[dependabot]

Bumps the compatible group with 7 updates in the / directory:

Package	From	To
convex	1.46.0	1.48.0
convex-helpers	0.1.128	0.1.129
convex-test	0.0.61	0.0.65
knip	6.41.0	6.43.0
oxfmt	0.72.0	0.75.0
oxlint-tsgolint	7.0.2004	7.0.2005
pkg-pr-new	0.0.91	0.0.92

Updates convex from 1.46.0 to 1.48.0

Changelog

Sourced from convex's changelog.

1.48.0

• Convex deployments can now sign their own JWTs with an internally managed key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs can be verified with the public key in the JWKS hosted at ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

• npx convex dev --verbose and npx convex deploy --verbose no longer print environment variable values. The logged list of environment variables shows every value as <redacted>, and values of 8 or more characters are also redacted wherever else they appear in the logged push response and diff, such as auth providers that auth.config.ts builds from process.env.

• When an AI agent runs npx convex env list or npx convex env default list, they now list only names by default, so secrets stay out of the agent's context. Agents are detected from the environment variables they set. Pass --include-values to print the values.

• Fixed npx convex ai-files install and npx convex ai-files update reporting success and exiting 0 when the guidelines download or the agent skills install failed. They now exit with code 1.

• ctx.storage.store() and ctx.storage.get() are now available in mutations, not just actions. Files stored and read in a mutation count toward its transaction limits.

1.47.0

• Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always failed because dev is reserved for your default dev deployment. It now suggests a dev/my-feature reference and passes --select.
• npx convex deploy now asks for confirmation before creating or changing an index on a large table, since the deploy blocks until the index is backfilled. Stage the index (staged: true) to backfill it in the background instead, or pass the new --skip-large-indexes-check flag to proceed without confirmation. That flag also covers deleting large indexes, replacing the hidden --allow-deleting-large-indexes flag, which keeps working.
• The envList MCP tool now returns only environment variable names by default, so secrets stay out of the agent's context. Pass includeValues: true to get the values too, or use envGet to read a single variable.
• npx convex env list and npx convex env default list have a new --include-values flag for printing values explicitly. Values are still printed by default. The docs and help text now use --include-values wherever the values are needed, like npx convex env list --include-values > .env.convex, and --names-only for just listing variables.
• Added .staged() to defineTable for validating a schema change in the background instead of blocking the deploy on a scan of the table. Pass the fields to add or change, set a field to undefined to remove it, or pass a full validator. The current validator stays enforced while Convex checks existing documents and new writes against the staged one. npx convex deploy

... (truncated)

Commits

• See full diff in compare view

Updates convex-helpers from 0.1.128 to 0.1.129

Changelog

Sourced from convex-helpers's changelog.

0.1.129

• (fix:streams) Retry later groups after nonempty pages (#1027)
• (fix:validators) Only match own keys of an object validator's fields. Thanks to @​mikirejf for the fix! (#1035)

Commits

• f2ede44 npm 0.1.129
• 1dcc570 npm 0.1.129-alpha.0
• c248fba fix(build): publish TypeScript sources under src/ (#1038)
• 8237d3a fix(stream): retry later groups after nonempty pages (#1027)
• e48f9df chore: typecheck the example Convex app with its own tsconfig (#1036)
• 66a908b fix(validators): only match own keys of an object validator's fields (#1035)
• 0fd10de Rename GitHub org references from get-convex to convex (#1033)
• c24d565 test(stream): expand pagination coverage (#1026)
• See full diff in compare view

Updates convex-test from 0.0.61 to 0.0.65

Changelog

Sourced from convex-test's changelog.

0.0.65

• Adds support for Convex mutations that call the ctx.auth.signJwt API.

0.0.64

• Update pagination restriction to match backend: components can now call .paginate and mutations can paginate multiple times.

0.0.63

• Pin Date.now(), Date(), and new Date() for each query or mutation, including nested calls and t.run. Like the Convex backend, the pinned time is at or after the transaction's snapshot timestamp and at or before the _creationTime of documents the transaction inserts. Scheduled functions still become due according to the wall clock, as in the real Convex backend. (#144)
• Enforce the 1,024-candidate limit for text search during iteration and pagination, including candidates excluded by post-search filters. Queries can stop early with .take(), smaller pages, or an early exit from iteration to stay within the limit. (#169, #171)
• Fail early when calling, scheduling, or creating a function handle for an unregistered component, with an error that explains how to register it and lists the registered components. (#164)
• Preserve a stored Blob's content type in _storage metadata. (#170)

0.0.62

• Return typed component references from registerComponent (#161)

Commits

• e6e17df 0.0.65
• ed7a5ce Support ctx.auth.signJwt in mutations (#173)
• ebcf1f7 0.0.64
• 265e5df Allow component pagination with one paginate call per query (#163)
• 5e0fc2a 0.0.63
• 9831bb9 docs: prepare changelog for 0.0.63 (#172)
• c597e3f Enforce search candidate limits in paginated queries (#171)
• fe4e0ac Fail fast with a clear error when a component isn't registered (#164)
• aace21a fix(clock): pin transaction time at or after its snapshot (#144)
• dd4d44b Enforce the search query candidate limit during iteration (#169)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dowski-convex, a new releaser for convex-test since your current version.

Updates knip from 6.41.0 to 6.43.0

Release notes

Sourced from knip's releases.

Release 6.43.0

• Document and pin exports that only keep each other alive (#2160) (39af70abb32523a992a7d6152b8cd95ef317f237)
• Don't add config files without an extension as entry files (resolve #2168) (46a825ddf15d3073b899ed6ef34689e5da5508f2)
• Recognize unscoped ~name workspace packages (resolve #2172) (ba527f7386e7741507f2f18d84864058e02ac907)
• Follow imports and re-exports in ambient modules (resolve #2174) (dbd3a8b8b0429433e5385371c09e805b808a32c2) - thanks @​tlq5l!
• Follow @reference in Tailwind CSS compiler (#2177) (219f16de95e174cdcfd6a90782bcef13cf79bd64) - thanks @​mkantautas!
• Support { find, replacement } array form of Vite alias (#2179) (5d0779bc4cf8c0469c50d5b2cda1a6bd1f053d81) - thanks @​mkantautas!
• fix(expo): treat local config plugins as entry files (#2176) (100ef491509a88b00ea9956ba40dbc1b0ac0c205) - thanks @​Cayan!
• fix(next): detect Turbopack loaders in shared config factories (#2161) (9cf928be5022928a38c12fe8001cec7bf467040c) - thanks @​jakeleventhal!
• Ignore osascript as global binary (#2182) (c301e44c7975442d4d25595f084e6b853f07a434) - thanks @​abrahamguo!
• Skip --fix for exports in multi-declarator variable statements (#2178) (326afd9c1e66eef04d986b83ed829b506f506c48) - thanks @​mkantautas!
• Watch the project directory instead of process.cwd() (#2183) (16d9932d0239f649cf2c1349cc7bc893850cd4f0) - thanks @​abrahamguo!
• Follow directory paths in tsconfig references (#2186) (d741c46e3f2a9caaf6bf4e81e9d4c8cfca48623e) - thanks @​mkantautas!
• Handle @plugin options blocks in Tailwind CSS compiler (#2187) (9fae773eb75bcba03e62f44ce3e9aa0b889bf4ac) - thanks @​mkantautas!
• Remove anonymous default-exported functions and classes in --fix (#2188) (6748259fbb2ea9a5940ea3861626f77677610a86) - thanks @​mkantautas!
• Recognize bun fmt as a built-in command (#2189) (e971b0924bcb7ff8dcab01a180d3016cc08b675d) - thanks @​TomasHubelbauer!
• Add plugin for @​bufbuild/buf (#2142) (90216c261c2273967125669beb611bf763d762c7) - thanks @​ryanquinn3!
• Pass isSsrBuild to Vite config functions (#2191) (d2aa101c55e5d7e8d26548808ce008b214622099) - thanks @​mkantautas!
• Follow src of <script> and <style> blocks in Vue SFCs (#2193) (3d148393d5129a096a182fab36a873b9f710f388) - thanks @​mkantautas!
• Remove import attributes with emptied re-exports in --fix (#2192) (231026cf9c21cc7890f21d048f4af6ea7233d7b8) - thanks @​mkantautas!
• Update npmx.dev snapshot (b2cc439006ec98ff5bbc1c99b99bc1ac5203b6b2)
• Read string parserOptions.parser in ESLint flat configs (#2198) (302f908aa135669d6fe96869ec6452b7570856a4) - thanks @​mkantautas!
• Resolve directory matches in Vitest test.projects to their config (#2195) (4d386138011c27e01e6e910be6d58266e07c9cf1) - thanks @​fixfon!
• Ignore custom elements named script-* when extracting script blocks (#2199) (23e6479b233e1882ddaf29736390309d0f3f040f) - thanks @​mkantautas!
• feat(mcp): add MCP plugin (#2180) (fc92470a9f687e2f1da60b84612ebf3e59a8bbb9) - thanks @​jakeleventhal!
• Handle non-Error plugin config failures (8f21ea2182fac5a96edd7d6d4280a0fa1051e434)
• Update articles list (6569cdcde1a79a6196a35a934b6c0d9d0e23faa4)
• Skip --fix export ranges inside a larger removal (204a8091baf91cb8cfb4e7a9aa70d461cc926baa)
• Detect .travis.yml with a stat instead of a glob (3601c6e32afef3d1d76a3944e540225da5190b9b)
• Mark YAML catalog entries fixed only when their line is removed (#2201) (813fa30e55ef3a8ed749d9d6d5a02a00810cfe72) - thanks @​mkantautas!
• Add Electron Forge plugin (#2158) (12e4355a43ea63c417d3b9ebfbbac1c8510b139e) - thanks @​mehdimirzafaruk!
• Resolve function and promise entries in Vitest test.projects (#2197) (ec293d1a33d30a8b0521725d1148e6e72c6e4220) - thanks @​mkantautas!
• Follow npm lifecycle scripts and run-script aliases (#2202) (89dfdc881e6865aef326c2b9dc700cf5c46b73b4) - thanks @​sushanta-neupane!
• Follow pnpm t, tst and run-script aliases (ce91e230e0823433dfcc1ee4562335c34d2b73ef)
• Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils) (db9aa7443c5b3839df5c0fe320d78ea42f0f3446)
• Ignore tool output before the first report section in ecosystem snapshots (9434bf678e60d16832f13e892d7c1ebc2b9e6ed1)
• Update dependencies (21c3b75fc4ae94208311abb630ff129fcd9fe820)
• Bump engines.node to follow Astro's (9d7a5e07212b093f9d422cab813fad5d01273fc6)

Release 6.42.1

• fix(semantic-release): resolve shareable configs from extends (#2159) (4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks @​giaBaoJS!
• fix(jest): load projects entries as Jest configs (#2167) (4c22593724460890e4492ba86119d0188127f2ba) - thanks @​Cayan!
• Update npmx.dev snapshot (4b19797b77a559f7190e9119b3a156e1ac6aef9f)
• fix(tailwind): track packages referenced from CSS url() (#2166) (949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks @​agustincastaing!
• Add .otf to foreign file extensions (fcff4db0b88d6282569743cd779aec5a5df99862)
• Match quoted SCSS url() values within a single line (2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)
• fix(bun): treat bun test arguments as path filters (#2165) (5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks @​jakeleventhal!
• fix(vitest): use default test entries when config has no test key (#2170) (7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks @​fixfon!

Release 6.42.0

... (truncated)

Commits

• 0712156 Release knip@6.43.0
• 21c3b75 Update dependencies
• db9aa74 Treat vitest-environment-nuxt as optional (it comes with @nuxt/test-utils)
• ce91e23 Follow pnpm t, tst and run-script aliases
• 89dfdc8 Follow npm lifecycle scripts and run-script aliases (#2202)
• ec293d1 Resolve function and promise entries in Vitest test.projects (#2197)
• 12e4355 Add Electron Forge plugin (#2158)
• 813fa30 Mark YAML catalog entries fixed only when their line is removed (#2201)
• 3601c6e Detect .travis.yml with a stat instead of a glob
• 204a809 Skip --fix export ranges inside a larger removal
• Additional commits viewable in compare view

Updates oxfmt from 0.72.0 to 0.75.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.75.0

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)

oxfmt v0.74.0

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)

... (truncated)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• See full diff in compare view

Updates oxlint-tsgolint from 7.0.2004 to 7.0.2005

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2005

What's Changed

• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#1273
• chore(deps): update gomod by @​renovate[bot] in oxc-project/tsgolint#1274
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1275
• chore(deps): update oxc-project/security-action action to v1.0.9 by @​renovate[bot] in oxc-project/tsgolint#1276
• fix(unbound-method): respect this: void on class properties by @​baevm in oxc-project/tsgolint#1277
• docs(security): inherit organization security policy by @​Boshen in oxc-project/tsgolint#1295
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1301
• fix(no-deprecated): avoid infinite loop on circular alias chains by @​magurotuna in oxc-project/tsgolint#1309
• feat(await-thenable): add allowMixedPromiseArrays option by @​camc314 in oxc-project/tsgolint#1307
• chore: remove update-typescript-go.yml by @​camc314 in oxc-project/tsgolint#1311
• ci: pin just version in setup and autofix by @​camc314 in oxc-project/tsgolint#1312
• fix(no-unnecessary-type-parameters): count generic type arguments by @​farnoodma in oxc-project/tsgolint#1297
• feat(no-unsafe-enum-assignment): add rule by @​camc314 in oxc-project/tsgolint#1316
• fix(require-array-sort-compare): report tuples by @​baevm in oxc-project/tsgolint#1317

New Contributors

• @​magurotuna made their first contribution in oxc-project/tsgolint#1309
• @​farnoodma made their first contribution in oxc-project/tsgolint#1297

Full Changelog: oxc-project/tsgolint@v7.0.2004...v7.0.2005

Commits

• 4ebf80f fix(require-array-sort-compare): report tuples (#1317)
• 62e97c9 feat(no-unsafe-enum-assignment): add rule (#1316)
• e649c1e fix(no-unnecessary-type-parameters): count generic type arguments (#1297)
• e333787 ci: pin just version in setup and autofix (#1312)
• bcab203 chore: remove update-typescript-go.yml (#1311)
• bb8225c feat(await-thenable): add allowMixedPromiseArrays option (#1307)
• 086f19a fix(no-deprecated): avoid infinite loop on circular alias chains (#1309)
• a180371 chore(deps): update npm packages (#1301)
• 8897346 docs(security): inherit organization security policy (#1295)
• 69698fe fix(unbound-method): respect this: void on class properties (#1277)
• Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.91 to 0.0.92

Commits

• abfb98a release: v0.0.92
• 5e3a62c feat: support upm and nub in --packageManager flag (#562)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.