build(deps-dev): bump the oxc group with 3 updates

[dependabot]

Bumps the oxc group with 3 updates: oxfmt, oxlint and oxlint-plugin-react-doctor.

Updates oxfmt from 0.71.0 to 0.72.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
• dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)
• 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)
• fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)
• 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)
• 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)
• c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)
• c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)
• 36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)
• 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)
• e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)
• 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

• 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)
• cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)
• 0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

• 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)
• 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)
• 66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)
• af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Updates oxlint from 1.86.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

• 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
• cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
• 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

• 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
• 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
• 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
• 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
• e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
• 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
• ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Updates oxlint-plugin-react-doctor from 0.9.14 to 0.9.17

Release notes

Sourced from oxlint-plugin-react-doctor's releases.

oxlint-plugin-react-doctor@0.9.17

No release notes provided.

oxlint-plugin-react-doctor@0.9.16

Patch Changes

• #1855 23d6160 Thanks @​aidenybai! - Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.

  Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.

• #1855 23d6160 Thanks @​aidenybai! - Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.

• #1855 23d6160 Thanks @​aidenybai! - Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.

• #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

• #1811 3242a81 Thanks @​skoshx! - Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)

  • server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.

  • nextjs-no-redirect-in-try-catch: Recognize Next.js unstable_rethrow(error) as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.

  • server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.

• #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

• #1855 23d6160 Thanks @​aidenybai! - Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent. Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.

• #1855 23d6160 Thanks @​aidenybai! - Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.

  Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.

• #1855 23d6160 Thanks @​aidenybai! - Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.

• #1855 23d6160 Thanks @​aidenybai! - Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.

Changelog

Sourced from oxlint-plugin-react-doctor's changelog.

0.9.17

0.9.16

Patch Changes

• #1855 23d6160 Thanks @​aidenybai! - Avoid sequential-await warnings when local helpers read the same cache entry or delegate to the same imported operation with matching stable arguments. Follow bounded imported helpers to guarded, module-owned Map/WeakMap caches keyed by unchanged function parameters, with dependency fingerprints for cache invalidation. Preserve warnings for distinct imported operations sharing an input, and bound the diagnostic's parallelization advice.

  Keep diagnostics when a helper computes a cache key with an unknown call or property read. These values can change between calls.

• #1855 23d6160 Thanks @​aidenybai! - Recognize convergent last-item equality guards in no-self-updating-effect, including literal tail replacements and appends with tail-preserving deferred trims.

• #1855 23d6160 Thanks @​aidenybai! - Avoid no-derived-state false positives when custom hooks return draft state setters through immutable aliases.

• #1846 6313667 Thanks @​aidenybai! - Disable require-pnpm-hardening by default; enable it explicitly through rules when wanted. Describe await parallelization as a conditional opportunity, preserving ordering, resource limits, and error semantics. Recognize local Promise.all/allSettled collectors and stop describing async array callbacks as sequential.

• #1811 3242a81 Thanks @​skoshx! - Fix cache/navigation binding resolution and unsafe mutation parallelization (issue #1810)

  • server-cache-with-object-literal: Properly resolve React.cache imports through aliases and check all argument positions for fresh objects/arrays. Shadowed or non-React cache functions no longer trigger false positives.

  • nextjs-no-redirect-in-try-catch: Recognize Next.js unstable_rethrow(error) as a valid error forwarding pattern, suppressing the diagnostic when the caught error is correctly rethrown.

  • server-sequential-independent-await and async-parallel: Detect mutating HTTP requests (POST, PUT, PATCH, DELETE) and preserve their ordering, preventing incorrect parallelization suggestions for operations that must run sequentially.

• #1832 8a950f0 Thanks @​skoshx! - Fix effect-needs-cleanup false positive for React 19 callback ref cleanup returns. React 19 callback refs can return cleanup functions with the signature (node: T | null) => void | (() => void). The rule now correctly handles cases where cleanup is only returned after resource usage (e.g., after ResizeObserver.observe()), allowing void returns on the null branch.

• #1855 23d6160 Thanks @​aidenybai! - Resolve local Hook-shaped object methods before applying React Hook namespace heuristics, including inspection dispatchers and useEffectEvent. Preserve Hook diagnostics for unresolved invoked callbacks and bound Hook aliases, while resolving proven local callbacks at each call site.

• #1855 23d6160 Thanks @​aidenybai! - Avoid display-name diagnostics for data factories that return descriptors containing JSX icons.

  Preserve anonymous-component diagnostics for proven array maps and React useMemo callbacks that return render output.

• #1855 23d6160 Thanks @​aidenybai! - Recognize effect-owned timer replacements that clear the previous handle before assignment and release the final timer during teardown.

• #1855 23d6160 Thanks @​aidenybai! - Respect Solid JSX applicability in handler naming, DOM property, and module-scope helper advice while preserving React diagnostics in mixed-runtime files.

0.9.15

Patch Changes

• #1837 83466a8 Thanks @​skoshx! - Fix a stack overflow in no-hydration-branch-on-browser-global when resolving arguments across files. Track parameters and visited bindings by symbol identity so file-local numeric IDs cannot collide, and preserve cycle tracking across imported helpers.

• #1814 499a020 Thanks @​aidenybai! - Stop no-impure-state-updater reporting callbacks handed to a helper that merely runs them (run(async () => setValue("x"))). Only a wrapper that forwards its parameter into a React setter's updater slot still counts as an updater.

  Stop nextjs-no-side-effect-in-get-handler reporting .set() on a Headers object the helper constructs itself; mutations on stores the helper did not create still report.

  Treat a ternary between static values (hasHeader ? 0 : 16) as static spacing in rn-scrollview-dynamic-padding, and reword its recommendation to name the matching contentInset edge and its iOS-only scope.

  Accept a Zustand store.setState(awaitedValue) re-sync as a cache update in query-mutation-missing-invalidation; plain UI-state writes and non-store bindings still report.

... (truncated)

Commits

• 0a046d2 chore: version packages (#1865)
• 675ad3c chore: version packages (#1838)
• 23d6160 fix: resolve latest repository audit false positives (#1855)
• 6313667 fix: make pnpm hardening opt-in and correct async advice (#1846)
• 3242a81 fix: resolve cache/navigation binding and unsafe mutation parallelization (#1...
• d741d58 chore: version packages (#1806)
• 8a950f0 fix: support React 19 callback ref cleanup returns in effect-needs-cleanup (#...
• 83466a8 fix: stop hydration argument cycles across files (#1837)
• 95db911 test: stabilize CI performance and worktree checks (#1834)
• a4daa0a RD CLEANUP: simplify cleanup helpers (#1833)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions