chore(deps): bump the dev-dependencies group with 18 updates

[dependabot]

Bumps the dev-dependencies group with 18 updates:

Package	From	To
@vitest/eslint-plugin	1.6.26	1.6.27
fallow	3.14.0	3.16.0
tsx	4.23.11	4.23.12
typescript-eslint	8.66.0	8.67.0
@angular/common	22.1.1	22.1.2
@angular/compiler	22.1.1	22.1.2
@angular/core	22.1.1	22.1.2
@angular/platform-browser	22.1.1	22.1.2
@angular/platform-browser-dynamic	22.1.1	22.1.2
esbuild	0.28.1	0.28.2
fastify	5.11.2	5.12.0
hono	4.13.1	4.13.2
@nestjs/common	11.1.28	11.2.1
@nestjs/core	11.1.28	11.2.1
svelte	5.56.8	5.56.9
swr	2.5.0	2.5.1
eslint-config-next	16.3.0	16.3.1
shiki	4.4.2	4.4.3

Updates @vitest/eslint-plugin from 1.6.26 to 1.6.27

Release notes

Sourced from @​vitest/eslint-plugin's releases.

v1.6.27

   🐞 Bug Fixes

• valid-title:
  • Refine the reportEmptyTitle message  -  by @​ysknsid25 in vitest-dev/eslint-plugin-vitest#941 (08973)
  • Handle missing argument in valid-title rule  -  by @​ysknsid25 in vitest-dev/eslint-plugin-vitest#942 (ef700)

    View changes on GitHub

Commits

• aad57d1 chore: release v1.6.27
• d1c0a34 docs(valid-title): fixed the description of the valid-title option (#940)
• ef70063 fix(valid-title): handle missing argument in valid-title rule (#942)
• 089732f fix(valid-title): Refine the reportEmptyTitle message (#941)
• See full diff in compare view

Updates fallow from 3.14.0 to 3.16.0

Release notes

Sourced from fallow's releases.

v3.16.0: honest template scoring, prunable audit cache, visible demotion

Health scoring gets more honest and more configurable in this release: template-family units drop the CRAP dimension they could never earn coverage for, Svelte {#snippet} blocks are scored as their own units, and thresholdOverrides finally reach file scores and refactoring targets. The audit cache becomes observable and prunable, new-only duplication demotion is no longer invisible, and a batch of correctness fixes lands across the type-aware sidecar, manual-mock detection, and the resolver.

Features

• fallow audit-cache prune: the audit cache garbage collector now explains what it does, and a new audit-cache prune subcommand removes stale entries on demand. --dry-run previews the policy without touching disk, --max-age-days overrides the age ceiling (flag, then FALLOW_AUDIT_CACHE_MAX_AGE_DAYS, then audit.cacheMaxAgeDays, then the 30-day default), and the JSON maintenance envelope reports per-entry dispositions with reclaimed_bytes counting only bytes actually removed from disk. Legacy git registrations that are only deregistered report under deregistered and are never counted as reclaimed. RUST_LOG=fallow=debug surfaces per-entry GC decisions during normal audit runs. (#2221)
• Observable duplication demotion: when --gate new-only demotes an introduced clone group to inherited, the decision is now visible. Demoted entries carry demotion_reason (currently no-added-lines), audit-family JSON always includes attribution.duplication_demoted, and --explain prints the demotion decision with the diff source it used. (#2220)
• Svelte {#snippet} blocks are their own complexity units: top-level snippets score as <snippet:NAME> units with nesting rebased to zero, so extracting markup into a snippet moves the score. Snippet units are exact-match keys for health.thresholdOverrides[].functions. (#2227)
• Broader declarative plugin manifests: typed manifest field paths with bounded [*] object-array traversal and exact exists predicates, strict JSON rules that reject JSONC input, and deterministic plugin-check limit diagnostics. Thanks @​M-Hassan-Raza. (#2165)

Health scoring changes

• Template-family units no longer participate in the CRAP dimension: a template carries no direct test coverage, so \<template> and <snippet:NAME> findings gate on the cyclomatic and cognitive dimensions only and never report crap, coverage_pct, or coverage_tier. A maxCrap override scoped to a template unit reports a matched row explaining the entry can be removed. (#2235)
• thresholdOverrides and maxCrap reach file scores and refactoring targets: file scoring and the add_test_coverage target rule now compare CRAP against the effective per-function ceiling instead of a fixed 30. Rows whose breaches were let through by configuration carry crap_exempted and crap_effective_threshold. (#2228)

Bug fixes

• Windows: --gate new-only no longer fails on pre-existing findings: the base-snapshot focus set is built from git rev-parse --show-toplevel, whose spelling can differ from the canonicalized project root (8.3 path components, drive-letter case), so no path mapped into the base worktree and the base dead-code results were filtered away entirely. Every inherited finding then looked introduced and failed the gate. Path matching now compares simplified and canonicalized forms, and a base run whose focus set cannot be expressed leaves its results unfiltered.
• jest/vitest __mocks__ parity: vitest root-level __mocks__ manual mocks for node modules are no longer reported as unused files, and literal X/__mocks__ imports and the /__mocks__ virtual package suffix now follow each framework's actual semantics. (#2225, #2226)
• Type-aware sidecar and root typescript stay in lockstep: the root lockfile pins the same typescript the sidecar needs, and a new preflight exits with a message naming the resolved version, its path, and the install command when the resolvable install is missing or too old, instead of a bare module-resolution error. (#2236)
• No wasted sidecar work when private-type-leaks is off: the type-aware layer only requests the api-surface capability when the check is active, pinned by an end-to-end config test in both directions. (#2218, #2219)
• MCP audit tool description matches the payload: the description now documents the nested complexity block that audit JSON actually carries. (#2217)
• Effective barrel exports resolve through one binding model: explicit-over-star precedence, ambiguous star origins vs convergent diamonds, separate type and value namespaces, and canonical binding identity now hold through usage propagation, public exports, duplicate analysis, trace provenance, caches, and the type-aware sidecar. Thanks @​M-Hassan-Raza. (#2210)
• Package tooling stays out of production reachability: build and tooling scripts no longer make devDependencies look like production dependencies. Thanks @​Jerc92. (#2211)
• Partial GitLab review posts now warn: inline-review jobs surface a warning when posting only partially succeeds instead of reporting clean success. Thanks @​Jerc92. (#2209)
• Scoped-package manual mocks: factory-less jest.mock/vi.mock of a scoped package no longer fabricates an unused-file candidate. (#2213)

Performance

A broad sweep across extraction, engine, and core: direct CSS color parsing (with recovery semantics, non-RGB color recovery, and !important ordering preserved), reused CSS class inventories, lazy styling-token candidates, cached built-in and default-entry plugin matchers, a lazy plugin matcher cache, cached production exclude globsets, compacted source discovery globs, skipped side-effect export indexes and irrelevant package scans, and single-pass Markdown escaping.

Full Changelog: fallow-rs/fallow@v3.15.0...v3.16.0

v3.15.0: near-miss clone detection, diagnosable threshold overrides, community bug fixes

Highlights

Near-miss clone detection and smarter duplicate triage

fallow dupes --near (config duplicates.near) now also detects function-scoped clones with small structural edits, reported with a similarity score. Every clone-group finding carries a new spread field, and --top ranking boosts clones scattered across distant files above local ones, so the duplicates worth consolidating first rise to the top. A new duplicates.ignoredClones list ("dup:<fingerprint>:<instance_count>") silences clone groups a reviewer has accepted; fingerprints hash the normalized token sequence, so formatting-only edits keep a reviewed clone recognized.

Threshold overrides are finally diagnosable (health schema 10)

A health.thresholdOverrides entry that did not silence a finding now tells you why: every override row carries a required dimension (complexity or crap), a new insufficient status marks an override that raises a ceiling the code still exceeds, and an optional outstanding[] lists the dimensions a matched unit still breaches. Overrides now also apply to synthetic \<template> findings in Svelte, Vue, and Astro single-file components, and those findings get a framework-correct suppression hint (<!-- fallow-ignore-next-line complexity --> on the line above the reported line) instead of Angular decorator advice. A follow-up pass made the override rows agree with their findings everywhere: the <component> rollup consults the override resolver, outstanding no longer swaps dimensions between same-named units, status is scored across ceilings, and CodeClimate plus GitHub annotations quote the effective threshold instead of the run-global one. Standalone health and combined output move to schema_version 10; audit output does not embed the health contract and stays at 9. Thanks @​lcestou for the report.

Bug fixes

• Type-aware analysis respects an explicit "private-type-leaks": "off". Enabling typeAware force-enabled the opt-in rule regardless of config, which also made the api-surface sidecar capability mandatory. The explicit setting now wins; unset configs keep the default-on behavior. Thanks @​thewirv.
• cacheMaxAgeDays and FALLOW_AUDIT_CACHE_MAX_AGE_DAYS actually reclaim audit caches now. The base-snapshot cache GC only visited entries under the current repo's hash prefix, so caches from linked worktrees accumulated forever. Abandoned entries from other repo identities now age out, live owners are skipped (a repo's own 0 cannot be defeated from outside), and invalid env values warn instead of silently falling back. Thanks @​EvanAgee.
• --gate new-only no longer fails clone-removal refactors. Extracting a shared helper and deleting duplicate instances shifted the clone group's attribution key and made the surviving duplication look introduced. Groups whose instances contain no added line are now demoted to inherited, while a genuinely pasted clone still fails the gate. Thanks @​devmax128.
• Framework template findings show which conditions caused them. A \<template> complexity finding in Vue, Angular, Svelte, or Astro now reports each decision point at its own line and column with the weight it added, so the VS Code inline breakdown and health --complexity-breakdown work in templates too. Thanks @​Ericlm.

... (truncated)

Commits

• 45fd287 chore: release v3.16.0
• aec0bd0 test(audit-cache): ignore lazy directory mtimes in the prune snapshot
• fb44ef4 fix(audit): keep base attribution when the focus remap fails
• 88507a5 test(audit): dump full base snapshot keys in the demotion assert
• defaf59 test(audit): dump base duplicate-export keys in the demotion assert
• 008e2b2 test(audit): surface verdict context in the reshaped-clone demotion assert
• 8cde8ee build(scripts): fail loudly when node resolution escapes the checkout (#2261)
• 400835b fix(audit-cache): stop counting deregistered legacy entries as reclaimed (#2260)
• 74f5a84 perf(core): cache default entry matchers
• 4a2c8cb docs(quality-gates): root npm ci suffices for type-aware test targets (#2259)
• Additional commits viewable in compare view

Updates tsx from 4.23.11 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• See full diff in compare view

Updates typescript-eslint from 8.66.0 to 8.67.0

Release notes

Sourced from typescript-eslint's releases.

v8.67.0

8.67.0 (2026-08-10)

🚀 Features

• typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.67.0 (2026-08-10)

🚀 Features

• typescript-eslint: export basic globs for using tseslint (#12105)

❤️ Thank You

• Claude Sonnet 5
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨
• Kirk Waiblinger @​kirkwaiblinger

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 20a261f chore(release): publish 8.67.0
• c245fbb feat(typescript-eslint): export basic globs for using tseslint (#12105)
• 3b155bb chore: use typescript 7 for typechecking (#12601)
• See full diff in compare view

Updates @angular/common from 22.1.1 to 22.1.2

Release notes

Sourced from @​angular/common's releases.

22.1.2

compiler

Commit	Description
	Generate correct expression for optional chaning.
	remove namespaced MathML script elements

compiler-cli

Commit	Description
	correctly resolve symbol for SafePropertyRead in chained optional navigation
	record class extends clause references in DeferredSymbolTracker

core

Commit	Description
	ensure i18n_util hasOwnProperty checks are safe for property renaming
	incorrect loop in defer blocks
	reject prefixed SVG script hosts

forms

Commit	Description
	keep radio inputs in sync when values change

http

Commit	Description
	always decode JSON responses as UTF-8

router

Commit	Description
	limit protocol-relative URL handling to serialization

Changelog

Sourced from @​angular/common's changelog.

22.1.2 (2026-08-13)

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

Commits

• 4f7e998 fix(http): always decode JSON responses as UTF-8
• See full diff in compare view

Updates @angular/compiler from 22.1.1 to 22.1.2

Release notes

Sourced from @​angular/compiler's releases.

22.1.2

compiler

Commit	Description
	Generate correct expression for optional chaning.
	remove namespaced MathML script elements

compiler-cli

Commit	Description
	correctly resolve symbol for SafePropertyRead in chained optional navigation
	record class extends clause references in DeferredSymbolTracker

core

Commit	Description
	ensure i18n_util hasOwnProperty checks are safe for property renaming
	incorrect loop in defer blocks
	reject prefixed SVG script hosts

forms

Commit	Description
	keep radio inputs in sync when values change

http

Commit	Description
	always decode JSON responses as UTF-8

router

Commit	Description
	limit protocol-relative URL handling to serialization

Changelog

Sourced from @​angular/compiler's changelog.

22.1.2 (2026-08-13)

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

Commits

• 6f9a64e fix(compiler): remove namespaced MathML script elements
• 76dff30 fix(compiler): Generate correct expression for optional chaning.
• See full diff in compare view

Updates @angular/core from 22.1.1 to 22.1.2

Release notes

Sourced from @​angular/core's releases.

22.1.2

compiler

Commit	Description
	Generate correct expression for optional chaning.
	remove namespaced MathML script elements

compiler-cli

Commit	Description
	correctly resolve symbol for SafePropertyRead in chained optional navigation
	record class extends clause references in DeferredSymbolTracker

core

Commit	Description
	ensure i18n_util hasOwnProperty checks are safe for property renaming
	incorrect loop in defer blocks
	reject prefixed SVG script hosts

forms

Commit	Description
	keep radio inputs in sync when values change

http

Commit	Description
	always decode JSON responses as UTF-8

router

Commit	Description
	limit protocol-relative URL handling to serialization

Changelog

Sourced from @​angular/core's changelog.

22.1.2 (2026-08-13)

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

Commits

• d22eb38 refactor(core): distinguish animations that share a name
• bb7f051 refactor(compiler): remove explicit strict: true
• 0df9d5e fix(core): ensure i18n_util hasOwnProperty checks are safe for property renaming
• 4d985a1 fix(core): incorrect loop in defer blocks
• 7b40456 fix(core): reject prefixed SVG script hosts
• 31bbf31 build: update cross-repo angular dependencies
• See full diff in compare view

Updates @angular/platform-browser from 22.1.1 to 22.1.2

Release notes

Sourced from @​angular/platform-browser's releases.

22.1.2

compiler

Commit	Description
	Generate correct expression for optional chaning.
	remove namespaced MathML script elements

compiler-cli

Commit	Description
	correctly resolve symbol for SafePropertyRead in chained optional navigation
	record class extends clause references in DeferredSymbolTracker

core

Commit	Description
	ensure i18n_util hasOwnProperty checks are safe for property renaming
	incorrect loop in defer blocks
	reject prefixed SVG script hosts

forms

Commit	Description
	keep radio inputs in sync when values change

http

Commit	Description
	always decode JSON responses as UTF-8

router

Commit	Description
	limit protocol-relative URL handling to serialization

Changelog

Sourced from @​angular/platform-browser's changelog.

22.1.2 (2026-08-13)

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

Commits

• f51080b refactor(platform-browser): modernize DOM renderer tests
• See full diff in compare view

Updates @angular/platform-browser-dynamic from 22.1.1 to 22.1.2

Release notes

Sourced from @​angular/platform-browser-dynamic's releases.

22.1.2

compiler

Commit	Description
	Generate correct expression for optional chaning.
	remove namespaced MathML script elements

compiler-cli

Commit	Description
	correctly resolve symbol for SafePropertyRead in chained optional navigation
	record class extends clause references in DeferredSymbolTracker

core

Commit	Description
	ensure i18n_util hasOwnProperty checks are safe for property renaming
	incorrect loop in defer blocks
	reject prefixed SVG script hosts

forms

Commit	Description
	keep radio inputs in sync when values change

http

Commit	Description
	always decode JSON responses as UTF-8

router

Commit	Description
	limit protocol-relative URL handling to serialization

Changelog

Sourced from @​angular/platform-browser-dynamic's changelog.

22.1.2 (2026-08-13)

compiler

Commit	Type	Description
76dff307b4	fix	Generate correct expression for optional chaning.
6f9a64e6f5	fix	remove namespaced MathML script elements

compiler-cli

Commit	Type	Description
e9660b1801	fix	correctly resolve symbol for SafePropertyRead in chained optional navigation
ec6deea513	fix	record class extends clause references in DeferredSymbolTracker

core

Commit	Type	Description
0df9d5eb65	fix	ensure i18n_util hasOwnProperty checks are safe for property renaming
4d985a179e	fix	incorrect loop in defer blocks
7b40456792	fix	reject prefixed SVG script hosts

forms

Commit	Type	Description
3b5c798072	fix	keep radio inputs in sync when values change

http

Commit	Type	Description
4f7e9987fa	fix	always decode JSON responses as UTF-8

router

Commit	Type	Description
2f82601662	fix	limit protocol-relative URL handling to serialization

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS...

  Description has been truncated