[dependabot]

Bumps the toolchain group with 2 updates: @effect/tsgo and vite-plus.

Updates @effect/tsgo from 0.63.0 to 0.67.5

Release notes

Sourced from @​effect/tsgo's releases.

@​effect/tsgo@​0.67.5

Patch Changes

• 689b96f: Finish the tsrs 0.23.0 bump: refresh Cargo.lock for the new tsrs crate versions, and update the release parity check in repoctl tsrs check to read tsrs's new matrix-based build-windows job (same target, runner and build flags, now written as ${{ matrix.target }}). Rework the Oxlint 002-effect-tsgolint-path.patch so it applies to Oxlint 1.92.0 as well as 1.88–1.91: EFFECT_TSGO_TSGOLINT_PATH is now resolved by a wrapper around upstream's try_find_tsgolint_executable instead of an edit inside it (same behavior).
• c7f44a4: Update the TypeScript next tag to typescript@next, which ships typescript-go commit a59fafb8e7b5b2efef0568149fea03caad02356a, update the TypeScript beta tag to typescript@beta, and update the TypeScript latest tag to typescript@latest. Refresh the Oxlint configuration schema from the selected package.

@​effect/tsgo-linux-arm@​0.67.5

No release notes provided.

@​effect/tsgo@​0.67.4

Patch Changes

• dd69d48: Update the TypeScript next tag to typescript@next, which ships typescript-go commit c46bcd6089ea2e5e84e7fcc60845ac884a5b0ac1, update the TypeScript beta tag to typescript@beta, and update the TypeScript latest tag to typescript@latest.

@​effect/tsgo-linux-arm@​0.67.4

No release notes provided.

@​effect/tsgo@​0.67.3

Patch Changes

• 1477f2e: Fix preferEffectArray, preferEffectRecord, preferEffectString, promiseInEffectSuccess and anyUnknownInErrorContext skipping everything inside a class extends expression. Their walks stop at type nodes, and the extends clause of a class is an ExpressionWithTypeArguments, which counts as one, so the make of a service class was never checked. The walks now visit the expression of a class extends clause; its type arguments, implements clauses and interface extends clauses are still skipped.

  import { Context, Effect } from "effect"
  const xs: ReadonlyArray<number> = [1, 2, 3]
  export class Doubled extends Context.Service<Doubled, { readonly all: ReadonlyArray<number> }>()("Doubled", {
  make: Effect.gen(function*() {
  // now reported by preferEffectArray
  return { all: xs.map((n) => n * 2) }
  })
  }) {}

  effectFnOpportunity had the same blind spot when checking whether a function declaration is used before it is declared: a call inside an earlier class extends expression was ignored, so it offered to convert a hoisted function into a const that the class would then read before initialization. That opportunity is no longer offered.

  export class Early extends Context.Service<Early, { readonly value: number }>()("Early", {
    make: makeEarly(1) // runs when the class is defined
  }) {}
  // no longer suggested as Effect.fn: the const would not be initialized yet
  function makeEarly(n: number) {
  return Effect.gen(function*() {
  return { value: n }
  })
  }

... (truncated)

Changelog

Sourced from @​effect/tsgo's changelog.

0.67.5

Patch Changes

• 689b96f: Finish the tsrs 0.23.0 bump: refresh Cargo.lock for the new tsrs crate versions, and update the release parity check in repoctl tsrs check to read tsrs's new matrix-based build-windows job (same target, runner and build flags, now written as ${{ matrix.target }}). Rework the Oxlint 002-effect-tsgolint-path.patch so it applies to Oxlint 1.92.0 as well as 1.88–1.91: EFFECT_TSGO_TSGOLINT_PATH is now resolved by a wrapper around upstream's try_find_tsgolint_executable instead of an edit inside it (same behavior).
• c7f44a4: Update the TypeScript next tag to typescript@next, which ships typescript-go commit a59fafb8e7b5b2efef0568149fea03caad02356a, update the TypeScript beta tag to typescript@beta, and update the TypeScript latest tag to typescript@latest. Refresh the Oxlint configuration schema from the selected package.

0.67.4

Patch Changes

• dd69d48: Update the TypeScript next tag to typescript@next, which ships typescript-go commit c46bcd6089ea2e5e84e7fcc60845ac884a5b0ac1, update the TypeScript beta tag to typescript@beta, and update the TypeScript latest tag to typescript@latest.

0.67.3

Patch Changes

• 1477f2e: Fix preferEffectArray, preferEffectRecord, preferEffectString, promiseInEffectSuccess and anyUnknownInErrorContext skipping everything inside a class extends expression. Their walks stop at type nodes, and the extends clause of a class is an ExpressionWithTypeArguments, which counts as one, so the make of a service class was never checked. The walks now visit the expression of a class extends clause; its type arguments, implements clauses and interface extends clauses are still skipped.

  import { Context, Effect } from "effect"
  const xs: ReadonlyArray<number> = [1, 2, 3]
  export class Doubled extends Context.Service<Doubled, { readonly all: ReadonlyArray<number> }>()("Doubled", {
  make: Effect.gen(function*() {
  // now reported by preferEffectArray
  return { all: xs.map((n) => n * 2) }
  })
  }) {}

  effectFnOpportunity had the same blind spot when checking whether a function declaration is used before it is declared: a call inside an earlier class extends expression was ignored, so it offered to convert a hoisted function into a const that the class would then read before initialization. That opportunity is no longer offered.

  export class Early extends Context.Service<Early, { readonly value: number }>()("Early", {
    make: makeEarly(1) // runs when the class is defined
  }) {}
  // no longer suggested as Effect.fn: the const would not be initialized yet
  function makeEarly(n: number) {
  return Effect.gen(function*() {
  return { value: n }
  })
  }

0.67.2

Patch Changes

... (truncated)

Commits

• d0847ed Version Packages (#1015)
• c7f44a4 chore: update upstreams (#1014)
• bf34a20 Version Packages (#1012)
• dd69d48 chore: update upstreams (#1011)
• 11414d1 chore: update upstreams (#1010)
• 35c35db Version Packages (#1009)
• 1c8e970 Version Packages (#1007)
• 87042ed fix(cli): provide only FileSystem and Path to the proxy so piped stdio stays ...
• ed1b917 Version Packages (#1001)
• 3922483 chore: update upstreams (#993)
• Additional commits viewable in compare view

Updates vite-plus from 1.4.0 to 1.5.1

Release notes

Sourced from vite-plus's releases.

vite-plus v1.5.1

Vite+ 1.5.1 fixes two high-severity security issues in package-manager downloads and vp env use, restores interactive input in vp run tasks, fixes vp migrate config merges, and adds a reference page for each package command.

Features

• Upgrade the bundled Vite and Rolldown (#3390), by @​voidzero-guard[bot] and @​fengmk2:
  • vite@8.3.5 to vite@8.3.7. A pnpm install no longer turns every cached build into a cache miss, because Vite tells Vite Task to ignore node_modules/.modules.yaml. It also fixes named imports from Node.js built-ins and reloads in bundled dev mode, subpath imports (#) in the dependency optimizer, SSR builds with build.ssr: true, and chunks shared with workers.
  • rolldown@1.2.16 to rolldown@1.2.18, with module source maps that keep only the sources and names that they trace.
  • @voidzero-dev/vite-plus-core requires postcss@^8.5.32, as the bundled Vite does.

Fixes & Enhancements

• Security: Vite+ verifies the pnpm that it downloads for its own setup against a hash in the CLI, and checks a downloaded pnpm, Yarn 2+, or bun against the integrity hash in the project's packageManager field instead of the hash that the registry reports. A registry set in a project's .npmrc can no longer make Vite+ run a package manager that does not match (GHSA-5qr3-w62x-jmwx, high). Mirrors and private registries that serve the same package still pass. Each pinned version gets its own cache directory, so a project with a pinned package manager downloads it once more after the upgrade. Unpinned installs keep their current location (#3400), by @​fengmk2 and @​arkmarta.
• Security: vp env use and other dist-tag lookups, such as pnpm@latest, accept only a valid semver version from the registry, so a registry set in a project's .npmrc can no longer put shell commands into the statements that the vp env use shell wrapper runs (GHSA-p79r-mf8q-r78h, high) (#3395), by @​fengmk2 and @​arkmarta.
• Scripts that vp run starts get a blocking stdin again when the run block of vite.config.ts is not statically analyzable (for example, a task command held in a constant), so interactive prompts such as vp update --interactive wait for input instead of failing with EAGAIN (#3361), by @​everton-dgn.
• vp migrate changes only the return statements of a defineConfig callback, so functions inside the config, such as Rolldown codeSplitting.groups[].name callbacks, keep their return values and the build no longer fails. When a callback return cannot receive the merged settings, migration keeps the standalone config files and asks for a manual merge. Pack and task cache migration also recognize configs wrapped in parentheses, as, satisfies, <T>, or ! (#3325, #3372), by @​jong-kyung.
• vp create react-router passes --no-git-init to create-react-router, so the generator's initial commit no longer stops the Vite+ setup when no Git identity is configured (#3363), by @​chbaefront.
• env.fish calls fish built-ins through builtin, so vp env use changes the Node.js version even when a user function has the name of a built-in such as count (#3353), by @​naokihaba.
• Shell completion suggests full command names before aliases, so vp i<Tab> offers install and vp up<Tab> offers update. An alias stays available when no full name matches (#3337), by @​nekomoyi.
• Completion for vp run and vpr skips comment keys such as "# docs #" in package.json scripts, matches task names that contain :, and shows each task's command as its description in Zsh and Fish (#3354), by @​nekomoyi.
• vp pm dist-tag rm works with Yarn Berry, because Vite+ passes remove to yarn npm tag (#3358), by @​jong-kyung.

Docs

• Add a Package Management section to the guide, with a reference page for each of the 38 package commands that lists its options, package-manager support, version requirements, and npm fallbacks. Help output for package commands and the old package management and install URLs point to the new pages (docs) (#3105), by @​jong-kyung.
• Show the README logo that matches the GitHub theme, so the logo stays visible after a theme change (#3350), by @​fengmk2.

Chore

• Build Linux native bindings against the napi-cross glibc 2.17 sysroot with @napi-rs/cli@3.10.12, let the linker reject unresolved symbols, and run Linux CI on ubuntu-latest again. Let the dependency upgrade workflow change workflow files (#3349, #3384), by @​fengmk2.
• Refine contributor guidance: AGENTS.md separates the vite-plus package from the global vp CLI and replaces CLAUDE.md, and the Node.js version RFCs describe .nvmrc support (#3388, #3383), by @​liangmiQwQ and @​hyunbinseo.
• Resolve the docs theme aliases from import.meta.dirname, so the docs dev server no longer warns about __dirname (#3379), by @​liangmiQwQ.
• Fold the .node-version parse tests into one table (#3355), by @​Brooooooklyn.

Bundled Versions

Tool	Version	Source	Changelog
vite	8.3.7	5def936	8.3.6, 8.3.7
rolldown	1.2.18	f9a49d6	1.2.18
oxc-node	1.0.1	7ff14c3	unchanged
tsdown	0.23.4	npm	unchanged
vitest	5.1.0	npm	unchanged
oxlint	1.91.0	npm	unchanged
oxlint-tsgolint	7.0.2005	npm	unchanged
oxfmt	0.76.0	npm	unchanged

Upgrade

vp upgrade
</tr></table> 

... (truncated)

Commits

• e5defe1 release: v1.5.1 (#3401)
• a110977 fix(pm): verify and content-key managed package-manager installs (#3400)
• 37cb983 fix(cli): restore blocking stdin after loading a dynamic config (#3361)
• bb2d43e fix(create): skip React Router Git initialization (#3363)
• a32a8ce fix(build): use the napi-cross sysroot for native Linux builds (#3349)
• 671b5e4 release: v1.5.0 (#3336)
• 62ea11f feat(deps): upgrade upstream dependencies (#3330)
• b08be8d fix(create): avoid following target symlinks (#2418)
• 5deeca1 chore(deps): upgrade Vitest to 5.1.0 (#3206)
• 94d4e6f feat(migrate): migrate transpile-only ts-node scripts and preloads (#3210)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 744439ae-2a8b-4324-8cdf-0a64a4c7bb44

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts