build(deps-dev): bump the development group with 2 updates

[dependabot]

Bumps the development group with 2 updates: oxfmt and oxlint.

Updates oxfmt from 0.71.0 to 0.72.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
• dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)
• 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)
• fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)
• 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)
• 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)
• c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)
• c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)
• 36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)
• 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)
• e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)
• 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

• 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)
• cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)
• 0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

• 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)
• 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)
• 66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)
• af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Updates oxlint from 1.86.0 to 1.87.0

Release notes

Sourced from oxlint's releases.

oxlint v1.87.0

🚀 Features

• 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
• cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
• 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

• 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
• 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
• 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
• 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
• e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
• 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)
• ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument checks for used ignore patterns (#26925) (camc314)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs changes before merge.

What this changes

Updates the development formatter oxfmt to 0.72.0 and linter oxlint to 1.87.0, including their matching platform packages.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The dependency changes are focused and internally consistent, but unsuccessful checks limit validation confidence.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot-authored tooling update is outside the external-contributor proof gate; no authority or stored-data contract changes require additional proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes
Reason: Refreshing the existing development tools follows the repository's established maintenance pattern and brings upstream fixes without expanding the shipped runtime.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This PR contains a distinct, focused tooling update that current main has not adopted. Its failed checks need diagnosis, but the available evidence does not establish a concrete patch defect.

Priority: P3
Reviewed head: 2abc101fc0a9ffff75a0aa3baee5e9917cd7c412

Before merge

• Complete next step - Inspect the failed Check log to identify the cause and resolve any failure introduced by the dependency update.

Findings

None.

Tests

• Missing end-to-end proof: A successful exact-head repository check with the updated formatter and linter is not established; detailed failure logs could not be inspected.

Agent review details

How this fits together

The formatter and linter check repository files during development and CI. They are development dependencies rather than terminal protocol or runtime components.

flowchart TD
  A[Repository files] --> B[Development checks]
  C[Dependency versions and lockfile] --> B
  B --> D[Formatter]
  B --> E[Type-aware linter]
  D --> F[Check results]
  E --> F

Loading

Technical review

Best possible solution:

Retain the focused dependency update once the repository checks work with the new tools.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates development dependencies rather than reporting a runtime bug; recorded CI establishes a failed check but its detailed cause is unavailable.

Is this the best way to solve the issue?

Yes for scope: updating the existing dependency declarations and generated lockfile preserves the established tooling owner and avoids a parallel implementation. Successful validation remains unresolved.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fc0f56595507.

Provenance checked

• package.json and pnpm-lock.yaml formatter/linter versions keeps the original intent (build(deps): refresh terminal development tooling #93: Refresh eligible development tooling while preserving the Ghostty runtime, supported Node versions, pnpm alignment, and two-day cooldown.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Introduced dependency changes: The pinned introduction changes only the formatter requirement and formatter/linter lockfile resolutions; matching optional platform packages are updated consistently. (package.json:97, 2abc101fc0a9)
• Still necessary on current main: GitHub confirms main remains at fc0f565; its manifest and lockfile retain oxfmt 0.71.0 and oxlint 1.86.0. The same-repository search found no other item owning these exact updates. (package.json:97, fc0f56595507)
• Existing tooling intent: build(deps): refresh terminal development tooling #93 refreshed these tools while preserving the runtime dependency, Node support, pnpm version, and two-day release cooldown; this PR preserves those boundaries. (package.json:97, be919476ad42)
• Exact-head check failures: All seven Node matrix jobs fail in the Check step after successful dependency installation: https://github.com/openclaw/libterminal/actions/runs/37657617100. Annotations report only exit code 1. Downloading the detailed job log was blocked because its Azure storage host is outside the review network allowlist, leaving the failing subcommand and cause unknown. (.github/workflows/ci.yml, 2abc101fc0a9)
• Main comparison: The CI workflow succeeds on the exact main revision: https://github.com/openclaw/libterminal/actions/runs/37595784180. This establishes a differing result, but does not identify which introduced dependency change caused the PR failure. (.github/workflows/ci.yml, fc0f56595507)
• Formatter release compatibility: The official oxfmt 0.72.0 release announces a breaking Markdown formatter replacement. The target executes oxfmt over repository files through format:check, making these release notes relevant to the failed development check.

Likely related people:

• Peter Steinberger: Raw commit be91947 adds package.json:98 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: be919476ad42; files: package.json)
• Vincent Koc: Raw commit c8ff7e3 adds package.json:72 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c8ff7e3cc762; files: package.json)

Review metrics

Metric	Value	Why it matters
Dependency update scope	2 development tools; 2 files; production code +0, tests +0	The update adds no runtime implementation or test maintenance burden.

Labels

Label changes:

• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P3: This is routine development-tool maintenance without an established user-facing runtime failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

History

Review history (16 earlier review cycles; latest 8 shown)

• reviewed 2026-10-08T12:50:04.741Z sha 2abc101 :: needs changes before merge. :: none
• reviewed 2026-10-08T14:34:36.022Z sha 2abc101 :: needs changes before merge. :: none
• reviewed 2026-10-08T16:03:13.798Z sha 2abc101 :: needs changes before merge. :: none
• reviewed 2026-10-08T17:19:07.351Z sha 2abc101 :: needs changes before merge. :: none
• reviewed 2026-10-08T19:47:26.477Z sha 2abc101 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T11:46:57.976Z sha 2abc101 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T14:03:48.109Z sha 2abc101 :: needs maintainer review before merge. :: none
• reviewed 2026-10-09T17:27:03.160Z sha 2abc101 :: needs maintainer review before merge. :: none

Reviewed October 9, 2026, 5:47 PM ET / 21:47 UTC (Revision 17).

[steipete]

Incorporated into #103, now merged. The combined update includes oxfmt 0.72.0, oxlint 1.87.0, actions/setup-node 7.1.0, and the README import-order fix required by the new formatter. The exact PR head passed all cross-platform CI checks, and Dependabot credit is preserved. Thank you!

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml