chore: Bump the dev-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@types/node	26.2.0	26.3.0
oxfmt	0.64.0	0.65.0
oxlint	1.79.0	1.80.0
ai	7.0.77	7.0.78
caniuse-lite	1.0.30001809	1.0.30001810
svgo	4.0.2	4.1.0
js-yaml	5.3.0	5.4.0

Updates @types/node from 26.2.0 to 26.3.0

Commits

• See full diff in compare view

Updates oxfmt from 0.64.0 to 0.65.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• See full diff in compare view

Updates oxlint from 1.79.0 to 1.80.0

Release notes

Sourced from oxlint's releases.

oxlint v1.80.0 & oxfmt v0.65.0

Table of Contents

• Oxlint v1.80.0
• Oxfmt v0.65.0

Oxlint v1.80.0

🚀 Features

• 70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (#26012) (Mikhail Baev)

🐛 Bug Fixes

• 17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (#26044) (camc314)
• 8a353a7 linter/eslint/no-control-regex: Refine help message text (#25996) (Rahul Mishra)
• 8a9bdbd estree: Include decorators in FormalParameterRest spans (#26021) (camc314)
• 8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (#26020) (Cameron)
• 2cde1f6 rust: Address nightly deprecations (#25998) (Boshen)
• 51d36d7 linter/vue: Resolve vue imports via shared import helpers (#25903) (Connor Shea)
• 83a68d2 linter/react/no-react-children: Resolve react imports by symbol (#25901) (Connor Shea)
• 124e196 linter: Resolve globals by reference, not by name (#25905) (Connor Shea)
• a701bcc linter: Remove invalid React compiler doc links (#25900) (Boshen)

📚 Documentation

• 9b7e153 linter: Set version to 1.79.0 for rules shipped in 1.79.0 (#25902) (connorshea)

Oxfmt v0.65.0

🐛 Bug Fixes

• bf37dd5 formatter: Preserve class decorators before export when the statement is suppressed (#26034) (leaysgur)

Changelog

Sourced from oxlint's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Commits

• 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
• See full diff in compare view

Updates ai from 7.0.77 to 7.0.78

Changelog

Sourced from ai's changelog.

7.0.78

Patch Changes

• 96970bb: Continue approved generateText, streamText, and WorkflowAgent turns with a model-visible tool error when revalidated tool input is invalid.
• Updated dependencies [e12e068]
  • @​ai-sdk/gateway@​4.0.63

Commits

• 5b64c39 Version Packages (#19341)
• 96970bb fix: invalid approved tool input terminates resumed tool-approval turns (#19280)
• See full diff in compare view

Updates caniuse-lite from 1.0.30001809 to 1.0.30001810

Commits

• b86caab Update caniuse-db 1.0.30001810
• See full diff in compare view

Updates svgo from 4.0.2 to 4.1.0

Release notes

Sourced from svgo's releases.

v4.1.0

This minor release upgrades the SAX parser and introduces stricter XML validation. It also includes important security hardening for removeScripts, dependency updates, and improvements to the test and regression infrastructure.

Support SVGO

If SVGO is valuable to you or your organization, please consider supporting the project on OpenCollective. Your sponsorship helps fund ongoing maintenance and security work.

Stricter XML validation

SVGO now uses sax 1.6.1, upgraded from 1.5.0 (#2257).

The new parser version validates numeric character references against the ranges permitted by XML. Invalid references are now rejected in both text and attributes, including:

• disallowed control characters such as &[#1](https://github.com/svg/svgo/issues/1);, , and ;
• UTF-16 surrogate code points such as �;
• invalid XML code points such as .

Valid boundary values—including U+0020, U+D7FF, U+E000, U+FFFD, and characters through U+10FFFF—remain supported.

Parser failures are consistently exposed as SvgoParserError errors with an Invalid character entity reason.

This is an intentional behavior change: malformed SVGs that were previously accepted may now produce a parser error, while valid XML documents are unaffected.

Security

The removeScripts plugin has been hardened against several script-execution bypasses:

• Filters executable data: URLs containing HTML, XHTML, or SVG documents while preserving inert data such as PNG images, and filters legacy vbscript: URLs (#2263).
• Sanitizes content inside SVG <foreignObject> elements by removing HTML event-handler attributes, srcdoc, and executable URLs from action, data, formaction, href, and src, while preserving non-executable HTML and visual content (#2264).
• Recognizes namespace-prefixed SVG <a> elements and removes ASCII tabs and newlines before checking URL schemes, preventing values such as java&[#9](https://github.com/svg/svgo/issues/9);script: from bypassing detection while preserving elements in unrelated custom namespaces (#2268).

These changes address:

• GHSA-4vpr-x523-8j87
• GHSA-w27v-7q3p-w38r

Dependencies

• Upgraded css-select to v6 and css-what to v7, and updated SVGO's custom selector adapter for css-select v6 (#2244).

Project maintenance

@​TrySound is back as an active SVGO maintainer.

Many thanks to @​KTibow, @​SethFalco, and @​XhmikosR for maintaining and improving SVGO over the past several years.

Full Changelog: svg/svgo@v4.0.2...v4.1.0

Commits

• 5765cbe chore: prepare v4.1.0 release (#2275)
• 3db3ef3 fix(removeScripts): handle anchor URL bypasses (#2268)
• 4e9b9ae chore: cache regression screenshots (#2267)
• d55270c chore(regression): migrate comparison workers to Tinypool (#2266)
• fd51e47 fix(removeScripts): sanitize foreignObject content (#2264)
• dcaf957 chore: optimize fixtures in a bounded worker pool (#2265)
• a354293 fix(removeScripts): filter executable data URLs (#2263)
• 4e0d2ac ci(typecheck): return typechecking on CI
• 0b97fed test(typescript): drop tsd for vitest type testing API
• f6e8ae1 chore(pnpm): drop package.json#pnpm.onlyBuiltDependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for svgo since your current version.

Updates js-yaml from 5.3.0 to 5.4.0

Changelog

Sourced from js-yaml's changelog.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

Commits

• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• a5fdb31 Add automatic double quoting for whitespace-only strings, close #534
• 25dcf77 Fix keep-chomped scalar test expectations
• 9f50a42 Fix open-ended tracking for document end markers
• 31aad6d Fix simple key length limit for astral characters
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions