members (resolve #2070) (f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks @​MFA-G!
  • fix: add the commitlint-plugin prefix to Commitlint plugin names (#2096) (3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks @​devYRPauli!
  • fix: match .mjs config files in the simple-git-hooks plugin (#2097) (79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks @​devYRPauli!
  • fix: match capacitor.config.js in the Capacitor plugin (#2098) (4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks @​devYRPauli!
  • fix(typescript): ArrayExpression (#2099) (#2100) (87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks @​DreamLongYT!
  • Preserve development entry pattern groups (7c229f4e1918075d801ed3b046fa022b1d3bcc41)
  • Resolve null package exports to the files they hide (resolve #2084, close #2085) (5bd46260feb60b957c2631bc72375ef192e441e0)
  • Pin InvokeAI ecosystem test (4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)
  • fix(utils): add jsx extension to source mapping (#2087) (eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks @​DreamLongYT!
  • fix(serverless-framework): handle explicit extensions in handler paths (#2091) (e9393965be7563640921e3f20c946fcb9132e1cb) - thanks @​DreamLongYT!
  • Annotate published manifest return type (d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)
  • Add Jasmine plugin (#2105) (9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks @​SulimanAbdulrazzaq!
  • fix: resolve workspace exports with fallback arrays (#2088) (49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks @​DreamLongYT!
  • fix(postcss): ignore disabled plugins in object configs (#2092) (b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks @​DreamLongYT!
  • Resolve webServer commands in Playwright plugin (#2110) (1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks @​everton-dgn!
  • Cache config file inputs per plugin (#2109) (01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks @​everton-dgn!
  • fix: include custom compiler extensions in source path mapping (#2090) (dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks @​DreamLongYT!
  • Don't let a self-closing swallow the next (#2113) (989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks @​maniflopi!
  • fix(oxlint): resolve lint from loaded Vite config (#2108) (6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks @​everton-dgn!
  • fix: resolve Jest module names without the jest-* prefix (#2095) (a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks @​devYRPauli!
  • Resolve Vitest paths from the top-level root (resolve #2114) (#2119) (8a495d424cf60cab502c5c5ea476a3c761a9da6d) - thanks @​SwastikTripathi!
  • fix(rsbuild): detect config from tools.rspack inside rsbuild config (#2077) (c4ed619d5352b1d7b9ffaacc8c75d247eef39517) - thanks @​TkDodo!
  • Add osls plugin (#2104) (a8bf4bfaeba2ee0aaf756b343789de9fff75a1fa) - thanks @​bytedoe!
  • Explain why types in signatures of used exports are not reported (61f5cc02e6b4e895dbd8507ab845ae30f073211b)
  • Update sponsors page (7ea33fa2c116c29e2c131bda900aaf7b9073a3ff)
  • Edit docs (b459d7c3ad6d5535fd7646d93022a2974641ccd9)

Release 6.39.0

  • Add Railway plugin (#2026) (6da55767eb419701dd32f93789a00e8bdc915276) - thanks @​jonahsnider!
  • Update query snapshot (8877d3cf35943e17a617e1197fa46c5a43342479)
  • Fix excluded tags on entry re-exports (#2062) (b22e27543cb8dd4ba7ec97c70ccfd06bc8f16614) - thanks @​devYRPauli!
  • Update rolldown snapshot (3a45c806e1c1b7ceb078903652c8631566400096)
  • Skip synthetic self-imports in Vue and Nuxt auto-import compilers (#2067) (d912d807e41f140bbc79bafce6882b3c05dec6ff) - thanks @​bytedoe!
  • fix(angular): keep other projects' inputs when one has no architect (#2064) (af3f42e9772e9937fd71b7557d3b54aee1db339a) - thanks @​Cayan!
  • fix(vite): resolve nested HTML entry points in multi-page apps (#1988) (4648aefe56e7bac521bb6f17189473b46f8ff00f) - thanks @​DreamLongYT!
  • Improve Rstest plugin support (#2068) (add87992e9dfe2f3c22e4c6ba7fa257d7f0151cf) - thanks @​fi3ework!
  • Handle profiles, formatters and require paths in Cucumber plugin (#2065) (2ad39fcf02e067b4bdfc06a658bf4bf5abeea764) - thanks @​giaBaoJS!
  • fix(playwright): resolve globalSetup/globalTeardown from config dir (#2076) (7060bb968339680d694275413aba2833e4521ed9) - thanks @​alokn!
  • fix: read entry export tags under the re-exported names (#2069) (1698683df95a96b3515795eb664aacf030042d7b) - thanks @​devYRPauli!
Commits
  • dd6d422 Release knip@6.40.0
  • a8bf4bf Add osls plugin (#2104)
  • c4ed619 fix(rsbuild): detect config from tools.rspack inside rsbuild config (#2077)
  • 8a495d4 Resolve Vitest paths from the top-level root (resolve #2114) (#2119)
  • a5f4cfb fix: resolve Jest module names without the jest-* prefix (#2095)
  • 6d44e53 fix(oxlint): resolve lint from loaded Vite config (#2108)
  • 989fdad Don't let a self-closing <script /> swallow the next <script> (#2113)
  • dc3a47e fix: include custom compiler extensions in source path mapping (#2090)
  • 01cb432 Cache config file inputs per plugin (#2109)
  • 1af96bc Resolve webServer commands in Playwright plugin (#2110)
  • Additional commits viewable in compare view

Updates lefthook from 2.1.14 to 2.2.0

Release notes

Sourced from lefthook's releases.

v2.2.0

Changelog

  • 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
  • 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
  • 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)

v2.1.17

Changelog

  • 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
  • c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
  • 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
  • 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)

v2.1.16

Changelog

  • 3ee04318fd06d56a70cc9c90dc8385b19918f520 ci: refactor publishing scripts (#1559)
  • 91407e537b2fa36539506963a33e582dca394798 deps: bump mod and text deps to resolve CVEs (#1560)
  • be6f0ae8793533449cb9a07a253fa9a381e82206 fix: preserve unrelated unstaged changes on conflict (#1483)
  • cf4ef1e19baf0581871f69b40914d64c94ff19d7 fix: test staging fixed files with partially staged

v2.1.15

Changelog

  • 2388dde2b31dc9a782e967764046b41b404cece9 feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#1547)
  • 49260b57c2a56bc4d65d09395458bb3ce3c63311 fix(lfs): do not pipe stdin into post-checkout git-lfs hook (#1523)
  • 38bc1c6cef3192a36002d0dcc37973416249c07e fix: quote paths in the generated hook shim (#1509)
  • 0892f5f256ebe162485492af5ca14c2ced45586f fix: remove color blending (#1558)
  • f1de41cd5cd6a6c5e0179c65e00d5ed6d90078c2 fix: resolve push-files fallback against the remote-tracking ref (#1485)
  • 07ce565bcc73465bc18fb36561b935ee2a53eab6 fix: sanitize slashes in remote ref when building the checkout dir name (#1486)
  • c465ca8ef4fc9ee0695aa4a9530fc404ed838b7a test(cmd): regression for valid fish shell completion output (#1527)
Changelog

Sourced from lefthook's changelog.

2.2.0

2.1.7

2.1.16

2.1.15

Commits
  • 125cd28 2.2.0: new Go version and git worktree fixes
  • 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • 0bd7388 docs: publish JSON schema at lefthook.dev/schema.json (#1579)
  • 57fee37 fix: pass --output path to git diff as a single argument (#1581)
  • cc9969c fix: ignore trailing NUL in --files-from-stdin (#1574)
  • 46c65b3 deps: October 2026 (#1571)
  • 3064549 2.1.17: improve submodules and push_files support
  • c12bccd fix: don't hash submodules when checking fail_on_changes (#1566)
  • 03225ef refactor: naming of helpers (#1568)
  • 8d8073d fix: diff push files against the merge base with the default branch (#1565)
  • Additional commits viewable in compare view

Updates react-doctor from 0.9.14 to 0.9.17

Release notes

Sourced from react-doctor's releases.

react-doctor@0.9.17

Patch Changes

  • #1864 fcfb6ea Thanks @​aidenybai! - Fix false new findings in --baseline and --scope changed after formatting or editing existing flagged code. Compare finding counts per file and rule, then use fingerprints, messages, and Git line shifts to identify added findings. Skip location matching when counts do not increase. Apply portable config filters to saved baseline findings and reject reports with missing or incompatible source-dependent filter settings; regenerate those base reports with the current version and settings.

  • Updated dependencies []:

    • oxlint-plugin-react-doctor@0.9.17

react-doctor@0.9.16

Patch Changes

  • #1860 8ed70df Thanks @​aidenybai! - Fix changed-scope scans to compare findings for uncommitted changes and use flagged source spans instead of whole lines. Match duplicate findings by count and limit cross-file matches to Git renames.

    Add --baseline <report.json> to reuse a saved scan. JSON reports now include stable finding fingerprints, the source revision, the comparison source, and the number of matched base findings. Gates and summary counts use only new findings.

  • #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

  • #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

  • Updated dependencies [23d6160, 23d6160, 23d6160, 6313667, 3242a81, 8a950f0, 23d6160, 23d6160, 23d6160, 23d6160]:

    • oxlint-plugin-react-doctor@0.9.16
Changelog

Sourced from react-doctor's changelog.

0.9.17

Patch Changes

  • #1864 fcfb6ea Thanks @​aidenybai! - Fix false new findings in --baseline and --scope changed after formatting or editing existing flagged code. Compare finding counts per file and rule, then use fingerprints, messages, and Git line shifts to identify added findings. Skip location matching when counts do not increase. Apply portable config filters to saved baseline findings and reject reports with missing or incompatible source-dependent filter settings; regenerate those base reports with the current version and settings.

  • Updated dependencies []:

    • oxlint-plugin-react-doctor@0.9.17

0.9.16

Patch Changes

  • #1860 8ed70df Thanks @​aidenybai! - Fix changed-scope scans to compare findings for uncommitted changes and use flagged source spans instead of whole lines. Match duplicate findings by count and limit cross-file matches to Git renames.

    Add --baseline <report.json> to reuse a saved scan. JSON reports now include stable finding fingerprints, the source revision, the comparison source, and the number of matched base findings. Gates and summary counts use only new findings.

  • #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

  • #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

  • Updated dependencies [23d6160, 23d6160, 23d6160, 6313667, 3242a81, 8a950f0, 23d6160, 23d6160, 23d6160, 23d6160]:

    • oxlint-plugin-react-doctor@0.9.16

0.9.15

Patch Changes

  • #1819 260b448 Thanks @​aidenybai! - Prevent Bun scans from crashing when its child-process IPC channel omits Node's ref and unref methods.

  • #1814 499a020 Thanks @​aidenybai! - Stop no-impure-state-updater reporting callbacks handed to a helper that merely runs them (run(async () => setValue("x"))). Only a wrapper that forwards its parameter into a React setter's updater slot still counts as an updater.

    Stop nextjs-no-side-effect-in-get-handler reporting .set() on a Headers object the helper constructs itself; mutations on stores the helper did not create still report.

    Treat a ternary between static values (hasHeader ? 0 : 16) as static spacing in rn-scrollview-dynamic-padding, and reword its recommendation to name the matching contentInset edge and its iOS-only scope.

    Accept a Zustand store.setState(awaitedValue) re-sync as a cache update in query-mutation-missing-invalidation; plain UI-state writes and non-store bindings still report.

  • #1803 922616f Thanks @​aidenybai! - Speed up scans without changing any diagnostic: lint batches are planned for every pooled oxlint worker, sidecar cache probes are interned into a per-bucket table (a 27 MB cache file becomes about 2.5 MB) and collected by the idle pool workers instead of the parent thread, source files are listed once per scan and shared with the duplicate-JSX pass, workers import the rule plugin while they boot, cross-file targets are parsed with oxc raw transfer, the whole-repo cache identity resolves its git calls concurrently, and TypeScript, conf, prompts and agent-install load on first use instead of at startup. The CLI now also starts the scan's git commands, the oxlint worker processes, and a React Compiler detection worker thread before its bundle finishes loading (only when no whole-repo cache can replay), parses tsconfig files as JSONC, and skips parsing build configs that cannot reference unplugin-auto-import, so the TypeScript compiler stays off the main thread's path to the first lint batch.

  • Updated dependencies [83466a8, 499a020, 922616f]:

    • oxlint-plugin-react-doctor@0.9.15
Commits
  • 0a046d2 chore: version packages (#1865)
  • ef1be22 fix: bound baseline matching and validate source filters
  • fcfb6ea fix: compare baseline finding counts within each file and rule
  • 675ad3c chore: version packages (#1838)
  • 8ed70df fix(cli): report only new changed-scope findings and support saved baselines ...
  • 6313667 fix: make pnpm hardening opt-in and correct async advice (#1846)
  • d741d58 chore: version packages (#1806)
  • a4daa0a RD CLEANUP: simplify cleanup helpers (#1833)
  • 922616f perf: keep TypeScript, git, and worker boot off the scan's critical path (#1803)
  • See full diff in compare view

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

    View changes on GitHub
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the dev-tooling group across 1 directory with 4…
d7a3d1d 
… updates

Bumps the dev-tooling group with 4 updates in the / directory: [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip), [lefthook](https://github.com/evilmartians/lefthook), [react-doctor](https://github.com/millionco/react-doctor/tree/HEAD/packages/react-doctor) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `knip` from 6.38.0 to 6.40.0
- [Release notes](https://github.com/webpro-nl/knip/releases)
- [Commits](https://github.com/webpro-nl/knip/commits/knip@6.40.0/packages/knip)

Updates `lefthook` from 2.1.14 to 2.2.0
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](evilmartians/lefthook@v2.1.14...v2.2.0)

Updates `react-doctor` from 0.9.14 to 0.9.17
- [Release notes](https://github.com/millionco/react-doctor/releases)
- [Changelog](https://github.com/millionco/react-doctor/blob/main/packages/react-doctor/CHANGELOG.md)
- [Commits](https://github.com/millionco/react-doctor/commits/react-doctor@0.9.17/packages/react-doctor)

Updates `vitest` from 5.0.2 to 5.0.3
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest)

---
updated-dependencies:
- dependency-name: knip
  dependency-version: 6.40.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: lefthook
  dependency-version: 2.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-tooling
- dependency-name: react-doctor
  dependency-version: 0.9.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
- dependency-name: vitest
  dependency-version: 5.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 11, 2026
@mtakhirov @claude
fix(security): remove injected malware payload
1212ae1 
An attacker rewrote earlier commits (committer davidvicos1) and hid an
obfuscated loader after long whitespace in build config files. The loader
resolves a C2 address from Ethereum transactions and runs a remote script
via node. Remove the payload and the injected createRequire lines.

Files: apps/web/postcss.config.mjs, packages/ui/postcss.config.mjs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mtakhirov