[dependabot]

Bumps oxlint from 1.83.0 to 1.88.0.

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

• bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

• 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
• 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
• 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

• 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
• c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
• c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
• 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
• 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

• 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
• 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
• 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

oxlint v1.87.0

🚀 Features

• 42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (#27292) (Mikhail Baev)
• cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion (#27245) (Mikhail Baev)
• 1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (#27181) (Mikhail Baev)

🐛 Bug Fixes

• 176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label attribute values (#27302) (sama Pyb)
• 7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish event handlers (#27306) (sama Pyb)
• 4e09837 linter/jsx-a11y/lang: Validate lang expression strings (#27304) (sama Pyb)
• 7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped BigInt literals (#27207) (breken)
• e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and large integers in fixer (#27206) (breken)
• 3d61a59 parser: Validate TypeScript type member separators (#27222) (camc314)
• f08236b linter/eslint/prefer-exponentiation-operator: Preserve autofix precedence (#27150) (camc314)
• 7d60ae3 linter/valid-title: Continue checks after allowed words (#27146) (Cameron)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
• e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
• 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxlint@​1.83.0 ⏵ 1.88.0	+1		+1	+1

View full report

[github-actions]

The repair workflow made no commit.

Repair run

[github-actions]

The repair workflow made a commit that changes code, so it did not push it. Review the full patch, then apply it in a checkout of the pull request branch. The command checks that the patch is the one listed here:

gh run download 39562993043 --repo fallow-rs/fallow-verdict --name dependabot-repair --dir /tmp/dependabot-repair
echo "be775deed71038d8c544d7bcced528ef3b855b6b196d53ce38cd4a668a42632f  /tmp/dependabot-repair/repair.patch" | sha256sum -c -
git am /tmp/dependabot-repair/repair.patch && git push

Changed files:

 src/state/store.ts               |  6 +++---
 test/check.test.ts               | 56 ++++++++++++++++++++++++++++----------------------------
 test/dismissal-agreement.test.ts | 28 ++++++++++++++--------------
 test/review.test.ts              | 35 ++++++++++++++++++-----------------
 test/similar-code.test.ts        | 35 +++++++++++++++++------------------
 5 files changed, 80 insertions(+), 80 deletions(-)

Patch:

From 066a66da2413d7e6c119a36ab3e1fb557e25d572 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 07:37:35 +0000
Subject: [PATCH] chore(deps-dev): hoist helpers flagged by oxlint
 consistent-function-scoping

oxlint 1.88 reports seven helper functions that capture nothing from their
enclosing scope. Moved them to module scope (renamed one test helper to
confirmedFor to avoid shadowing). No behavior change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 src/state/store.ts               |  6 ++--
 test/check.test.ts               | 56 ++++++++++++++++----------------
 test/dismissal-agreement.test.ts | 28 ++++++++--------
 test/review.test.ts              | 35 ++++++++++----------
 test/similar-code.test.ts        | 35 ++++++++++----------
 5 files changed, 80 insertions(+), 80 deletions(-)

diff --git a/src/state/store.ts b/src/state/store.ts
index 678cb8a..6fc9439 100644
--- a/src/state/store.ts
+++ b/src/state/store.ts
@@ -75,6 +75,9 @@ const readJson = async (file: string): Promise<Result<unknown, VerdictError>> =>
   }
 };
 
+const writeJson = (file: string, value: unknown): Promise<void> =>
+  writeAtomic(file, `${JSON.stringify(value, null, 2)}\n`);
+
 export const newRunId = (): string =>
   `${new Date().toISOString().replace(/[-:T]/g, "").slice(0, 14)}-${randomBytes(4).toString("hex")}`;
 
@@ -100,9 +103,6 @@ export const openStore = (root: string, kind: KindName): Store => {
   const ownerFile = path.join(lockDir, "owner.json");
   const recoveryDir = path.join(dataDir, ".lock-recovery");
 
-  const writeJson = (file: string, value: unknown): Promise<void> =>
-    writeAtomic(file, `${JSON.stringify(value, null, 2)}\n`);
-
   const lockIsStale = async (): Promise<boolean> => {
     try {
       const owner = JSON.parse(await readFile(ownerFile, "utf8")) as { pid?: number };
diff --git a/test/check.test.ts b/test/check.test.ts
index 79b4f26..c4b23f6 100644
--- a/test/check.test.ts
+++ b/test/check.test.ts
@@ -552,21 +552,21 @@ const ssrf = (
   });
 };
 
-describe("check never resolves a finding that can still exist", () => {
-  const ambiguousFor = async (before: SecurityFinding[], after: SecurityFinding[]) => {
-    const state = await scanned(before);
-    const target = before[0]?.finding_id ?? "";
-    const engine = engineFor(VULNERABLE);
-    const result = await checkWith(
-      withFreshScan(after),
-      state.loaded,
-      state.store,
-      options(state, target, engine),
-    );
-    expect(engine.engine.calls).toBe(0);
-    return result.ok ? result.data.report : null;
-  };
+const ambiguousFor = async (before: SecurityFinding[], after: SecurityFinding[]) => {
+  const state = await scanned(before);
+  const target = before[0]?.finding_id ?? "";
+  const engine = engineFor(VULNERABLE);
+  const result = await checkWith(
+    withFreshScan(after),
+    state.loaded,
+    state.store,
+    options(state, target, engine),
+  );
+  expect(engine.engine.calls).toBe(0);
+  return result.ok ? result.data.report : null;
+};
 
+describe("check never resolves a finding that can still exist", () => {
   it("needs a person after an extract-helper move to another file", async () => {
     // `const u = req.query.u; fetch(u)` in src/a.ts becomes a helper call into src/b.ts.
     const after = ssrf("src/b.ts", 3);
@@ -643,21 +643,21 @@ describe("check never resolves a finding that can still exist", () => {
   });
 });
 
-describe("check fatal engine errors", () => {
-  const twoFindings = (): SecurityFinding[] => [
-    makeFinding({ finding_id: OLD_ID }),
-    makeFinding({
-      finding_id: "security:tainted-sink:src/routes/user.ts:6:3",
-      line: 6,
-      col: 3,
-      evidence: "res.json receives a non-literal argument",
-      candidate: {
-        ...makeFinding().candidate,
-        sink: { ...makeFinding().candidate.sink, line: 6, col: 3, callee: "res.json" },
-      },
-    }),
-  ];
+const twoFindings = (): SecurityFinding[] => [
+  makeFinding({ finding_id: OLD_ID }),
+  makeFinding({
+    finding_id: "security:tainted-sink:src/routes/user.ts:6:3",
+    line: 6,
+    col: 3,
+    evidence: "res.json receives a non-literal argument",
+    candidate: {
+      ...makeFinding().candidate,
+      sink: { ...makeFinding().candidate.sink, line: 6, col: 3, callee: "res.json" },
+    },
+  }),
+];
 
+describe("check fatal engine errors", () => {
   it("stops after a rejected key and exits 2", async () => {
     const state = await scanned();
     let calls = 0;
diff --git a/test/dismissal-agreement.test.ts b/test/dismissal-agreement.test.ts
index bb27150..05d3f3d 100644
--- a/test/dismissal-agreement.test.ts
+++ b/test/dismissal-agreement.test.ts
@@ -244,21 +244,21 @@ describe("confirmed confidence", () => {
   });
 });
 
-describe("unconfirmed stored dismissals", () => {
-  const judgedWithoutConfirmation = async () => {
-    const context = await setup();
-    await judge(
-      makeLoaded(context.root, {
-        engine: { concurrency: 1 },
-        policy: { confirmDismissals: false },
-      }),
-      context.store,
-      mockEngine(() => SAFE_MITIGATED),
-      judgeOptions,
-    );
-    return context;
-  };
+const judgedWithoutConfirmation = async () => {
+  const context = await setup();
+  await judge(
+    makeLoaded(context.root, {
+      engine: { concurrency: 1 },
+      policy: { confirmDismissals: false },
+    }),
+    context.store,
+    mockEngine(() => SAFE_MITIGATED),
+    judgeOptions,
+  );
+  return context;
+};
 
+describe("unconfirmed stored dismissals", () => {
   it("asks again in judge for a dismissal that was never confirmed", async () => {
     const { loaded, store } = await judgedWithoutConfirmation();
     const engine = mockEngine(() => SAFE_MITIGATED);
diff --git a/test/review.test.ts b/test/review.test.ts
index 56230f4..3c5f532 100644
--- a/test/review.test.ts
+++ b/test/review.test.ts
@@ -408,24 +408,25 @@ const policyAnswers = (bug: number, rule: number): Record<string, Answer> => ({
   severity: { type: "score", score: 2, probabilities: [0, 0, 1, 0], confidence: 1 },
 });
 
+const built = async (): Promise<Awaited<ReturnType<typeof buildReviewPacket>>> => {
+  const root = await makeProject(PROJECT);
+  const [unit] = await identify(
+    root,
+    selectUnits(
+      [],
+      [
+        {
+          reason: "path",
+          functions: [fn({ path: "src/calc.ts", name: "add", line: 4, line_count: 4 })],
+        },
+      ],
+    ),
+  );
+  if (unit === undefined) throw new Error("Missing unit");
+  return buildReviewPacket(unit, root, 28_000);
+};
+
 describe("review policy", () => {
-  const built = async (): Promise<Awaited<ReturnType<typeof buildReviewPacket>>> => {
-    const root = await makeProject(PROJECT);
-    const [unit] = await identify(
-      root,
-      selectUnits(
-        [],
-        [
-          {
-            reason: "path",
-            functions: [fn({ path: "src/calc.ts", name: "add", line: 4, line_count: 4 })],
-          },
-        ],
-      ),
-    );
-    if (unit === undefined) throw new Error("Missing unit");
-    return buildReviewPacket(unit, root, 28_000);
-  };
   const config = makeLoaded("/", {
     review: { rules: [{ name: "no-fs", where: "src/**", ensure: "No file reads.", floor: 0.8 }] },
   }).config.review;
diff --git a/test/similar-code.test.ts b/test/similar-code.test.ts
index c4c16eb..a4b4a6a 100644
--- a/test/similar-code.test.ts
+++ b/test/similar-code.test.ts
@@ -1014,22 +1014,21 @@ const configured = (config: Record<string, unknown> = {}): LoadedConfig => ({
   configPath: null,
 });
 
+const confirmedFor = (kind: "security" | "review" | "similar-code", config = {}): string[] =>
+  kindFor(kind).use((adapter) => [...confirmedVerdicts(adapter, configured(config))].toSorted());
+
 describe("confirmed verdicts for each kind", () => {
   it("confirms similar-code dismissals and survivors, security dismissals, and nothing for review", () => {
-    const verdicts = (kind: "security" | "review" | "similar-code", config = {}): string[] =>
-      kindFor(kind).use((adapter) =>
-        [...confirmedVerdicts(adapter, configured(config))].toSorted(),
-      );
-    expect(verdicts("security")).toEqual(["dismissed"]);
-    expect(verdicts("review")).toEqual([]);
-    expect(verdicts("similar-code")).toEqual(["dismissed", "survivor"]);
-    expect(verdicts("similar-code", { policy: { confirmDismissals: false } })).toEqual([
+    expect(confirmedFor("security")).toEqual(["dismissed"]);
+    expect(confirmedFor("review")).toEqual([]);
+    expect(confirmedFor("similar-code")).toEqual(["dismissed", "survivor"]);
+    expect(confirmedFor("similar-code", { policy: { confirmDismissals: false } })).toEqual([
       "survivor",
     ]);
-    expect(verdicts("similar-code", { similarCode: { confirmSurvivors: false } })).toEqual([
+    expect(confirmedFor("similar-code", { similarCode: { confirmSurvivors: false } })).toEqual([
       "dismissed",
     ]);
-    expect(verdicts("review", { review: { confirmDismissals: true } })).toEqual(["dismissed"]);
+    expect(confirmedFor("review", { review: { confirmDismissals: true } })).toEqual(["dismissed"]);
   });
 });
 
@@ -1066,15 +1065,15 @@ describe("confirmation bound wording", INSPECT_TIMEOUT, () => {
   });
 });
 
-describe("shared review keys", INSPECT_TIMEOUT, () => {
-  const sharedDiscovery = async (): Promise<SimilarCodeOutput> => {
-    const parsed = parseSimilarCodeOutput(
-      await readJson(path.join(repo, "test/fixtures/similar-code/shared-key-discovery.json")),
-    );
-    if (!parsed.ok) throw new Error(parsed.error.message);
-    return parsed.data;
-  };
+const sharedDiscovery = async (): Promise<SimilarCodeOutput> => {
+  const parsed = parseSimilarCodeOutput(
+    await readJson(path.join(repo, "test/fixtures/similar-code/shared-key-discovery.json")),
+  );
+  if (!parsed.ok) throw new Error(parsed.error.message);
+  return parsed.data;
+};
 
+describe("shared review keys", INSPECT_TIMEOUT, () => {
   it("exports one verdict for each review key and passes the Fallow join with a note", async () => {
     const output = await sharedDiscovery();
     const shared = sharedReviewKeys(output);
-- 
2.55.0

Summary from the repair run:

**Result:** committed
**Cause:** oxlint 1.88 flags seven functions under unicorn/consistent-function-scoping because they capture nothing from their parent scope.
**Change:** Moved those helpers to module scope in src/state/store.ts and four test files, and renamed one test helper to avoid shadowing.
**Check:** `npx oxlint` reports no errors. I could not run the tests because dependencies were not installed in the sandbox.

Repair run