chore(deps): bump the bun-minor-patch group across 1 directory with 9 updates

[dependabot]

Bumps the bun-minor-patch group with 9 updates in the / directory:

Package	From	To
@anthropic-ai/claude-agent-sdk	0.3.247	0.3.286
xstate	5.32.6	5.33.2
zod	4.4.3	4.6.5
@biomejs/biome	2.5.10	2.5.15
@types/bun	1.4.0	1.4.2
dependency-cruiser	18.2.0	18.5.0
knip	6.32.3	6.39.0
marked	18.0.11	18.0.14
type-coverage	2.30.1	2.30.2

Updates @anthropic-ai/claude-agent-sdk from 0.3.247 to 0.3.286

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.286

What's changed

• Added the initialize response field sdk_mcp_manifests_parked and the system/init capabilities sdk_mcp_manifests and sdk_mcp_tools_list_changed
• Fixed foreground subagents sometimes not receiving the task-tracking tools listed in tools or allowedTools
• Fixed an SDK MCP server listing no tools when one tool's schema cannot be converted to JSON Schema; that tool is now left out with a warning naming it
• Fixed toggleMcpServer() not disconnecting, and failing to re-enable, an in-process MCP server created with createSdkMcpServer(), except one named claude-in-chrome
• Changed a person's priority now message to move running shell commands, agents and MCP calls to the background and join the running turn instead of stopping it
• Changed the TypeScript Agent SDK to leave an omitted permissionMode to Claude Code, so a settings defaultMode now applies and, on third-party providers or with telemetry off, the session starts in auto mode like claude -p; pass permissionMode: 'default' for manual approvals
• Updated to parity with Claude Code v2.1.286

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.286
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.286
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.286
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.286

v0.3.285

What's changed

• Added an optional read.title (the artifact's stored title) to the Artifact tool's structured read result
• Added provider_not_allowed to startup_failure_reason and allowedProviders to the Settings type
• Fixed sessions with CLAUDE_CODE_FORK_SUBAGENT=1: a subagent's own Agent call now runs in the foreground, so the subagent gets the child's result
• Fixed getSessionMessages() leaving out a message sent while Claude was working when the process stopped before the reply, or when another prompt followed it with no reply in between
• Fixed toggleMcpServer(name, false) leaving the connection open for a server that had not yet connected when the session started, or whose config was edited after it connected
• Fixed rewind_conversation leaving a backgrounded MCP tool call running after the message that started it was removed
• Changed Bash/PowerShell timeout to bound a run_in_background command (was ignored; default 30 min, max 2 h); the stopped task notification for a stop at that limit says why
• Changed getSubagentMessages() to also return the messages a subagent read while it ran, such as a message sent to it; offset and limit count these rows
• Updated to parity with Claude Code v2.1.285

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.285
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.285
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.285
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.285

v0.3.284

What's changed

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.286

• Added the initialize response field sdk_mcp_manifests_parked and the system/init capabilities sdk_mcp_manifests and sdk_mcp_tools_list_changed
• Fixed foreground subagents sometimes not receiving the task-tracking tools listed in tools or allowedTools
• Fixed an SDK MCP server listing no tools when one tool's schema cannot be converted to JSON Schema; that tool is now left out with a warning naming it
• Fixed toggleMcpServer() not disconnecting, and failing to re-enable, an in-process MCP server created with createSdkMcpServer(), except one named claude-in-chrome
• Changed a person's priority now message to move running shell commands, agents and MCP calls to the background and join the running turn instead of stopping it
• Changed the TypeScript Agent SDK to leave an omitted permissionMode to Claude Code, so a settings defaultMode now applies and, on third-party providers or with telemetry off, the session starts in auto mode like claude -p; pass permissionMode: 'default' for manual approvals
• Updated to parity with Claude Code v2.1.286

0.3.285

• Added an optional read.title (the artifact's stored title) to the Artifact tool's structured read result
• Added provider_not_allowed to startup_failure_reason and allowedProviders to the Settings type
• Fixed sessions with CLAUDE_CODE_FORK_SUBAGENT=1: a subagent's own Agent call now runs in the foreground, so the subagent gets the child's result
• Fixed getSessionMessages() leaving out a message sent while Claude was working when the process stopped before the reply, or when another prompt followed it with no reply in between
• Fixed toggleMcpServer(name, false) leaving the connection open for a server that had not yet connected when the session started, or whose config was edited after it connected
• Fixed rewind_conversation leaving a backgrounded MCP tool call running after the message that started it was removed
• Changed Bash/PowerShell timeout to bound a run_in_background command (was ignored; default 30 min, max 2 h); the stopped task notification for a stop at that limit says why
• Changed getSubagentMessages() to also return the messages a subagent read while it ran, such as a message sent to it; offset and limit count these rows
• Updated to parity with Claude Code v2.1.285

0.3.284

• Added a renamed skill's directory name to its SlashCommand aliases when the name is plain and Claude Code ships no command by that name
• Added applied.ultracodeAvailable and applied.ultracodeRequested to getSettings(): whether this session can run Ultracode, and whether it is requested, independent of whether it is in effect
• Fixed forkSession() copies reading back the wrong history when cut at a progress row or fork briefing after a rewind, or when the session was compacted with some messages kept
• Fixed getSessionMessages() leaving out messages from other agents, sessions and channels that the CLI transcript shows
• Fixed { decision: 'block' } returned by Elicitation and ElicitationResult hook callbacks being ignored; it now declines the MCP elicitation
• Fixed query() closing stdin before a follow-up turn woken by a finished background agent, which failed that turn's hooks, canUseTool and SDK MCP calls with "Stream closed"
• Changed the first turn to still wait up to 2s for connecting MCP servers named in allowedTools or by an mcp_tool hook, even with CLAUDE_CODE_MCP_STARTUP_WAIT_MS set to 0
• Changed applyFlagSettings({ ultracode: true }) to keep the current effort level instead of switching to xhigh; an effortLevel that changes the level without ultracode turns Ultracode off
• Updated to parity with Claude Code v2.1.284

0.3.283

• Added plugin_errors to the SDKSystemMessage type (system/init), including path for a --plugin-dir entry that did not load
• Fixed getSessionMessages() returning, and forkSession() copying, a rewound-away branch when the newest branch ends at a meta row or a local command's rows
• Changed stream-json output to include warnings and notices raised during a turn as system/informational messages; it previously dropped them
• Changed the set_max_thinking_tokens control request: omitting max_thinking_tokens now leaves the session's thinking budget unchanged; send null to reset it to the session default
• Updated to parity with Claude Code v2.1.283

0.3.282

• Added support for strictKnownMarketplaces and blockedMarketplaces in host-supplied managedSettings: the allowlist applies only where admin policy sets none; the blocklist adds to the admin's
• Added @anthropic-ai/claude-agent-sdk/core, a smaller entry point for apps that bundle the SDK (query, MCP tool helpers, session mutations, resolveSettings); it uses your installed zod and MCP SDK
• Added prewarm() and SpareProcess.claim() (alpha): start a Claude Code process before its session is known and bind it to a folder and its per-session options later
• Fixed readMcpResource() relaying content _meta keys under the CLI-reserved com.anthropic/ prefix; they are now dropped, as for tool results
• Updated to parity with Claude Code v2.1.282

... (truncated)

Commits

• 0e21ebb chore: Update CHANGELOG.md
• 28c70e2 ci: security hardening for the GitHub Actions workflow that calls Claude (#483)
• 49ac970 chore: Update CHANGELOG.md
• 41cad2a chore: Update CHANGELOG.md
• fc99cf7 ci: pin the model for issue triage (#480)
• 9e1902d chore: Update CHANGELOG.md
• 9e477a1 chore: Update CHANGELOG.md
• fb04f66 chore: Update CHANGELOG.md
• 58d2e4b chore: Update CHANGELOG.md
• 18661ed chore: Update CHANGELOG.md
• Additional commits viewable in compare view

Updates xstate from 5.32.6 to 5.33.2

Release notes

Sourced from xstate's releases.

xstate@5.33.2

Patch Changes

• #5718 015dc23 Thanks @​davidkpiano! - Fixed metadata types in generic history values, snapshot nodes, and directed graph results. These containers now accept arbitrary state and transition metadata consistently with AnyStateNode and AnyTransitionDefinition, avoiding unsafe-type warnings when inspecting machines through generic APIs.

xstate@5.33.1

Patch Changes

• #5712 8614c4d Thanks @​crishoj! - AnyStateNode and AnyStateNodeDefinition now widen the TStateMeta and TTransitionMeta parameters that were added to StateNode and StateNodeDefinition in 5.33.0. Those parameters default to MetaObject, while the nodes of an AnyStateMachine have them as any, so tooling that tracks any (such as @typescript-eslint's no-unsafe-argument and no-unsafe-return) reported every node read off an untyped machine as unsafe:

  declare const machine: AnyStateMachine;
  // StateNode<any, any, any, any> passed to StateNode<any, any, MetaObject, MetaObject>
  takesStateNode(machine.root);

  AnyTransitionDefinition was widened along with the new parameters; these two were missed.

xstate@5.33.0

Minor Changes

• #5700 6d8c317 Thanks @​davidkpiano! - State and transition metadata can now use separate types:

  const machine = setup({
    types: {
      meta: {} as { label: string },
      transitionMeta: {} as { trackingId: number }
    }
  }).createMachine({
    meta: { label: 'Root' },
    on: {
      NEXT: { meta: { trackingId: 42 } }
    }
  });

  When transitionMeta is omitted, types.meta continues to apply its type to both state and transition metadata.

Commits

• fbee62e Version Packages (#5720)
• 015dc23 fix(core): preserve arbitrary metadata in generic node containers (#5718)
• 4c71eb3 Version Packages (#5717)
• 8614c4d fix(core): widen the meta parameters of AnyStateNode and `AnyStateNodeDefin...
• a76139b Version Packages (#5710)
• 6d8c317 Add separate transition metadata typing (#5700)
• See full diff in compare view

Updates zod from 4.4.3 to 4.6.5

Release notes

Sourced from zod's releases.

v4.6.5

Commits:

• d2b135cfb7a3582b9eb515756b9166bcb9521f4a docs: add the 4.6.x patch highlights to the 4.6 post
• f1448f7cee00df9fe1e9ad84a000aa1828cc8bc1 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• de65a5cb39ed22a507fac935788f718fa88d104f docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• 56222cd1532c07bcb91b67df529cab4c0a215330 feat(instanceof): key the .properties() shape off the instance type (#6600)
• ca0229a404818290e6cdcfefcd7eb2d04bcbb543 Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)"
• cc4cd4ee9c52fcaa10964e48cc144541e41a5ed9 Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)""
• 0f3f5ee3ca56c7574bf849e54f79e9a6e02562ee 4.6.5
• 59bbc03e10c636b9eb3c393dfeb552819774ec21 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump

v4.6.4

A patch on top of 4.6.3.

• d6bc1e30 feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed weekly by CI (#6595)
• ad32d751 perf: z.url() rejects an invalid URL with URL.canParse() instead of a throwing constructor, about 50x faster; fewer allocations on the validation path (#6588)
• 2bb08717 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• f6e1701a chore(deps): bump next to 15.5.25 and vite to 7.3.6 (#6153)

v4.6.3

A patch on top of 4.6.2.

• 413cce9a fix(v4): make z.properties() a check again (#6594) — removes the standalone z.properties() schema from 4.6.0; z.instanceof().properties() and .check(...z.properties()) are unchanged
• 75d63ee1 docs: show only the .properties() method form in the 4.6 post
• 46da9572 docs: match the error-message examples to what the parsers emit

v4.6.2

A patch on top of 4.6.1.

• 9446b5cc fix: preserve undefined prefault outputs and object keys (#6587) — closes #6585
• 0c483c58 docs: the Zod 4.6 announcement post (#6546)
• a00c3f34 docs: use Trigger.dev's brand-kit lockups for the platinum card

v4.6.1

A patch on top of 4.6.0.

• b12aa523 fix: preserve unique tags with defaulted discriminators (#6582) — closes #6577
• dd9c36fa fix(v4): defer recursive object index inference (#6580)
• 3b154992 feat(lang): add Tajik (tg) locale (#6581) by @​ismoil77
• 2efa8b80 ci: give the npm wait a real budget and drop the back-publish path (#6583)

v4.6.0

Zod 4.6 is now available.

npm install zod@latest

At a glance:

... (truncated)

Commits

• 59bbc03 chore: re-pin the integration peers to the workspace zod after the 4.6.5 bump
• 0f3f5ee 4.6.5
• cc4cd4e Revert "Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, ref...
• ca0229a Revert "feat: add z.currencyCode() over a vendored ISO 4217 list, refreshed w...
• 56222cd feat(instanceof): key the .properties() shape off the instance type (#6600)
• de65a5c docs: lead the properties section with the check and add a Zod Mini tab (#6598)
• f1448f7 docs: fold the 4.6.x patch highlights into the 4.6 post's own sections
• d2b135c docs: add the 4.6.x patch highlights to the 4.6 post
• 2bb0871 chore: re-pin the integration peers to the workspace zod after the 4.6.4 bump
• 743aedb 4.6.4
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.10 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @types/bun from 1.4.0 to 1.4.2

Commits

• See full diff in compare view

Updates dependency-cruiser from 18.2.0 to 18.5.0

Release notes

Sourced from dependency-cruiser's releases.

v18.5.0

✨ features

• 25ac2f7f feat(extract/tsc): adds support for imports inside module and namespace blocks (#1095) - thanks to @​arpitjain099 for detecting the missing feature AND making the PR
• 918d9193 feat(report/markdown): adds baseline stale table (#1102)

👷 maintenance

• 10860b9a build(npm): updates external dependencies

v18.4.0

✨ features

To improve visibility of the state of the baseline (.dependency-cruiser-known-violations.json)...

• ...the err, err-html and markdown reporters now show the number of stale entries in the baseline. (c617e580/ e9ad4ce6/ be91a27c/ 993ac9df)
• ... the err, null, azure-devops and teamcity reporters can exit with a non-zero exit code when the baseline contains stale entries (set baseline.staleEntriesSeverity to error to enable).
  (#1100 / 0dbd7610)
• ... the new baseline-mode 'format' sorts the baseline so future diffs are easier to read after manual edits. (077d4431/ 3e465ea1)

Thanks to @​yunusdim and @​BPScott for the raising the issues and providing the suggestions and feedback that birthed these 🙇.

📖 documentation

• e41450b9 doc(cli): adds note to --baseline that severities are ignored on comparison

👷 maintenance

• 9f402bbb/ ab42c712 chore(npm): updates all external devDependencies
• c9d8fb5d chore(npm): adds upem policy to prevent accidents when @​types/node publishes a super-old version as 'latest'

v18.3.1

🐛 fixes

• aed44794 fix(extract/swc): finds the swc Visitor when bun hands over the default export (#1093) - thanks @​kurovskyiii for raising the issue and providing the fix in the pull request.

👷 maintenance

• 0b873f48 chore(npm): updates all external devDependencies

v18.3.0

✨ features

• Updates to the 'baseline' feature
  • feat: makes it possible to update the baseline "shrink-only", so violations that are fixed get removed, but no new ones are added (#1088/ #1091/ #1085)
  • feat(cli): exposes the baseline feature as a regular --baseline option (with same functionality as depcruise-baseline command) (#1084)
  • feat(baseline): when the baseline is updated show how many are new, same or removed (#1079)

... (truncated)

Commits

• 0c97313 18.5.0
• 10860b9 build(npm): updates external dependencies
• 25ac2f7 feat(extract/tsc): adds support for imports inside module and namespace block...
• 918d919 feat(report/markdown): adds baseline stale table (#1102)
• 7c22858 18.4.0
• 9f402bb chore(npm): updates all external devDependencies
• 993ac9d feat(report/markdown): adds baseline stale count (#1101)
• c9d8fb5 chore(npm): adds upem policy to prevent accidents when @​types/node publishes ...
• 0dbd761 feat: adds option to make stale entries in the baseline a non-zero-exit-code ...
• be91a27 feat(report/err-html): adds baseline stale count and table (#1099)
• Additional commits viewable in compare view

Updates knip from 6.32.3 to 6.39.0

Release notes

Sourced from knip's releases.

Release 6.39.0

• Add Railway plugin (#2026) (6da55767eb419701dd32f93789a00e8bdc915276) - thanks @​jonahsnider!
• Update query snapshot (8877d3cf35943e17a617e1197fa46c5a43342479)
• Fix excluded tags on entry re-exports (#2062) (b22e27543cb8dd4ba7ec97c70ccfd06bc8f16614) - thanks @​devYRPauli!
• Update rolldown snapshot (3a45c806e1c1b7ceb078903652c8631566400096)
• Skip synthetic self-imports in Vue and Nuxt auto-import compilers (#2067) (d912d807e41f140bbc79bafce6882b3c05dec6ff) - thanks @​bytedoe!
• fix(angular): keep other projects' inputs when one has no architect (#2064) (af3f42e9772e9937fd71b7557d3b54aee1db339a) - thanks @​Cayan!
• fix(vite): resolve nested HTML entry points in multi-page apps (#1988) (4648aefe56e7bac521bb6f17189473b46f8ff00f) - thanks @​DreamLongYT!
• Improve Rstest plugin support (#2068) (add87992e9dfe2f3c22e4c6ba7fa257d7f0151cf) - thanks @​fi3ework!
• Handle profiles, formatters and require paths in Cucumber plugin (#2065) (2ad39fcf02e067b4bdfc06a658bf4bf5abeea764) - thanks @​giaBaoJS!
• fix(playwright): resolve globalSetup/globalTeardown from config dir (#2076) (7060bb968339680d694275413aba2833e4521ed9) - thanks @​alokn!
• fix: read entry export tags under the re-exported names (#2069) (1698683df95a96b3515795eb664aacf030042d7b) - thanks @​devYRPauli!

Release 6.38.0

• Include co-authors in docs contributor list (0c334100df59d89a512ad598ec50e7f62f6da0c3)
• Filter bots and agents from docs contributors (617f70d8179c6b8668ca41fe5df77ced5e2b37c0)
• Update Eve plugin conventions (#2049) (260dbb91a85f3a3bc2727e8f255d73df3737552c) - thanks @​matchai!
• Add args example to that doc page (50b271b98fc930a05a3b045a2f691486f9f06528)
• Add Turborepo plugin (#2055) (e49d3db05f1d69ce7db3efcb8467a4af63c27379) - thanks @​changbaebang!
• Support import-x/* settings in ESLint plugin (#2050) (1a34cf82a3d6a1202717ef910bedba55838e9dd9) - thanks @​bytedoe!
• Resolve file option in Mocha configuration files (#2051) (9b5c5f60468c8a92a3e74adca5c0931f008677af) - thanks @​giaBaoJS!
• Support oxlint extends (#2054) (a149a98219bb14b15f446fc5f8c4f815e28b2183) - thanks @​matthewnitschke-wk!
• Fix import.meta handling in built-in compilers (#2059) (8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded) - thanks @​vdavid!
• Fix tag hints for enum and namespace members (#2061) (8a8805e48945863248429d18b7f6c4e4b7dc9ebd) - thanks @​devYRPauli!
• Flag unused member tags in tagged enums and namespaces (584e53ff3e0846fbfe04fa5b5bfefe2420576a34)
• feat: resolve MDX content mapper remarkPlugins (#2060) (34dbccf25359f9e9fefe9d0be6ef2ec0252223cc) - thanks @​gioboa!
• Refactor and separate concerns w/ new typescript-content-mapper plugin (11e94509bd0f350d747facf4003fc5b248d1b02d)
• Resolve mdx content mapper providerImportSource (7b5825117f97f2f87b7141509a254f88d0957cf7)
• Fix config → entry in plop plugin (25a380c9e1165b76583d69b48b5fa7cdf5db0ae2)

Release 6.37.0

• fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (#2048) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks @​RobHannay!
• fix: enable JSX in the config loader (#1959) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks @​addielaruee!
• Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)
• Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)
• Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)
• Separate shell binary expectations from reporting exemptions (resolve #2022) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)
• Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)
• Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)
• Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)
• Fix --format name resolution in the ESLint plugin (#2046) (1269e98bb700384811fadc124d69ea720832037e) - thanks @​bytedoe!

Release 6.36.0

• Add @​tailwindcss/webpack as Tailwind plugin enabler (#2027) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks @​igas!
• Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)
• Explain ambiguous star exports in traces (#2025) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks @​gioboa!
• Fix eslintrc parserOptions.parser handling in ESLint plugin (#2028) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks @​bytedoe!
• fix(compilers): require word boundary around import keyword (#2029) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks @​thanadolps!
• fix: recover from corrupt cache file (#2034) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks @​gioboa!
• fix: fix trailing comma on dependency removal (#2033) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks @​gioboa!

... (truncated)

Commits

• ed30e5b Release knip@6.39.0
• 1698683 fix: read entry export tags under the re-exported names (#2069)
• 7060bb9 fix(playwright): resolve globalSetup/globalTeardown from config dir (#2076)
• 2ad39fc Handle profiles, formatters and require paths in Cucumber plugin (#2065)
• add8799 Improve Rstest plugin support (#2068)
• 4648aef fix(vite): resolve nested HTML entry points in multi-page apps (#1988)
• af3f42e fix(angular): keep other projects' inputs when one has no architect (#2064)
• d912d80 Skip synthetic self-imports in Vue and Nuxt auto-import compilers (#2067)
• b22e275 Fix excluded tags on entry re-exports (#2062)
• 6da5576 Add Railway plugin (#2026)
• Additional commits viewable in compare view

Updates marked from 18.0.11 to 18.0.14

Release notes

Sourced from marked's releases.

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

v18.0.13

18.0.13 (2026-09-12)

Bug Fixes

• allow tabs in the thematic break that ends a list item (#4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#4090) (c6a25bb)
• case fold reference link labels (#4077) (aed9336)
• drop the leading whitespace after a hard line break (#4075) (123ce04)
• match html block start conditions when ending a list item (#4072) (c2facac)
• respect raw tokens when closing link labels (#4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#4080) (dbb393d)

v18.0.12

18.0.12 (2026-09-07)

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#4084) (4417582)
• allow one more level of nested brackets in a link label (#4064) (37b28d8)
• do not add a newline to an empty code block (#4073) (23b1706)
• escape character references in autolink destinations (#4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#4063) (df57534)
• reject invalid characters in HTML tag names (#4083) (300bb1d)
• remove up to the fence indentation from each content line (#4074) (0244f08)

Commits

• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• 5196d98 docs: add commonmark and gfm as versions in demo (#4094)
• de2320a docs: add marked-gitlab to known extensions (#4092)
• 7d05530 fix: allow indented lines in setext heading text (#4095)
• c7ee43a fix: strip whitespace when normalizing link reference labels (#4091)
• cead8de fix: decode numeric character references in text (#4076)
• e136da7 fix: preserve internal tabs in list item content (#4086)
• Additional commits viewable in compare view

Updates type-coverage from 2.30.1 to 2.30.2

Changelog

Sourced from type-coverage's changelog.

2.30.2 (2026-09-29)

• fix: report a clear error when typescript lacks the compiler API (b6e64b2)

Commits

• 798fdc4 2.30.2
• b6e64b2 fix: report a clear error when typescript lacks the compiler API
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgr...

Description has been truncated

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / unit

The overall line coverage in commit 14edb1b in the dependabot/bun/bun-m... branch remains at 87%, unchanged from commit 801c0e6 in the main branch.