[dependabot]

Bumps the compatible group with 8 updates in the / directory:

Package	From	To
@convex-dev/eslint-plugin	5.0.0	5.0.1
convex	1.46.0	1.49.0
convex-helpers	0.1.128	0.1.133
convex-test	0.0.61	0.0.67
knip	6.41.0	6.44.1
oxfmt	0.72.0	0.76.0
oxlint-tsgolint	7.0.2004	7.0.2005
pkg-pr-new	0.0.91	0.0.93

Updates @convex-dev/eslint-plugin from 5.0.0 to 5.0.1

Changelog

Sourced from @​convex-dev/eslint-plugin's changelog.

5.0.1

• Fix false positives in @convex-dev/no-collect-in-query with type-aware linting. In projects that include Convex's types, the rule reported every .collect() call, including ones on classes and objects unrelated to Convex. It now only reports .collect() on Convex queries. Thanks to @​stickerdaniel for the fix.
• Fix false positives in @convex-dev/no-filter-in-query with type-aware linting. The rule recognized Convex queries partly by name, so it reported .filter() on unrelated types, such as a class whose predicate takes a parameter of a type named FilterBuilder, or a non-Convex db.query() result stored in a variable. It now only reports .filter() on Convex queries.

Commits

• See full diff in compare view

Updates convex from 1.46.0 to 1.49.0

Changelog

Sourced from convex's changelog.

1.49.0

• New npx convex plugins install command, which installs the Convex plugin for Claude Code and Codex on macOS and Linux. It works with the terminal CLIs, the desktop apps and the VS Code extensions. Running it again upgrades the plugin to the latest version.
• This version drops support for Node.js 20. Please update to Node.js 22 or newer.
• Adds the v.function({ fnType, args, returns }) validator, which validates that a value is a well-formed function handle. You can specify fnType, args, and returns for TypeScript typechecking and including type signatures in codegen, but they are not checked when running functions or writing to a table at runtime. The inferred type of v.function() is FunctionHandle_future, which has the same type semantics as FunctionReference_future. When incorporating v.function() into your codebase, existing code that uses the FunctionHandle type may need to be updated to use FunctionHandle_future.
• Security fixes for GHSA-qw8j-4xj7-6f28 and GHSA-9mw5-7p28-rvv4.

1.48.0

• Convex deployments can now sign their own JWTs with an internally managed key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs can be verified with the public key in the JWKS hosted at ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

• npx convex dev --verbose and npx convex deploy --verbose no longer print environment variable values. The logged list of environment variables shows every value as <redacted>, and values of 8 or more characters are also redacted wherever else they appear in the logged push response and diff, such as auth providers that auth.config.ts builds from process.env.

• When an AI agent runs npx convex env list or npx convex env default list, they now list only names by default, so secrets stay out of the agent's context. Agents are detected from the environment variables they set. Pass --include-values to print the values.

• Fixed npx convex ai-files install and npx convex ai-files update reporting success and exiting 0 when the guidelines download or the agent skills install failed. They now exit with code 1.

• ctx.storage.store() and ctx.storage.get() are now available in mutations, not just actions. Files stored and read in a mutation count toward its transaction limits.

1.47.0

• Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always

... (truncated)

Commits

• See full diff in compare view

Updates convex-helpers from 0.1.128 to 0.1.133

Changelog

Sourced from convex-helpers's changelog.

0.1.133

• Zod 4 support: when a z.object() schema is passed as args to zCustomQuery/zCustomMutation/zCustomAction, checks on the object itself (.refine(), .superRefine(), .check()) are now run. Previously they were silently skipped. (#1055)

0.1.132

• Enforces defaultPolicy: "deny" for RLS on bare db.get calls where table name is not provided and cannot be determined.

0.1.131

• Zod 4 support: fixed a regression in 0.1.130 when chaining multiple .brand() calls together.

0.1.130

• Zod 4 support: bug fixes when used across different Zod versions:
  • zodToConvex now makes the fields of z.partialRecord optional on Zod 4.5 and later, with literal and enum keys. Thanks to @​aymanemt1 for the fix! (#1025, #1047)
  • Fixed TS2589: Type instantiation is excessively deep and possibly infinite when calling convexToZod inline (e.g. in the args of zCustomMutation) on Zod 4.6.6 and later. Thanks to @​jherth for the fix! (#1043)
  • Fixed the type of v.commitTs() in convexToZod on Zod 4.6. (#1050)
  • Fixed the type of branded zod/mini objects on Zod 4.0–4.2. (#1051)
• validate and parse now reject arrays and class instances (e.g. Date, Map) for v.record(...) validators, as Convex does. Thanks to @​RishavTiwari25 for the fix! (#1040)

0.1.129

• (fix:streams) Retry later groups after nonempty pages (#1027)
• (fix:validators) Only match own keys of an object validator's fields. Thanks to @​mikirejf for the fix! (#1035)

Commits

• 51f7bf8 npm 0.1.133
• 49a82e5 remove old package.json
• 6b17e15 Preserve extensionless package imports
• 03ffe84 package version
• 1815d4a Stage npm releases in CI and tag successful uploads (#1022)
• 290b146 Changelog for v0.1.133 (#1057)
• 1d7c578 fix(zod4): parse object args with the schema that was passed in (#1055)
• cddb52e Publish convex-helpers from the root with compiled dist entrypoints (#1024)
• b1cc431 npm 0.1.132
• d036c7e default deny gets without matching tableName
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for convex-helpers since your current version.

Updates convex-test from 0.0.61 to 0.0.67

Changelog

Sourced from convex-test's changelog.

0.0.67

• Adds support for file storage access in mutations.

0.0.66

• perf: only visit the queried table's documents in _iterateDocs (#154)

0.0.65

• Adds support for Convex mutations that call the ctx.auth.signJwt API.

0.0.64

• Update pagination restriction to match backend: components can now call .paginate and mutations can paginate multiple times.

0.0.63

• Pin Date.now(), Date(), and new Date() for each query or mutation, including nested calls and t.run. Like the Convex backend, the pinned time is at or after the transaction's snapshot timestamp and at or before the _creationTime of documents the transaction inserts. Scheduled functions still become due according to the wall clock, as in the real Convex backend. (#144)
• Enforce the 1,024-candidate limit for text search during iteration and pagination, including candidates excluded by post-search filters. Queries can stop early with .take(), smaller pages, or an early exit from iteration to stay within the limit. (#169, #171)
• Fail early when calling, scheduling, or creating a function handle for an unregistered component, with an error that explains how to register it and lists the registered components. (#164)
• Preserve a stored Blob's content type in _storage metadata. (#170)

0.0.62

• Return typed component references from registerComponent (#161)

Commits

• f9700ad 0.0.67
• c5aacdc Support ctx.storage.store and ctx.storage.get in mutations (#166)
• 3a3b9a0 0.0.66
• 76e9dce perf: only visit the queried table's documents in _iterateDocs (#154)
• e6e17df 0.0.65
• ed7a5ce Support ctx.auth.signJwt in mutations (#173)
• ebcf1f7 0.0.64
• 265e5df Allow component pagination with one paginate call per query (#163)
• 5e0fc2a 0.0.63
• 9831bb9 docs: prepare changelog for 0.0.63 (#172)
• Additional commits viewable in compare view

Updates knip from 6.41.0 to 6.44.1

Release notes

Sourced from knip's releases.

Release 6.44.1

• Narrow the docs package Node.js engine range to Astro's requirement (60589c42a12b8f26c048318017700f56cbe9bbef)
• Follow resolve.alias in the Rsbuild plugin (#2251) (4dc61d2febaa15770f41d8a5af7d33f19de25fa3) - thanks @​fixfon!
• Read SWC plugins from tools.swc in the Rsbuild plugin (#2253) (ad2227a52970044d727e08a73b22e9ebea811dd1) - thanks @​fixfon!
• Read .release-it.mjs and other c12 extensions in the Release It plugin (#2258) (87816e6f311510c139e998b2b956aed612239b1d) - thanks @​SwastikTripathi!
• Read .mocharc.mjs in the Mocha plugin (#2259) (16fee14f4ec1bcd3244a1b4cb2ac15343a4e0999) - thanks @​SwastikTripathi!
• Restart the language server on config changes after a failed start (#2257) (f7db448226066f61ee6ee7e938cdc683bbbf433f) - thanks @​fixfon!
• Keep the command after boolean flags in the Bun resolver (resolve #2262) (3c84cafb68b2fa3d419b03a3a5e564d60aaeef30)
• Read babel.config.mts in the Babel plugin (#2267) (04abfd84887e57eeb5dd8e8a9044cd3aa405ad8c) - thanks @​clean99!
• Track import().then() callback member usage (#2264) (14565eb56ec16140d30708fa498c8b34f23c1f9f) - thanks @​gioboa!
• Reload the knip config file when the language server restarts (#2261) (fa9ca71a9a67f017e2cf209725f4ab7aa726c220) - thanks @​fixfon!
• Read all supported CSpell configuration locations (#2265) (c6c5b2cbf6a96abef70f6f30301fc67a0f56a6cd) - thanks @​clean99!
• Read SVGR configs from cosmiconfig search locations (#2266) (47082a803eb776166cf39399c1e4e06a737c91e7) - thanks @​clean99!
• Handle extends arrays in the npm-package-json-lint plugin (#2269) (83c8c80a50e0d77babc5422c059ef86c53a2e548) - thanks @​clean99!
• Read Relay configuration from package.json (#2270) (6ce8b0050006251148b3bbc42989bb430ed484ec) - thanks @​clean99!
• Read dependencies from SWC config arrays (#2271) (5ffe9276e8a54ba00035976ad8dfe394535b9f50) - thanks @​clean99!
• Recognize CJS and ESM data files in the Eleventy plugin (#2272) (d939417b0ea7660eae1a119d5e2ddd0aedeadca1) - thanks @​clean99!
• Unroll case iterations in the SolidJS Vite, Buf, Eve and Nx plugin tests (5f87aabe082b3dc0db5a77d7c37119caa9b31fb3)
• Hoist remark to the root for the VS Code remark extension (e7772700fb26260fc877e7d66b30005b1acdfef6)
• Format root Markdown and package READMEs with pnpm remark (58c7670cfb255c395b6dfec0b70b1f25a0860d47)
• Write readable tests (393b34864396372bd9b90ab50de96c0628ad5d91)
• Format Markdown with remark (10c0133f697bcaecb17833094749178fb5d5f594)
• Fix local links in Markdown (a3fd031d853f9ed55cd952a4211c75d43840c921)
• Treat cloudflare: specifiers as runtime built-ins (#2268) (e7f261e82b0a310141aea03956d52d218929c518) - thanks @​SwastikTripathi!

Release 6.44.0

• Clarify that custom entry still adds entry files from package.json (#2206) (4099ddeef28406ed8c9b798cf5ce525241818642) - thanks @​MannXo!
• Resolve expanded package scripts against the directory of their manifest (#2209) (9d8464dd7335b9898a17a0db59c3c33a7ae460f4) - thanks @​fixfon!
• Track exports through namespace member chains of any depth (#2210) (75697027e89e176c16e3d567cff3d6e016d0e9f0) - thanks @​fixfon!
• Do not treat Windows drive letters as package names (#2217) (d412c5be3a5c2d69583ce54b32e033813c1d2972) - thanks @​Cherry!
• Generate built-in compilers list from source (#2216) (d6f594cc767fa41c6f94cf49bfa0302be4b9de40) - thanks @​abrahamguo!
• Update to pnpm@^11 + pnpm dedupe (ef5b819eddbb0b4ff92804524aca590797a199fc)
• Stop growing and rewriting the analysis cache on warm runs (close #2213) (54b02dd84181867f41f98a6c80209dad32fa3da6)
• Use entry in plugins that do not resolve their config files (0b0e3285e3a440650b86a776b5e2a1fc1816bca8)
• Reuse graph reachability for incremental sessions (#2190) (38d926a652e820a375fe59d04ba0980393882153) - thanks @​jakeleventhal!
• fix: reload discovered configuration in watch sessions (#2211) (cefef30891c4428635e5cfc7b147faa42857247d) - thanks @​jakeleventhal!
• Keep editor sessions and views current (#2215) (cfe91abb5e6064230a71926f0d7565fce94486c0) - thanks @​jakeleventhal!
• Add Lingui plugin (#2212) (611e7dbe1c6675612e457324aae411bf4cda5b11) - thanks @​clean99!
• Update dependency bun to v1.4.4 (#2219) (3f35bbdf863057f69f237ab507053271019fc315) - thanks @​renovate[bot]!
• Read CSpell configuration from package.json (#2228) (86ab963cf3cd279a8b8af3a3f0098d24762c59cb) - thanks @​clean99!
• Ignore file discovery order in session configuration test (51a8d33dbe04e76da8f2e2ed24d8943d0e9e15fe)
• Fix strict mode for caught optional peer imports (#2218) (e535f40b8cacea80c830282544975f0be2191323) - thanks @​jay23606!
• Add kysely-codegen plugin (#2223) (a50e8423d28406bd20c213334d3aac4857c1cce0) - thanks @​clean99!
• Add PurgeCSS plugin (#2224) (668aea696a217d7c537791771be6044fc5ae375b) - thanks @​clean99!
• Document plugin args and path bases, issue key order and real-world fixes (8e48df60c4502c66d9daba87d5f436898ae60116)
• Add Mastra plugin (#2227) (dd4e1f72de127eb8328dd941fa4492034f29d69d) - thanks @​ashokram-si!
• Count findPackageJSON() bare specifiers as dependencies (#2235) (d4e387b31235d49fe755acb79553b385aa0de4c9) - thanks @​abrahamguo!
• Add universal hooks file to SvelteKit entries (#2237) (f286584f168d27255769bd9529b49a3518e4f788) - thanks @​APX403!
• Attribute extended tsconfig plugins correctly (#2230) (8d1d1d1e54204287b8321a0a5d50cbfa4562759e) - thanks @​gioboa!
• Resolve reporter in the Mocha plugin (#2232) (c413715a334be72094a02af0dbb37e36e878e262) - thanks @​X-Guardian!

... (truncated)

Commits

• da07b6e Release knip@6.44.1
• e7f261e Treat cloudflare: specifiers as runtime built-ins (#2268)
• 10c0133 Format Markdown with remark
• 5f87aab Unroll case iterations in the SolidJS Vite, Buf, Eve and Nx plugin tests
• d939417 Recognize CJS and ESM data files in the Eleventy plugin (#2272)
• 5ffe927 Read dependencies from SWC config arrays (#2271)
• 6ce8b00 Read Relay configuration from package.json (#2270)
• 83c8c80 Handle extends arrays in the npm-package-json-lint plugin (#2269)
• 47082a8 Read SVGR configs from cosmiconfig search locations (#2266)
• c6c5b2c Read all supported CSpell configuration locations (#2265)
• Additional commits viewable in compare view

Updates oxfmt from 0.72.0 to 0.76.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.76.0

💥 BREAKING CHANGES

• 296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

• 336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)
• 0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)
• 44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)
• 36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

• dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)
• fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)
• f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)
• fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)
• e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)
• 2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)
• f00862b formatter: Keep parens around a generic function type in a type assertion (#28173) (vidigoat)
• 9ead5c4 formatter: Handle this.b and super.b like foo.b (#28200) (leaysgur)
• 72a54cf formatter: Break parens of (a + b)[c] like (a + b).c (#28199) (leaysgur)
• b8f4f34 formatter: Print x.b and x.#b samely (#28193) (leaysgur)
• 9ddccb7 formatter: Keep parens for private field (#28188) (leaysgur)

⚡ Performance

• b6f1ac9 formatter_markdown: Bump parser to 0.0.4 and skip unread work (#28713) (leaysgur)
• 633ee96 formatter_css: Use u32 spans (#28708) (leaysgur)
• f680ee1 formatter_yaml: Use multiline flag for flow scalars (#28707) (leaysgur)
• ff7c203 formatter_css: Avoid repeated scans and allocations in values (#28706) (leaysgur)
• 7cd46cb formatter_htmlish: Search script end tags by < in embedded (#28704) (leaysgur)
• 46f8efd formatter_graphql: Print block string lines borrowed from the source (#28701) (leaysgur)
• dce1485 formatter_htmlish: Skip escaping attr values without the chosen quote (#28700) (leaysgur)
• e9392c8 formatter_core: Search line terminators with memchr (#28699) (leaysgur)
• ceb26be formatter_htmlish: Use char to escape attr quotes (#28697) (leaysgur)
• 8239dac parser: Replace dragonbox_ecma with zmij_ecma (#28282) (Boshen)

📚 Documentation

• 303d9e8 formatter: Strengthen start-token-no-double-parens rationale (#28711) (Yuji Sugiura)
• a82ce83 oxfmt: Update unclassified divergence (#28685) (Yuji Sugiura)
• 7f18c20 formatter_htmlish: Note class and srcset are formatted with embeddedLanguageFormatting: off (#28465) (Yuji Sugiura)
• 01ed68a oxfmt,formatter_htmlish,formatter: Clean up behavior comments (#28384) (Yuji Sugiura)
• a363c27 formatter_css,formatter_yaml: Point parser citations at AGENTS.md (#28466) (Yuji Sugiura)
• 6586050 formatter_core: Document tab width in text width policy (#28393) (leaysgur)
• 49fbffb formatter_core: Tighten FORMATTER_POLICY (#28206) (leaysgur)

oxfmt v0.75.0

... (truncated)

Commits

• f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• See full diff in compare view

Updates oxlint-tsgolint from 7.0.2004 to 7.0.2005

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2005

What's Changed

• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#1273
• chore(deps): update gomod by @​renovate[bot] in oxc-project/tsgolint#1274
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1275
• chore(deps): update oxc-project/security-action action to v1.0.9 by @​renovate[bot] in oxc-project/tsgolint#1276
• fix(unbound-method): respect this: void on class properties by @​baevm in oxc-project/tsgolint#1277
• docs(security): inherit organization security policy by @​Boshen in oxc-project/tsgolint#1295
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1301
• fix(no-deprecated): avoid infinite loop on circular alias chains by @​magurotuna in oxc-project/tsgolint#1309
• feat(await-thenable): add allowMixedPromiseArrays option by @​camc314 in oxc-project/tsgolint#1307
• chore: remove update-typescript-go.yml by @​camc314 in oxc-project/tsgolint#1311
• ci: pin just version in setup and autofix by @​camc314 in oxc-project/tsgolint#1312
• fix(no-unnecessary-type-parameters): count generic type arguments by @​farnoodma in oxc-project/tsgolint#1297
• feat(no-unsafe-enum-assignment): add rule by @​camc314 in oxc-project/tsgolint#1316
• fix(require-array-sort-compare): report tuples by @​baevm in oxc-project/tsgolint#1317

New Contributors

• @​magurotuna made their first contribution in oxc-project/tsgolint#1309
• @​farnoodma made their first contribution in oxc-project/tsgolint#1297

Full Changelog: oxc-project/tsgolint@v7.0.2004...v7.0.2005

Commits

• 4ebf80f fix(require-array-sort-compare): report tuples (#1317)
• 62e97c9 feat(no-unsafe-enum-assignment): add rule (#1316)
• e649c1e fix(no-unnecessary-type-parameters): count generic type arguments (#1297)
• e333787 ci: pin just version in setup and autofix (#1312)
• bcab203 chore: remove update-typescript-go.yml (#1311)
• bb8225c feat(await-thenable): add allowMixedPromiseArrays option (#1307)
• 086f19a fix(no-deprecated): avoid infinite loop on circular alias chains (#1309)
• a180371 chore(deps): update npm packages (#1301)
• 8897346 docs(security): inherit organization security policy (#1295)
• 69698fe fix(unbound-method): respect this: void on class properties (#1277)
• Additional commits viewable in compare view

Updates pkg-pr-new from 0.0.91 to 0.0.93

Commits

• 9dae3e0 release: v0.0.93
• abfb98a release: v0.0.92
• 5e3a62c feat: support upm and nub in --packageManager flag (#562)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions