[usercao]

Summary

• Update oxfmt from 0.70.0 to 0.73.0.
• Update oxlint from 1.85.0 to 1.88.0.
• Update tinybench from 6.2.0 to 6.2.2.
• Update tsdown from 0.23.0 to 0.23.1.
• Update vite from 8.3.1 to 8.3.4.
• Update vitest from 5.0.2 to 5.0.5.
• Refresh the Yarn lockfile and its transitive development dependencies.

Security

This update resolves Dependabot alert #93, a critical command injection vulnerability in the transitive shell-quote development dependency:

• Advisory: GHSA-pgg4-j6r4-53mv
• CVE: CVE-2026-102422
• CWE: CWE-78
• Severity: critical, CVSS 9.2
• Affected versions: >= 1.8.4, < 1.11.0
• Patched version: 1.11.0

The lockfile now resolves launch-editor to 2.14.2 and shell-quote to 1.12.0 instead of 1.10.0. This supersedes the automated Dependabot security update for alert microsoft#93.

Validation

• corepack yarn verify
  • Formatting and lint checks passed.
  • Type checking passed.
  • 935 unit tests passed.
  • 160 end-to-end tests passed.
  • Scaling, package API, runtime, and pack-content checks passed.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1530095

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​5.0.2 ⏵ 5.0.5			+1	+1
	@​types/​node@​24.19.0 ⏵ 24.19.2	+1		+1
	vite@​8.3.1 ⏵ 8.3.4	+1		+1
	oxfmt@​0.70.0 ⏵ 0.73.0	+8		+1
	tsdown@​0.23.0 ⏵ 0.23.1	+1		+1	+1
	oxlint@​1.85.0 ⏵ 1.88.0	+1		+1
	tinybench@​6.2.0 ⏵ 6.2.2

View full report

[Copilot]

🟢 Approval recommended

Dependency declarations and lockfile updates are consistent, no blocking issues were identified, and comprehensive validation is reported as passing.

No open issues 🎉

What changed in this PR

Updates the plugin’s development tooling and refreshes dependencies to address the reported shell-quote security vulnerability.

Changes:

• Updates six formatting, linting, benchmarking, build, and test dependencies.
• Refreshes transitive dependencies, including shell-quote to 1.12.0.

File	Description
yarn.lock	Updates resolved dependencies and checksums.
package.json	Updates six development dependency ranges.

_{Review effort: Balanced}

[pullfrog]

ℹ️ The diff is clean and mergeable as it stands. One factual correction is needed, and it is in the PR description rather than in the code.

Reviewed changes

• Six dev dependency bumps, all caret ranges in package.json: oxfmt 0.70.0→0.73.0, oxlint 1.85.0→1.88.0, tinybench 6.2.0→6.2.2, tsdown 0.23.0→0.23.1, vite 8.3.1→8.3.4, vitest 5.0.2→5.0.5.
• The security fix rides along in the lockfile refresh. launch-editor 2.14.1→2.14.2 raises its own shell-quote range from ^1.8.4 to ^1.10.0, and the lockfile now resolves shell-quote 1.12.0 instead of 1.10.0, past the 1.11.0 fix for CVE-2026-102422. The old shell-quote@npm:^1.8.4 descriptor is gone, so no vulnerable resolution is left behind.
• Transitive drift stays inside the dev graph: native bindings for oxlint/oxfmt/rolldown, tsdown's declaration toolchain (yuku-codegen/yuku-parser/yuku-ast/@yuku-toolchain/types 0.10.2→0.19.0, verkit 0.4.1→0.5.0, rolldown 1.2.7→1.2.13, tinypool 2.1.2→2.2.0), and @types/node 24.19.0→24.19.2 inside its unchanged ^24 range.
• Nothing that ships moved. All five dependencies resolutions and every TypeScript pin, including the e2e aliases for 5.0.4, 5.5.4, 5.9.3 and 6.0.3, are identical to main, so the supported-host matrix and the emitted-declaration gates run against the same compilers as before. Every newly pinned version also predates the commit by more than a day, so .yarnrc.yml's npmMinimalAgeGate was respected rather than bypassed.

Because CI does not run the whole release gate, I checked the rest locally against this lockfile: yarn install --immutable accepts it, rebuilding lib/ with the bumped toolchain yields a tree byte-identical to the base toolchain's build (including lib/index.d.cts and lib/api.d.ts), and a full yarn verify passes with 935 unit tests, 160 e2e tests, all six consumer type gates, and 14 packed files. The Validation section's claims hold as written.

ℹ️ The security note cites an advisory ID that does not exist

GHSA-pgg4-j6r4-53mv 404s, and the advisory is GHSA-pqg4-j6r4-53mv (p and q transposed): GHSA-pqg4-j6r4-53mv. Everything else in the note is correct (CVE-2026-102422, >= 1.8.4, < 1.11.0, fixed in 1.11.0, CWE-78, CVSS v4 9.2), so this is a string to correct in the description, not a claim to re-investigate.

Not a blocker: there is no changeset. Since the published tarball ships only lib/, I read a dev dependency bump as outside the repo's changeset rule, but a critical advisory fix is the kind of thing you may want visible in the release notes, and that call is yours.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using space-bunny-free (free) ｜ 𝕏}

[quantizor]

nice, thanks! checked this out locally. verify is green, lockfile has shell-quote at 1.12.0 so microsoft#93 is handled, and the built lib/ is byte-identical to main so no changeset needed. tiny nit: the advisory link in the description has a typo (should be GHSA-pqg4-j6r4-53mv). also means #42 can be closed once this lands 👍