chore(deps-dev): bump the npm-all group across 1 directory with 6 updates

[dependabot]

Bumps the npm-all group with 6 updates in the / directory:

Package	From	To
@tsdown/css	0.22.14	0.23.0
oxfmt	0.64.0	0.66.0
tsdown	0.22.14	0.23.0
typescript	6.0.3	7.0.2
postcss-merge-rules	8.0.5	9.0.2
verkit	0.3.2	0.4.0

Updates @tsdown/css from 0.22.14 to 0.23.0

Release notes

Sourced from @​tsdown/css's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• 61718d7 chore: upgrade deps
• 62f01cd chore: release v0.23.0-rc.1
• 41fe425 chore: release v0.23.0-rc.0
• 033daca chore: release v0.23.0-beta.3
• 2471598 chore: release v0.23.0-beta.2
• c606f40 chore(css): upgrade postcss-modules to v9
• b566f6d feat(css): support function form for css.modules.localsConvention
• ebee509 fix(css): watch files imported via @import (#1038)
• be3ea86 feat!: drop types and typesVersionsfields
• Additional commits viewable in compare view

Updates oxfmt from 0.64.0 to 0.66.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Commits

• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• f5f9ea9 docs: add Ember support guide (#1043)
• 8ac89dc chore: upgrade Vitest to v5
• 96a4098 feat: expose programmatic watch controls (#1062)
• 61718d7 chore: upgrade deps
• d04119c chore: upgrade deps
• 55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
• 946224d fix: ignore optional dependencies in type definitions
• 62f01cd chore: release v0.23.0-rc.1
• bf53f43 fix(cli): camel-case nested flag keys
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates postcss-merge-rules from 8.0.5 to 9.0.2

Release notes

Sourced from postcss-merge-rules's releases.

v9.0.2

What's Changed

• fix: add main and types to package manifests in cssnano/cssnano#1958
• fix: update postcss-calc

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.1...cssnano@9.0.2

v9.0.1

What's Changed

• refactor: some small performance gains in cssnano/cssnano#1955

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.0.0...cssnano@9.0.1

v9.0.0

What's Changed

Breaking changes

• Migrate to ESM and simplify config loading in cssnano/cssnano#1948

Probably backward-compatible for most users. Some changes to configuration loading documented in migration guide.

Bug fixes

• Introduce new postcss-calc plugin in cssnano/cssnano@34aec91

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.10...cssnano@9.0.0

v8.0.10

What's Changed

• Make charset normalization idempotent in cssnano/cssnano#1949

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.9...cssnano@8.0.10

v8.0.9

Bug fixes

Bug fixes coming by way of updating colordx and svgo to the latest release.

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@8.0.8...cssnano@8.0.9

v8.0.8

What's Changed

Bug Fixes

• fix(postcss-minify-gradients): minify gradients using spec algorithm in cssnano/cssnano#1941

... (truncated)

Commits

• c14c19d Publish cssnano 9.0.2
• 8e84f80 chore: update postcss-calc to latest version
• b2642b4 chore: move browserslist version to catalog
• 5358f81 chore: update browser data
• a8a9c55 fix(cssnano-preset-default): update postcss-calc
• 901bbcc chore: update pnpm to 11.25
• 0a9a7fc docs: update branch names in README
• 9f8cf3e chore: update development deps
• ec55a36 test: use resolve to check packages
• cdce13c test: add package manifest check
• Additional commits viewable in compare view

Updates verkit from 0.3.2 to 0.4.0

Release notes

Sourced from verkit's releases.

v0.4.0

Breaking changes

coerce() now returns SemVer | null

coerce() previously returned a formatted string. It now returns a mutable, reusable SemVer record.

const version = coerce('release-1.2.3')
version?.major // 1

To retain the previous string result:

const parsed = coerce('release-1.2.3')
const version = parsed ? normalizeFull(parsed) : null

findMinimumForRange() now returns SemVer | null

The minimum version is now returned as a mutable parsed record.

const minimum = findMinimumForRange('^1.2.3')
minimum?.major // 1

To obtain the previous string result:

const minimum = findMinimumForRange('^1.2.3')
const version = minimum ? normalize(minimum) : null

SemVerRange.raw and SemVerRange.normalized were removed

SemVerRange now contains only its effective options and comparator sets:

interface SemVerRange {
  options: RangeOptions
  sets: SemVerComparator[][]
}

Replace range.normalized with:

normalizeRange(range)
</tr></table> 

... (truncated)

Commits

• 1e6c34c chore: release v0.4.0
• 7c13015 refactor!: organize APIs around parsed semver records
• 92c9ab5 perf: simplify parse/normalize logic
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.