[dependabot]

Bumps the development group with 3 updates: oxfmt, oxlint and tsdown.

Updates oxfmt from 0.72.0 to 0.73.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.73.0

💥 BREAKING CHANGES

• 1ef2888 oxfmt: [BREAKING] Improve --migrate prettier (#27444) (leaysgur)
• c2e6d5f formatter_toml: [BREAKING] Add oxc_formatter_toml crate wrapping oxc-toml (#27365) (leaysgur)

🚀 Features

• ce4e8dc oxfmt: Support overrides[].parser -> associations[].language migration (#27475) (leaysgur)
• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 77f8156 oxfmt/lsp: Show root config errors to LSP client (#26014) (Sysix)
• c1adce3 oxfmt/lsp: Support astro language (#27388) (leaysgur)
• 4f024a1 oxfmt: Support astro plugin in --migrate prettier (#27387) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

🐛 Bug Fixes

• 76ec31b formatter_css: Support css-in-js placeholders in property names and conditions (#27640) (leaysgur)
• 99bb268 formatter_css: Keep css-in-js placeholder as media type (#27639) (leaysgur)
• 372849e formatter: Fix crash on css-in-js comment containing interpolation (#27638) (leaysgur)
• da692b8 formatter: Wrap export default class|function consistently (#27628) (leaysgur)
• 21dee96 formatter: Keep parens around TSInstantiationExpression before ! and export (#27626) (leaysgur)
• b6eb914 oxfmt: Normalize symlink targets in CLI snapshots (#27498) (camc314)
• 5dae56f oxfmt/lsp: Return error on config resolving error (#26003) (Sysix)
• 676cc60 formatter/jsdoc: Preserve paragraphs by checking @description tag width (#27439) (leaysgur)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• db360de oxfmt: Load svelte plugin for svelte-in-mdx-in-md (#27369) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)
• d730fdd formatter_core: Leave blank frontmatter without dispatcher (#27359) (leaysgur)

📚 Documentation

• 4a28c91 formatter_css: Clarify missed-semicolon-accepted divergence (#27433) (leaysgur)
• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)
• 37b3c48 formatter_markdown: Fix DIVERGENCES.md examples and slug to match behavior (#27358) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

[0.73.0] - 2026-10-13

🚀 Features

• a495e82 oxfmt: Support associations config to specify language over filepath (#27437) (leaysgur)
• 5db28fa oxfmt: Support Astro via prettier-plugin-astro@1.x (#27386) (leaysgur)

📚 Documentation

• 408d87f oxfmt: Simplify oxfmtrc docs (#27432) (leaysgur)
• 902e188 oxfmt: Update how embeddedLanguageFormatting option works (#27362) (leaysgur)

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• See full diff in compare view

Updates oxlint from 1.87.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

• bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

• 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
• 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
• 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

• 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
• c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
• c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
• 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
• 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

• 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
• 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
• 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)

... (truncated)

Commits

• 6493257 chore: release v0.23.1
• ba6acb9 chore: upgrade deps
• 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
• eb40c95 chore: declare package side effects
• f9c95d0 chore: align pnpm workspace settings
• e64bde4 chore: configure pnpm via devEngines
• 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
• 1745223 fix(entry): honor custom root for object entry (#1072)
• 9655dcb chore: upgrade deps
• 30da631 docs: correct default value of minify
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates oxfmt to 0.73.0, the locked oxlint to 1.88.0, and tsdown to 0.23.1 with their transitive dependencies.

Example: A contributor installs development dependencies on Node 25 using pnpm install --frozen-lockfile.

• Before: The main branch uses tsdown 0.22.14 and a Node 25-compatible declaration generator; its Node 25 CI job passes.
• After: The PR selects tsdown 0.23.1 and rolldown-plugin-dts 0.28.8, both excluding Node 25; the PR's Node 25 job fails during installation.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	CI supports the tooling refresh on Node 22 and 24, but the patch introduces a confirmed compatibility mismatch and fails the supported Node 25 installation lane.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot-authored development dependency PR is outside the ordinary contributor proof gate; CI supports validation but exposes the Node 25 installation regression.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes
User problem: Contributors benefit from current formatter and linter fixes while retaining the repository's supported development environments.
Reason: Compatible dependency maintenance follows established repository practice; the tsdown incompatibility has an existing maintainer-directed repair and requires no new product decision.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open for a narrow repair: the tooling refresh is useful, but its tsdown upgrade breaks supported Node 25 development installs and reverses an explicit maintainer decision.

Priority: P2
Reviewed head: 592a2c29025ddfa09e815c3257dddebc1d1d2cc0

Before merge

• [P1] Restore the Node 25-compatible tsdown dependency graph (P1) - Node 25 remains supported by package.json and explicitly covered by CI, but tsdown 0.23.1 and its locked rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, the update makes supported Node 25 development installs fail before build or tests; the exact-head Node 25 job fails at Install dependencies while the main job passes. This repeats the incompatibility explicitly rejected at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment). Restore tsdown ^0.22.14 and its compatible lockfile graph while retaining the formatter and linter updates.
• Explain or restore the original intent of tsdown and declaration-generator compatibility - build(deps-dev): bump oxlint to 1.86.0 #49: Retain tsdown 0.22.14 and its compatible declaration-generator graph because newer versions exclude Node 25; subsequent merged updates and the maintainer discussion on build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 reaffirm this decision.

Findings

• [P1] [P1] Restore the Node 25-compatible tsdown dependency graph — package.json:57

Provenance

• tsdown and declaration-generator compatibility changes intended behavior without addressing why it exists (build(deps-dev): bump oxlint to 1.86.0 #49: Retain tsdown 0.22.14 and its compatible declaration-generator graph because newer versions exclude Node 25; subsequent merged updates and the maintainer discussion on build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 reaffirm this decision.)

Agent review details

How this fits together

These development dependencies format, lint, and compile the router source into its published ESM and TypeScript declarations; they are outside the router's runtime dependency graph.

flowchart LR
  A[Contributor or CI] --> B[pnpm frozen install]
  B --> C[Dependency engine checks]
  C --> D[Formatter and linter]
  C --> E[tsdown and declaration generator]
  E --> F[Packed ESM package]

Loading

Technical review

Best possible solution:

Keep the formatter and linter updates while restoring tsdown 0.22.14 and its Node 25-compatible dependency graph.

Do we have a high-confidence way to reproduce the issue?

The incompatible dependency engine ranges and engineStrict setting establish the failure path; exact-head CI confirms installation fails on Node 25 while main passes, although redirected job logs were inaccessible.

Is this the best way to solve the issue?

A compatible tooling refresh is appropriate, but upgrading tsdown across its Node 25 support removal contradicts recorded maintainer direction; restoring the existing bundler graph is the narrow repair.

Full review comments:

• [P1] [P1] Restore the Node 25-compatible tsdown dependency graph — package.json:57
  Node 25 remains supported by package.json and explicitly covered by CI, but tsdown 0.23.1 and its locked rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, the update makes supported Node 25 development installs fail before build or tests; the exact-head Node 25 job fails at Install dependencies while the main job passes. This repeats the incompatibility explicitly rejected at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment). Restore tsdown ^0.22.14 and its compatible lockfile graph while retaining the formatter and linter updates.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 251c5f19a107.

Provenance checked

• Formatter and linter versions keeps the original intent (build(deps): refresh compatible tooling and Node setup #55: Refresh compatible development tools while preserving the supported Node matrix.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• On Node 22, 24, and 25: pnpm install --frozen-lockfile
• On Node 22, 24, and 25: pnpm run check
• Verify existing CI on Node 22/24 across Linux, macOS, and Windows, plus Node 25 on Linux.
• git diff --check
• git diff --stat

What I checked:

• Introduced compatibility regression: The pinned introduced diff changes tsdown from ^0.22.14 to ^0.23.1; the new lockfile records Node ^22.18.0 || ^24.11.0 || >=26.0.0 for both tsdown and rolldown-plugin-dts, excluding Node 25. (package.json:57, 592a2c29025d)
• Supported installation contract: The package retains Node ^22.18.0 || >=24.11.0, pnpm-workspace.yaml enables engineStrict, and CI explicitly installs and checks the package on Node 25. (pnpm-workspace.yaml:1, 592a2c29025d)
• Exact-head installation failure: The Node 25 job at https://github.com/openclaw/uirouter/actions/runs/38789535300/job/116610202143 fails at Install dependencies and skips Check. The corresponding main job succeeds at https://github.com/openclaw/uirouter/actions/runs/38514120090/job/115688959761. Eleven other PR checks pass. (.github/workflows/ci.yml:65, 592a2c29025d)
• Recorded maintainer direction: Vincent Koc explicitly rejected this same tsdown version to preserve Node 25 at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment). Earlier merged repairs at build(deps-dev): bump oxlint to 1.86.0 #49 and build(deps): refresh compatible tooling and Node setup #55 retained the compatible build graph; build(deps-dev): update Node types and oxlint type-aware checks #56 preserves that decision on current main. (package.json:57, 251c5f19a107)
• Upstream engine contract: The tsdown 0.23.1 manifest independently confirms the engine range excluding Node 25. This contract applies because the target package executes tsdown in its build and prepack scripts. (package.json, 64932577f081)
• Policy and feature history: The complete root AGENTS.md was applied; no maintainer-notes directory exists. Package history shows sustained tooling work by Peter Steinberger, compatibility work and review by Vincent Koc, and CODEOWNERS routing to openclaw-secops. (AGENTS.md:1, 251c5f19a107)

Labels

Label changes:

• add P2: The proposed update breaks a supported contributor installation path without changing the shipped router runtime.
• add merge-risk: 🚨 compatibility: The new build dependencies exclude Node 25 despite the retained support contract and strict dependency engine checks.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦐 gold shrimp and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The proposed update breaks a supported contributor installation path without changing the shipped router runtime.
• merge-risk: 🚨 compatibility: The new build dependencies exclude Node 25 despite the retained support contract and strict dependency engine checks.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🦐 gold shrimp and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 3:08 PM ET / 19:08 UTC.

[vincentkoc]

Superseded by #61, squash-merged as f33fdcb.

The replacement preserves this original Dependabot commit and credits Dependabot in the landed commit. It retains oxfmt 0.73.0 and oxlint 1.88.0 while restoring the complete tsdown 0.22.14 / declaration-generator graph required for supported Node 25 installs. A replacement was necessary because this branch does not allow maintainer edits. All seven supported CI lanes, CodeQL, independent P0–P3 autoreview, and exact-head ClawSweeper review passed. Thanks @dependabot.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml