[dependabot]

Bumps the development group with 9 updates in the / directory:

Package	From	To
oxfmt	0.75.0	0.76.0
oxlint	1.90.0	1.91.0
oxlint-plugin-react-doctor	0.9.18	0.9.22
ultracite	8.1.0	8.1.1
@tailwindcss/postcss	4.3.3	4.3.4
tailwindcss	4.3.3	4.3.4
@electric-sql/pglite	0.5.13	0.5.15
@electric-sql/pglite-pgvector	0.0.14	0.0.16
tsdown	0.23.4	0.23.5

Updates oxfmt from 0.75.0 to 0.76.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.76.0

💥 BREAKING CHANGES

• 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

• 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)
• 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)
• 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)
• 36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

• dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)
• fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)
• f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)
• fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)
• e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)
• 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)
• f00862b formatter: Keep parens around a generic function type in a type assertion (#28173) (vidigoat)
• 9ead5c4 formatter: Handle this.b and super.b like foo.b (#28200) (leaysgur)
• 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#28199) (leaysgur)
• b8f4f34 formatter: Print x.b and x.#b samely (#28193) (leaysgur)
• 9ddccb7 formatter: Keep parens for private field (#28188) (leaysgur)

⚡ Performance

• b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#28713) (leaysgur)
• 633ee96 formatter_css: Use u32 spans (#28708) (leaysgur)
• f680ee1 formatter_yaml: Use multiline flag for flow scalars (#28707) (leaysgur)
• ff7c203 formatter_css: Avoid repeated scans and allocations in values (#28706) (leaysgur)
• 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#28704) (leaysgur)
• 46f8efd formatter_graphql: Print block string lines borrowed from the source (#28701) (leaysgur)
• dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#28700) (leaysgur)
• e9392c8 formatter_core: Search line terminators with memchr (#28699) (leaysgur)
• ceb26be formatter_htmlish: Use char to escape attr quotes (#28697) (leaysgur)
• 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#28282) (Boshen)

📚 Documentation

• 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#28711) (Yuji Sugiura)
• a82ce83 oxfmt: Update unclassified divergence (#28685) (Yuji Sugiura)
• 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#28465) (Yuji Sugiura)
• 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#28384) (Yuji Sugiura)
• a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#28466) (Yuji Sugiura)
• 6586050 formatter_core: Document tab width in text width policy (#28393) (leaysgur)
• 49fbffb formatter_core: Tighten FORMATTER_POLICY (#28206) (leaysgur)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• See full diff in compare view

Updates oxlint from 1.90.0 to 1.91.0

Release notes

Sourced from oxlint's releases.

oxlint v1.91.0

🚀 Features

• 004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)
• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

• a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)
• 7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)
• 987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)
• e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)
• b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)
• cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)
• c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)
• 4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)
• 61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)
• ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)
• 31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

• 564559d linter/prefer-const: Avoid collecting resolved references (#28732) (Dunqing)
• bb947dc linter: Skip numeric separator formatting for short integers (#28485) (Cam McHenry)
• 1043dfa linter: Avoid collecting prefer-const binding identifiers (#28484) (Cam McHenry)
• 7c93eef linter: Reduce branches-sharing-code scratch allocations (#28483) (Cam McHenry)
• c0065fd linter: Allocate escape-case replacements only when needed (#28482) (Cam McHenry)
• d837414 linter: Lazily normalize capitalized-comments text (#28481) (Cam McHenry)
• 6baaad6 linter: Avoid no-var binding identifier allocations (#28480) (Cam McHenry)
• 882053b linter: Skip read-only parameters in no-param-reassign (#28479) (Cam McHenry)
• 92deebf linter: Reduce no-unmodified-loop-condition allocations (#28478) (Cam McHenry)
• f01d52d linter: Reduce no-duplicate-case allocations (#28477) (Cam McHenry)
• 6a72d84 linter: Reduce no-dupe-class-members allocations (#28476) (Cam McHenry)
• 77599ef linter: Reduce no-this-before-super allocations (#28475) (Cam McHenry)
• 2ea9f58 linter/no-dupe-else-if: Use smallvec to reduce allocs (#28474) (Cam McHenry)
• 69f0204 linter/react/rules-of-hooks: Reduce allocs (#28473) (Cam McHenry)
• b138c20 linter: Reduce allocs in no-dupe-keys (#28472) (Cam McHenry)
• 6f3e982 linter: Avoid operator allocations in no-useless-length-check (#28471) (Cam McHenry)
• fd68928 react-compiler: Skip passes lint does not need (Yagiz Nizipli)
• 224f4dd linter/eslint/sort-keys: Reserve initial capacity for string (#27624) (Cam McHenry)
• e4e01a3 linter/import/no-cycle: Compare visited modules by absolute resolved path (#27517) (Cam McHenry)
• 741b29b linter/import/no-cycle: Cache sorted module record snapshots (#27516) (Cam McHenry)
• 20022bb linter/import/no-cycle: Reuse traversal buffers between imports (#27481) (Cam McHenry)
• fd5edb7 linter/import/no-cycle: Reuse module records in diagnostic stack (#27480) (Cam McHenry)
• 73e877c linter/import/no-cycle: Don't allocate paths already seen (#27478) (Cam McHenry)
• 1515d53 linter/react/forward-ref-uses-ref: Narrow forward-ref-uses-ref dispatch (#28367) (Cam McHenry)
• ee51c01 linter/react/no-string-refs: Narrow AST dispatch (#28366) (Cam McHenry)
• bbfd692 linter/react/no-children-pop: Narrow AST dispatch (#28365) (Cam McHenry)
• a86158b linter/unicorn/prefer-set-size: Narrow AST dispatch (#28364) (Cam McHenry)
• a777fa6 linter/eslint/no-iterator: Narrow member dispatch (#28363) (Cam McHenry)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.91.0] - 2026-11-02

🚀 Features

• 419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
• See full diff in compare view

Updates oxlint-plugin-react-doctor from 0.9.18 to 0.9.22

Release notes

Sourced from oxlint-plugin-react-doctor's releases.

oxlint-plugin-react-doctor@0.9.22

Patch Changes

• #2326 ad51b5a Thanks @​aidenybai! - Treat an effect cleanup that only reads a proven local runtime binding as empty. Preserve cleanup exemptions for global identifiers and member reads that can run getters, and keep no-op filtering conservative in other rules. no-mirror-prop-effect, no-event-trigger-state, no-effect-event-handler, no-effect-chain and rendering-hydration-no-flicker also stop skipping effects with proven empty or read-only inline cleanups. Unknown cleanup factories and other effectful returns remain conservative.

oxlint-plugin-react-doctor@0.9.21

Patch Changes

• #2320 5a2c6f5 Thanks @​aidenybai! - Report an unguarded useReducer dispatch after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(dispatch, action)), exactly where the direct dispatch is reported. Only no-set-state-after-await-in-effect accepts the forwarded dispatch, because it already counts a direct dispatch. The prop-change rules, which compare writes against useState initializers, stay unchanged. Imported, reassigned, asynchronous, deferred and conditional helpers, and reassigned dispatch bindings, stay outside the proof.

• #2319 39152dc Thanks @​aidenybai! - Report react-hooks-js/set-state-in-effect when an effect updates state synchronously through a transparent local setter helper, such as useEffect(() => assign(setValue, next)), which React Compiler does not follow. A new forwarded-set-state-in-effect rule finds the write with the forwarded setter proof, runs only when the compiler rule is enabled, and React Doctor reports its finding under the compiler's rule key, message and docs link, so react-hooks/set-state-in-effect disable comments, ignores and scoring treat it like the compiler finding. Compiler-visible synchronous setter calls retain duplicate suppression. Ref-derived measurements and guarded ref writes remain allowed. Imported, reassigned, asynchronous, deferred, conditional and multi-statement forwarding helpers stay outside the proof.

oxlint-plugin-react-doctor@0.9.20

Patch Changes

• #2317 2c5d72c Thanks @​aidenybai! - Report an unguarded state update after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(setValue, next)), exactly where the direct setter call is reported. Cleanup guards still protect the forwarded write. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof. Preserve transparent TypeScript setter arguments and implicit undefined writes, and exclude bound/call/apply argument shifts from the forwarding proof.

  Keep resource lifecycle exemptions when the same setter is forwarded through immutable aliases, and register the deferred-write rule in cross-file cache metadata.

• #2315 8a7c60a Thanks @​aidenybai! - Report state adjusted after a prop change through a transparent local setter helper, such as assign(setValue, ""), exactly where the direct setter call is reported, including functional updaters and layout effects. Evaluate the forwarded write at its call site for the released object URL, portal mount, request map, resource lifecycle, and external work checks. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Preserve resource lifecycle and asynchronous loading exemptions when related event or completion writers also use transparent setter helpers.

• #2316 b713862 Thanks @​aidenybai! - Report an effect that resets all state after a prop change through a transparent local setter helper, such as assign(setKey, ""), exactly where the direct reset is reported, including layout effects. A reload forwarded through the same helper from an asynchronous callback now counts as a loading lifecycle, and a handler that writes through the helper keeps the hidden-until-reset exemption. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Keep setter identity stable across immutable aliases when counting reset state and recognizing asynchronous reloads. Resource lifecycle handlers retain their exemptions when their writes are forwarded through the same proven helper.

oxlint-plugin-react-doctor@0.9.19

Patch Changes

• #2000 9a79847 Thanks @​aidenybai! - Let rules declare the code that owns a finding separately from its diagnostic location. With --scope contextual, exhaustive-deps now reports existing dependency findings when their hook call or resolved local callback changes. Ownership survives lint-cache replay and stays out of public JSON reports and score requests.

  Add JSX element scope for alt-text and click-events-have-key-events, and function scope for rules-of-hooks. Existing scan defaults and other scopes are unchanged.

• #2311 813bd63 Thanks @​aidenybai! - Recognize synchronous derived-state writes through transparent local helpers that receive a React state setter. Preserve external, deferred, mutable, and independently editable state, including event writes through readonly setter aliases for direct and forwarded effect writes. Compare forwarded values with their existing state initializer. Withhold the forwarding proof for reassigned helpers and parameters whose defaults or destructuring can perform additional work.

• #2313 be55f78 Thanks @​aidenybai! - Detect unguarded state updates in inline microtask and proven native Promise callbacks started by effects with changing dependencies. Preserve cleanup guards, stable dependencies, and opaque or shadowed thenables.

  Exclude inert generator callbacks and mutated or escaped Promise receivers, and cache immutable provenance checks for shared Promise bindings.

• #2312 e5c7c99 Thanks @​aidenybai! - Detect redundant state derivation, initialization, adjustment, and resets in React useLayoutEffect, including imported aliases. Preserve layout measurement and resource lifecycle exemptions, and describe avoidable renders without implying stale content must be painted.

• #2308 a4bcd7f Thanks @​NisargIO! - Stop treating an empty effect cleanup as a real one. return () => {}, return () => undefined, a direct const function binding, or flag ? () => {} : undefined no longer silences no-adjust-state-on-prop-change, no-chain-state-updates, no-effect-event-handler, no-event-handler, no-pass-data-to-parent, or the derived-state rules' cleanup-managed state check. Cleanups that do work during parameter evaluation and disposer calls opposite inline or named empty functions still exempt the effect. Mutable bindings and unproven callback factories retain the existing conservative exemption.

• #2011 84ad0c8 Thanks @​skoshx! - Fix unsafe-json-in-html false positive for JSON.stringify().replaceAll("<", "\\u003c")

  The unsafe-json-in-html rule now recognizes .replaceAll("<", "\\u003c") as a safe escape pattern, equivalent to the already-recognized .replace(/</g, "\\u003c") form. This resolves false positives when developers use the more explicit .replaceAll method to escape less-than characters in JSON-LD or other JSON embedded in HTML/script tags.

• #2309 95cd1d4 Thanks @​aidenybai! - Detect missing cleanup for native timers called through globalThis, window, self, global, and proven constant aliases. Recognize matching qualified clearInterval and clearTimeout calls while preserving shadowed receiver and timer handle checks. Exclude qualified timer methods that have been overwritten, deleted, or updated, and never count an overridden clear method as cleanup.

... (truncated)

Changelog

Sourced from oxlint-plugin-react-doctor's changelog.

0.9.22

Patch Changes

• #2326 ad51b5a Thanks @​aidenybai! - Treat an effect cleanup that only reads a proven local runtime binding as empty. Preserve cleanup exemptions for global identifiers and member reads that can run getters, and keep no-op filtering conservative in other rules. no-mirror-prop-effect, no-event-trigger-state, no-effect-event-handler, no-effect-chain and rendering-hydration-no-flicker also stop skipping effects with proven empty or read-only inline cleanups. Unknown cleanup factories and other effectful returns remain conservative.

0.9.21

Patch Changes

• #2320 5a2c6f5 Thanks @​aidenybai! - Report an unguarded useReducer dispatch after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(dispatch, action)), exactly where the direct dispatch is reported. Only no-set-state-after-await-in-effect accepts the forwarded dispatch, because it already counts a direct dispatch. The prop-change rules, which compare writes against useState initializers, stay unchanged. Imported, reassigned, asynchronous, deferred and conditional helpers, and reassigned dispatch bindings, stay outside the proof.

• #2319 39152dc Thanks @​aidenybai! - Report react-hooks-js/set-state-in-effect when an effect updates state synchronously through a transparent local setter helper, such as useEffect(() => assign(setValue, next)), which React Compiler does not follow. A new forwarded-set-state-in-effect rule finds the write with the forwarded setter proof, runs only when the compiler rule is enabled, and React Doctor reports its finding under the compiler's rule key, message and docs link, so react-hooks/set-state-in-effect disable comments, ignores and scoring treat it like the compiler finding. Compiler-visible synchronous setter calls retain duplicate suppression. Ref-derived measurements and guarded ref writes remain allowed. Imported, reassigned, asynchronous, deferred, conditional and multi-statement forwarding helpers stay outside the proof.

0.9.20

Patch Changes

• #2317 2c5d72c Thanks @​aidenybai! - Report an unguarded state update after await or inside a microtask or Promise callback when it goes through a transparent local setter helper, such as queueMicrotask(() => assign(setValue, next)), exactly where the direct setter call is reported. Cleanup guards still protect the forwarded write. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof. Preserve transparent TypeScript setter arguments and implicit undefined writes, and exclude bound/call/apply argument shifts from the forwarding proof.

  Keep resource lifecycle exemptions when the same setter is forwarded through immutable aliases, and register the deferred-write rule in cross-file cache metadata.

• #2315 8a7c60a Thanks @​aidenybai! - Report state adjusted after a prop change through a transparent local setter helper, such as assign(setValue, ""), exactly where the direct setter call is reported, including functional updaters and layout effects. Evaluate the forwarded write at its call site for the released object URL, portal mount, request map, resource lifecycle, and external work checks. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Preserve resource lifecycle and asynchronous loading exemptions when related event or completion writers also use transparent setter helpers.

• #2316 b713862 Thanks @​aidenybai! - Report an effect that resets all state after a prop change through a transparent local setter helper, such as assign(setKey, ""), exactly where the direct reset is reported, including layout effects. A reload forwarded through the same helper from an asynchronous callback now counts as a loading lifecycle, and a handler that writes through the helper keeps the hidden-until-reset exemption. Imported, reassigned, asynchronous, deferred, conditional, and multi-statement helpers stay outside the proof.

  Keep setter identity stable across immutable aliases when counting reset state and recognizing asynchronous reloads. Resource lifecycle handlers retain their exemptions when their writes are forwarded through the same proven helper.

0.9.19

Patch Changes

• #2000 9a79847 Thanks @​aidenybai! - Let rules declare the code that owns a finding separately from its diagnostic location. With --scope contextual, exhaustive-deps now reports existing dependency findings when their hook call or resolved local callback changes. Ownership survives lint-cache replay and stays out of public JSON reports and score requests.

  Add JSX element scope for alt-text and click-events-have-key-events, and function scope for rules-of-hooks. Existing scan defaults and other scopes are unchanged.

• #2311 813bd63 Thanks @​aidenybai! - Recognize synchronous derived-state writes through transparent local helpers that receive a React state setter. Preserve external, deferred, mutable, and independently editable state, including event writes through readonly setter aliases for direct and forwarded effect writes. Compare forwarded values with their existing state initializer. Withhold the forwarding proof for reassigned helpers and parameters whose defaults or destructuring can perform additional work.

• #2313 be55f78 Thanks @​aidenybai! - Detect unguarded state updates in inline microtask and proven native Promise callbacks started by effects with changing dependencies. Preserve cleanup guards, stable dependencies, and opaque or shadowed thenables.

  Exclude inert generator callbacks and mutated or escaped Promise receivers, and cache immutable provenance checks for shared Promise bindings.

• #2312 e5c7c99 Thanks @​aidenybai! - Detect redundant state derivation, initialization, adjustment, and resets in React useLayoutEffect, including imported aliases. Preserve layout measurement and resource lifecycle exemptions, and describe avoidable renders without implying stale content must be painted.

• #2308 a4bcd7f Thanks @​NisargIO! - Stop treating an empty effect cleanup as a real one. return () => {}, return () => undefined, a direct const function binding, or flag ? () => {} : undefined no longer silences no-adjust-state-on-prop-change, no-chain-state-updates, no-effect-event-handler, no-event-handler, no-pass-data-to-parent, or the derived-state rules' cleanup-managed state check. Cleanups that do work during parameter evaluation and disposer calls opposite inline or named empty functions still exempt the effect. Mutable bindings and unproven callback factories retain the existing conservative exemption.

• #2011 84ad0c8 Thanks @​skoshx! - Fix unsafe-json-in-html false positive for JSON.stringify().replaceAll("<", "\\u003c")

... (truncated)

Commits

• 9791c32 chore: version packages (#2329)
• ad51b5a fix: treat an effect cleanup that only reads a binding as empty (#2326)
• 8552771 chore: version packages (#2323)
• 5a2c6f5 FPFNFIXAPEX: report reducer dispatch through transparent setter helpers (#2320)
• 39152dc FPFNFIXAPEX: report setState in effects through transparent setter helpers (#...
• 367ec1b chore: version packages (#2318)
• 2c5d72c FPFNFIXAPEX: report deferred state writes through transparent setter helpers ...
• b713862 FPFNFIXAPEX: report full state resets through transparent setter helpers (#2316)
• 8a7c60a FPFNFIXAPEX: report prop adjustments through transparent setter helpers (#2315)
• 4a3bc02 chore: version packages (#2004)
• Additional commits viewable in compare view

Updates ultracite from 8.1.0 to 8.1.1

Release notes

Sourced from ultracite's releases.

ultracite@8.1.1

Patch Changes

• 79d73d9: Update Biome to 2.6.4. The release adds 30 nursery rules, which the Biome presets leave off, and promotes or removes none, so the presets are unchanged and the @biomejs/biome peer range stays at ^2.6.2. The useSortedProperties assist that core turns on now follows stylelint-config-recess-order 7.9.0, so ultracite fix can reorder CSS properties it used to leave alone, such as scroll-behavior, anchor positioning and multi-column layout. It also no longer offers a sort that would change which of two overlapping declarations wins. noShorthandPropertyOverrides also recognises overrides of logical border, corner shape, position-try, text-box and transition-behavior properties. The Markdown formatter stays off in core: 2.6.4 fixes the dropped space before inline code, but it still rewrites a literal [ ] in prose to []. See the 2.6.4 release notes.

• 3572b86: Update the ESLint packages init installs: typescript-eslint 8.72.1, eslint-plugin-vue 10.12, eslint-plugin-storybook 10.6.5, @tanstack/eslint-plugin-query 5.105.1, @react-native/eslint-plugin 0.88.1, globals 17.14 and eslint-plugin-react-doctor 0.9.21, plus the Oxlint JS plugin oxlint-plugin-react-doctor 0.9.21. The presets were checked against ESLint 10.14.

  The Vue preset turns on eslint-plugin-vue's three new rules automatically: vue/no-content-outside-block reports content outside the top-level blocks of a .vue file, which the compiler drops; vue/no-define-model-default reports a default in defineModel(); and vue/no-props-shadow reports <script setup> declarations that shadow a prop. The new block-lang required and require-explicit-emits ignoreMixins options stay at their defaults: the first would reject components without a given block, and the second skips components that use mixins.

  react-doctor 0.9.21 adds react-doctor/forwarded-set-state-in-effect, which reports a state setter passed from an effect to a helper that calls it synchronously, such as useEffect(() => syncFrom(id, setValue), [id]). It is on in the ESLint React preset and in ultracite/oxlint/js-plugins. Setters handed to subscriptions, timers and listeners aren't reported.

• 6675a90: Update oxfmt to 0.75.0. The release changes no options. It fixes a run of formatting bugs, among them parentheses dropped around private in checks and instantiation expressions, a ; dropped before class members named in or instanceof, and its width heuristics now measure display width, so lines with wide characters (such as CJK text) can wrap differently after upgrading. Its prettier-plugin-astro integration now needs @astrojs/compiler-rs 0.5, which is the version ultracite init installs. See the 0.75.0 release notes for the full list.

• 3e83844: Update oxlint to 1.90.0 and enable its new type-aware rule, typescript/no-unsafe-enum-assignment, in the core Oxlint preset. It reports a value assigned, returned or passed where an enum is expected when it doesn't share that enum's type, such as const fruit: Fruit = 1, matching the @typescript-eslint rule of the same name that the ESLint type-aware preset already enables. Like the other type-aware rules, it only runs with oxlint --type-aware and oxlint-tsgolint installed, and oxlint 1.90 needs oxlint-tsgolint 7.0.2005 or later. Older oxlint releases fail to parse a config that names the rule, so the oxlint peer range moves to ^1.90.0.

  The release also makes a few rules report cases they used to miss: array-callback-return checks callbacks passed with extra arguments, no-useless-concat sees through parentheses, and jest/no-conditional-expect checks function expression callbacks. See the 1.90.0 release notes.

  Requires oxlint >= 1.90.0

Commits

• 9294814 Version Packages (#861)
• d23f3c5 Re-measure the provider pages for the toolchain update
• 3572b86 Update the ESLint plugins, Vue to 10.12 and react-doctor to 0.9.21
• 79d73d9 Update Biome to 2.6.4
• 6675a90 Update oxfmt to 0.75.0
• 3e83844 Update oxlint to 1.90.0 and enable no-unsafe-enum-assignment
• 62a10ca Bump actions/setup-node from 7.0.0 to 7.1.0 (#860)
• 8e0d593 Add the function style research post
• See full diff in compare view

Updates @tailwindcss/postcss from 4.3.3 to 4.3.4

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.4

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php files) (#20414)
• Canonicalization: don't merge utilities that reference different theme variables set to CSS-wide keywords like unset (#20417)
• Don't generate utilities when a modifier is used that would otherwise be silently ignored (e.g. rounded-sm/[5], shadow-sm/foo, stroke-2/50) (#20419)
• Preserve and, or, and not inside selectors in supports-[…] variants (e.g. supports-[selector(a:not(.foo))]:flex) (#20420)
• Don't warn about Angular's ::ng-deep and :host-context() when optimizing CSS (#20434)
• Don't generate CSS for candidates containing an empty additional modifier (e.g. bg-red-500/50/ and group-hover/foo//bar:flex) (#20466)
• Ensure min-*, max-*, and container query variants with decimal values are sorted numerically (e.g. min-[40.25rem] before min-[40.5rem]) (#20512)
• Ensure CSS comments ending with \*/ are closed correctly instead of swallowing the CSS that follows (e.g. /* C:\temp\*/) (#20508)
• Improve style invalidation performance of group-* and peer-* variants (#20513)
• Ensure cached compilers release their loadModule and loadStylesheet callbacks after compilation (#20531)
• Canonicalization: preserve & when moving a pseudo-element into * or ** (e.g. [&_::before]:flex → **:[&::before]:flex) (#20550)
• Ensure the Set.prototype.intersection polyfill in canonicalizeCandidates(…) returns the intersection instead of the first set on Node.js < 22 (#20562)
• Canonicalization: ensure inline theme(…) alphas with more than 2 decimals migrate to a percentage modifier with the same opacity (e.g. theme(colors.red.500/.12345) → text-red-500/[12.345%], not text-red-500/[12.345]) (#20563)
• Canonicalization: preserve inline theme(…) alphas as an arbitrary percentage when a custom --opacity-* theme value would change the opacity (e.g. theme(colors.red.500/50%) → text-red-500/[50%] with --opacity-50: 10%) (#20563)
• Ensure the @property fallback isn't applied in Safari versions that no longer support margin-trim: inline (#20569)
• Treat viewport units like dvmin and svi and font-relative units like cap and rex as lengths in arbitrary values (e.g. text-[10dvmin] generates font-size instead of color) (#20516)
• Write plugin logs to stderr in tailwindcss canonicalize so they don't end up in the results on stdout (#20561)
• Extract class shorthands on later lines when Pug text, comments, or quoted attribute values contain unbalanced brackets, or a quote that doesn't start a string (e.g. input(pattern=/"/.source)) (#20547, #20572)
• Underline the correct occurrence of an unsupported data type in --value(…) warnings (#20554)
• Canonicalization: prefer an existing candidate when collapsing utilities over another utility with the same default theme value (e.g. text-foreground text-primary → text-primary, not text-card-checked-border) (#20540)
• Canonicalization: don't collapse utilities into a utility that uses another theme variable with the same default value (e.g. mt-card mb-card → my-card, not my-4) (#20574)
• Ensure @tailwindcss/postcss rewrites relative url(…)s of stylesheets that are inlined before it runs (e.g. @imports in Vite) in optimized builds (#20576)
• Drop nested rules that put a combinator after a pseudo-element when using pseudo-element variants (e.g. selection:* on a utility with a nested & > * rule) (#20575)
• Don't generate CSS for arbitrary values with unbalanced parentheses or brackets (e.g. w-[calc(1px] or [--x:a[b]) (#20577)
• Canonicalization: prevent collapse: true from taking exponentially longer when classes are linked through a utility that sets many properties (e.g. sr-only) (#20558)
• Ensure & is substituted inside :-moz-any(…) and :-webkit-any(…) in custom variants (e.g. @custom-variant firefox (:-moz-any(&));) (#20486)
• Ensure the standalone macOS binaries have a valid code signature, so macOS 27 no longer kills them at launch (#20578)
• Ensure @tailwindcss/turbopack and @tailwindcss/webpack rebuild when the input CSS changes (e.g. next dev with Turbopack no longer serves the CSS of the previous edit) (#20582)
• Canonicalization: don't drop a utility that sets a --tw-* variable when an unrelated property has the same value (e.g. link mt-4 no longer becomes mt-4 when link sets margin-top: 16px and --tw-translate-x: 16px) (#20593)

... (truncated)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.4] - 2026-11-02

Added

• Add @tailwindcss/turbopack, a Turbopack loader for using Tailwind CSS with Next.js (#20367)

Fixed

• Ensure watch mode detects changes to symlinked @source files whose real paths aren't otherwise scanned (#20356)
• Ensure variants using @scope wrap generated utilities instead of nesting inside them (#20369)
• Ensure nested @scope rules preserve their scoping semantics when flattened (#20369)
• Preserve declarations directly inside @scope by wrapping them in :where(:scope) (#20369)
• Ensure generated utilities include a space in empty var() fallbacks (e.g. var(--tw-blur,) → var(--tw-blur, )) (#20373)
• Canonicalization: convert arbitrary breakpoint and container query variants to named equivalents (e.g. max-[64rem]:flex → max-lg:flex) (#20380)
• Prevent @tailwindcss/vite from crashing on every edit under Vite's experimental bundledDev mode (#20379)
• Ensure @tailwindcss/oxide falls back to WASM on platforms without native bindings (#20383)
• Extract class candidates from Ruby %w and %W literals using angle brackets or custom delimiters (e.g. %w<flex>, %w|flex|), including in Slim and Haml templates (#20387)
• Preserve whitespace in --default(…) values in functional @utility definitions (e.g. --default(box alphabetic) no longer becomes boxalphabetic) (#20392)
• Ensure automatic source detection respects negation-based .gitignore files (e.g. /* followed by !/… patterns) (#20397)
• Ensure root theme('…') namespace lookups in JavaScript plugins and config files return the full namespace object instead of the value of its DEFAULT key (#20399)
• Skip ignored directories when generating watch globs instead of walking their contents on every rebuild (#20408)
• Drop invalid UTF-8 candidates during class detection (#20389)
• Prevent @tailwindcss/vite from forcing full-page reloads for scanned files that Vite does not handle as modules (e.g. .php file...

  Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vecstore-sdk	Ready	Preview	Nov 7, 2026 3:33am UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 867c56b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 55d078ec-2aba-4e41-92fc-5e69d115adeb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​electric-sql/​pglite-pgvector@​0.0.14 ⏵ 0.0.16	+1		+1	+1
	tailwindcss@​4.3.3 ⏵ 4.3.4	+1		+1
	oxfmt@​0.75.0 ⏵ 0.76.0	+8			-1
	tsdown@​0.23.4 ⏵ 0.23.5	+1		+1	+1
	oxlint@​1.90.0 ⏵ 1.91.0	+1			+2
	ultracite@​8.1.0 ⏵ 8.1.1			+1
	oxlint-plugin-react-doctor@​0.9.18 ⏵ 0.9.22	+1		+1
	@​electric-sql/​pglite@​0.5.13 ⏵ 0.5.15	+1		+1	+1
	@​tailwindcss/​postcss@​4.3.3 ⏵ 4.3.4	+1		+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@79

commit: 867c56b