build(deps-dev): bump the development-minor-and-patch group across 1 directory with 3 updates

[dependabot]

Bumps the development-minor-and-patch group with 3 updates in the / directory: oxfmt, oxlint and vitest.

Updates oxfmt from 0.62.0 to 0.64.0

Changelog

Sourced from oxfmt's changelog.

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

Commits

• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• c07fe7c feat(oxfmt): support experimentalOperatorPosition (#25643)
• fed6681 docs(oxfmt): skip expanding overrides options (#25572)
• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• 00f490d refactor(oxfmt,formatter): split sortImports validation and use type enum (...
• See full diff in compare view

Updates oxlint from 1.77.0 to 1.79.0

Release notes

Sourced from oxlint's releases.

oxlint v1.79.0 & oxfmt v0.64.0

Table of Contents

• Oxlint v1.79.0
• Oxfmt v0.64.0

Oxlint v1.79.0

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

See React Compiler Support for details.

🚀 Features

• 9b7394e linter/typescript/no-empty-object-type: Implement suggestion (#25833) (Mikhail Baev)

🐛 Bug Fixes

• 345f981 react_compiler: Skip node_modules by default (#25859) (Boshen)
• 2f40afa linter/unicorn/no-array-callback-reference: Ignore effect library imports (#25857) (Michaël Bitard)
• 7b565a0 linter: Align React Compiler rule categories (#25840) (Boshen)
• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• f8e4884 linter/eslint/no-useless-constructor: Allow parameter properties (#25811) (camc314)
• e4b6993 linter: Report exhaustive effect dependencies (#25829) (Boshen)
• 742e25f linter/eslint/no-return-assign: Anchor diagnostic on return stmt (#25803) (camc314)
• b831ca8 react-compiler: Improve derived state diagnostic (#25804) (Boshen)
• 5908c87 linter/jest/prefer-mock-return-shorthand: Preserve implementations using this (#25802) (camc314)
• f6b2265 linter/eslint/no-redeclare: Run in ES modules, skipping only the globals check (#25691) (Hamody We)
• ca9f553 linter/unicorn/prefer-default-parameters: Mark fixer as a suggestion (#25801) (camc314)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• d5483f8 linter/typescript/no-useless-empty-export: Skip TS declaration files (#25789) (Evyatar Daud)
• 57f2199 linter/typescript/no-useless-empty-export: Report after imports (#25786) (camc314)
• 633bc19 linter/typescript/no-unnecessary-type-conversion: Mark fixer as suggestion (#25787) (camc314)
• dea3339 linter/typescript/explicit-module-boundary-types: Anchor diagnostics on arrows (#25779) (camc314)
• 5cd6f02 linter/eslint/array-callback-return: Anchor diagnostic on callback (#25780) (camc314)
• ef8cebf linter/eslint/preserve-caught-error: Handle AggregateError options (#25775) (camc314)
• c108d5c linter: Improve React Compiler diagnostics (#25742) (Boshen)
• c9ec55e react-compiler: Improve diagnostic spans (#25731) (Boshen)
• 1cbbcb7 linter/unicorn/prefer-string-replace-all: Apply fixes in one pass (#25709) (Mikhail Baev)
• dec0a86 react-compiler: Standardize diagnostics (#25702) (Boshen)
• 5fd77f7 linter/react/display-name: Report curried HOC inner component (#25662) (camc314)
• 4dbb80e linter/import/no-named-as-default: Report local export conflicts (#25658) (camc314)
• e8a7214 linter/react/rules-of-hooks: Report hooks inside try blocks (#25670) (camc314)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• d901d24 linter/react/exhaustive-deps: Handle destructured object dependencies (#25669) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• fa36f26 linter/react/no-this-in-sfc: Detect this in nested arrow callbacks (#25653) (camc314)
• 44d1be3 linter/typescript/no-var-requires: Run rule on JavaScript (#25664) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

Commits

• 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
• 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
• aa49d86 fix(linter): allow spread rule options in config types (#25675)
• 8922381 refactor(linter): remove inactive react config rule (#25740)
• 8c4552d feat(linter)!: split react/react-compiler into per-category rules (#25500)
• 36f8451 fix(linter/eslint/no-eval): align indirect default with ESLint (#25656)
• beb724d fix(linter/eslint/no-unused-vars): report bare underscore parameters (#25663)
• 4004c10 fix(linter/eslint/no-irregular-whitespace): check comments by default (#25660)
• 285820e fix(linter/no-large-snapshots): precompile and document allowed snapshot matc...
• 4df5835 fix(linter): allow capitalized built-in calls (#25516)
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 25, 2026, 8:21 AM ET / 12:21 UTC.

ClawSweeper review

What this changes

Updates the root development formatter to Oxfmt 0.64.0 and refreshes the pnpm resolutions for Oxfmt, Oxlint 1.79.0, and Vitest 4.1.11.

Merge readiness

⚠️ Ready for maintainer review - 4 items remain

Keep open for maintainer review: this is a clean, CI-passing development-tool update, but it replaces platform-native formatter and linter bindings with only Ubuntu CI evidence. Likely related people: Peter Steinberger is the recent development-dependency contributor (high confidence).

Priority: P3
Reviewed head: eeea8bf4153b357ad57a7c70f21d906b534d934e
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, mechanically consistent dependency refresh with green CI, pending a maintainer decision on non-Linux native-tool coverage.
Proof confidence	🌊 off-meta tidepool	Not applicable: Not applicable: this Dependabot dependency PR is covered by successful repository CI rather than contributor-run behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Not applicable: this Dependabot dependency PR is covered by successful repository CI rather than contributor-run behavior proof.
Evidence reviewed	5 items	Requested dependency updates: The PR changes the Oxfmt declared version and updates the lockfile resolutions for Oxfmt, Oxlint, and Vitest. Platform-native lockfile surface: The lockfile updates Oxfmt and Oxlint binding packages for multiple operating-system and CPU targets, not only the Linux binding used by CI. Current main remains on prior resolutions: Current main still declares Oxfmt 0.62.0, Oxlint 1.77.0, and Vitest 4.1.10, so this work is not already implemented.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch uses pnpm-managed development tools for formatting, linting, and testing. The manifest and lockfile select those tools and their native bindings for developer machines and CI validation.

flowchart LR
  A[Package manifest] --> B[pnpm lockfile]
  B --> C[Development tools]
  C --> D[Local validation scripts]
  D --> E[Continuous integration]

Loading

Decision needed

Question	Recommendation
Is successful Ubuntu CI sufficient for this native formatter/linter binding refresh, or should maintainers require a macOS and Windows tool smoke before merge?	Validate non-Linux tools: Run a narrow macOS and Windows Oxfmt/Oxlint smoke using the locked versions before merging.

Why: The branch replaces lockfile entries for native development-tool bindings across supported platforms, while the available successful run covers Ubuntu only.

Before merge

• Resolve merge risk (P1) - Oxfmt and Oxlint resolve to native binaries for several OS/CPU targets; the successful Ubuntu CI run does not independently establish formatter and linter behavior on macOS or Windows developer machines.
• Resolve merge risk (P1) - Updating the formatter and linter can change automated validation outcomes even though the present Linux CI suite is green.
• Complete next step (P2) - No mechanical repair is identified; a maintainer must decide whether the green Ubuntu suite is enough for the updated cross-platform native development tools.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency update scope	3 development-tool resolutions; 2 files affected; 212 added, 212 removed	The source change is one manifest version plus a lockfile refresh for the formatter, linter, test runner, and their transitive native bindings.

Merge-risk options

Maintainer options:

1. Validate native tool bindings (recommended)
   Run the locked formatter and linter on macOS and Windows before merge to establish that developer validation still starts and completes.
2. Accept platform coverage gap
   Merge with the green Ubuntu suite as sufficient evidence and accept that non-Linux native bindings were not independently exercised.

Technical review

Best possible solution:

Land the lockfile update after a maintainer either obtains a narrow macOS/Windows formatter-and-linter smoke result or explicitly accepts the platform-validation gap for this routine toolchain update.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR is a dependency-maintenance change, not a report of broken user behavior; the manifest and lockfile diff directly establish its scope.

Is this the best way to solve the issue?

Yes, conditionally: updating the declared tool version and deterministic lockfile is the repository-supported path, with non-Linux native-tool validation as the remaining safety check.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 36b5c739e0f9.

Labels

Label changes:

• add merge-risk: 🚨 compatibility: The lockfile replaces Oxfmt and Oxlint native bindings across developer operating systems and architectures.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• remove rating: 🦞 diamond lobster: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P3: This is routine development-tool maintenance with green CI and no reported production regression.
• merge-risk: 🚨 compatibility: The lockfile replaces Oxfmt and Oxlint native bindings across developer operating systems and architectures.
• merge-risk: 🚨 automation: The upgraded formatter and linter directly determine repository lint and format automation behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable: this Dependabot dependency PR is covered by successful repository CI rather than contributor-run behavior proof.

Evidence

What I checked:

• Requested dependency updates: The PR changes the Oxfmt declared version and updates the lockfile resolutions for Oxfmt, Oxlint, and Vitest. (package.json:44, eeea8bf4153b)
• Platform-native lockfile surface: The lockfile updates Oxfmt and Oxlint binding packages for multiple operating-system and CPU targets, not only the Linux binding used by CI. (pnpm-lock.yaml:28, eeea8bf4153b)
• Current main remains on prior resolutions: Current main still declares Oxfmt 0.62.0, Oxlint 1.77.0, and Vitest 4.1.10, so this work is not already implemented. (package.json:44, 36b5c739e0f9)
• CI validation boundary: The repository CI installs from the lockfile and runs typecheck, lint, format check, tests, build, and package smoke on Ubuntu with Node 26; provided PR checks report success. (.github/workflows/ci.yml:18, 36b5c739e0f9)
• Area history: Peter Steinberger recently maintained the same package and lockfile surface through development-dependency refreshes, including commit 1571f31. (package.json:44, 1571f3143be5)

Likely related people:

• Peter Steinberger: Recent main history shows repeated authored development-dependency and toolchain refreshes touching this manifest and lockfile surface. (role: recent area contributor; confidence: high; commits: 1571f3143be5, 439d9e42b891, 56e739868c4d; files: package.json, pnpm-lock.yaml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Obtain or explicitly waive a macOS and Windows Oxfmt/Oxlint smoke result before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-08-24T16:09:50.125Z sha eeea8bf :: needs maintainer review before merge. :: none
• reviewed 2026-08-24T21:02:59.384Z sha eeea8bf :: needs maintainer review before merge. :: none
• reviewed 2026-08-25T00:10:55.574Z sha eeea8bf :: needs maintainer review before merge. :: none
• reviewed 2026-08-25T06:03:17.772Z sha eeea8bf :: needs maintainer review before merge. :: none