[dependabot]

Bumps oxfmt from 0.68.0 to 0.74.0.

Release notes

Sourced from oxfmt's releases.

oxfmt v0.74.0

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)

... (truncated)

Commits

• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• a495e82 feat(oxfmt): support associations config to specify language over filepath ...
• 408d87f docs(oxfmt): simplify oxfmtrc docs (#27432)
• 5db28fa feat(oxfmt): support Astro via prettier-plugin-astro@1.x (#27386)
• 902e188 docs(oxfmt): update how embeddedLanguageFormatting option works (#27362)
• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• f158bff chore(deps): update npm packages (#26865)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.68.0 ⏵ 0.74.0	+1		+1	+2

View full report

[github-actions]

The repair workflow made a commit that changes code, so it did not push it. Review the full patch, then apply it in a checkout of the pull request branch. The command checks that the patch is the one listed here:

gh run download 40449733067 --repo fallow-rs/fallow-verdict --name dependabot-repair --dir /tmp/dependabot-repair
echo "3c07f9033d28f0e14bc963da4af55e7c3e8c98847c01a683f473353c74358450  /tmp/dependabot-repair/repair.patch" | sha256sum -c -
git am /tmp/dependabot-repair/repair.patch && git push

Changed files:

 docs/similar-code.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Patch:

From 4999bf7b11d9feaaa263785b12934d4fff849d59 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 27 Oct 2026 04:27:19 +0000
Subject: [PATCH] style(docs): reformat similar-code.md for oxfmt 0.74

fmt:check failed on docs/similar-code.md after the oxfmt bump; applied the new formatter output (one continuation line indent).
---
 docs/similar-code.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/similar-code.md b/docs/similar-code.md
index ee3992a..011318a 100644
--- a/docs/similar-code.md
+++ b/docs/similar-code.md
@@ -51,7 +51,7 @@ available for this kind.
    a shared verdict.
 4. `report` writes the Fallow verdict document to `verdicts.json` with one verdict for each
    candidate. Then it runs `fallow similar-code review --candidates <snapshot> --verdicts
-verdicts.json --require-verdict-for-each-candidate`. An error from Fallow stops the report
+   verdicts.json --require-verdict-for-each-candidate`. An error from Fallow stops the report
    with exit code 2. Use `--no-validate` to skip the join.
 
 A Fallow upgrade without a new scan keeps the old discovery snapshot. Until the next `scan`,
-- 
2.55.0

Summary from the repair run:

**Result:** committed
**Cause:** oxfmt 0.74 formats a wrapped list item continuation line in docs/similar-code.md differently.
**Change:** Reformatted docs/similar-code.md with oxfmt (one line indented).
**Check:** `npx oxfmt --check docs/similar-code.md` passes. The full `oxfmt --check` could not run locally because `.mcp.json` was unreadable in the sandbox, which is unrelated to this change.

Repair run

[dependabot]

Looks like oxfmt is up-to-date now, so this is no longer needed.