[dependabot]

Removes minimatch. It's no longer used after updating ancestor dependency ultracite. These dependencies need to be updated together.

Removes minimatch

Updates ultracite from 7.10.2 to 7.12.4

Release notes

Sourced from ultracite's releases.

ultracite@7.12.4

Patch Changes

• 1cdaf87: Add opt-in ultracite/oxlint/gdp and ultracite/eslint/gdp presets for gdp-ts, which makes authorization checks visible to the type checker. Following upstream's strict mode, they stop proofs being forged with type assertions ({} as UserIsProjectAdmin<U, P>) or minted outside proofs/, ban other type assertions outside proofs/ and lib/ids.ts (except as const), and keep provers private to their trusted module. Upstream's no-any is left off because core already bans any. Inside proofs/, empty proof interfaces (interface X<P> extends Proof<"X", [P]> {}) are allowed, and the ESLint preset ignores _-prefixed proof arguments in no-unused-vars, as Oxlint does by default. @gdp-ts/core ships the plugin, so there is nothing extra to install: extend the preset after core.

ultracite@7.12.3

Patch Changes

• f753c14: Add opt-in TSDoc syntax validation and public TypeScript API documentation checks to the Oxlint js-plugins preset. Selecting a plugin with --js-plugins on a config that extends the full js-plugins preset now keeps the preset's plugins.

• ade34d3: Update @biomejs/biome to 2.5.15. The release adds 11 nursery rules and changes no stable rules, so the Biome presets, which exclude nursery rules, are unchanged. It speeds up HTML formatting and big-file analysis, fixes Astro expression indentation and Svelte comment placement, and reports configuration errors that Biome 2.5.14 silently ignored.

• 631e0dd: Update oxfmt to 0.71.0. The release changes no options; it bundles Prettier 3.9.9 for embedded languages and fixes comment placement around assignments, JSDoc alignment and several Markdown edge cases.

• 08e83af: Update oxlint to 1.86.0 and enable its new type-aware rule, typescript/no-generated-empty-object-type, in the core Oxlint preset. It reports type operations such as Pick<Data, never> that resolve to the empty object type {}, matching the @typescript-eslint rule of the same name that the ESLint preset already enables. Like the other type-aware rules, it only runs with oxlint --type-aware and oxlint-tsgolint installed. Older oxlint releases fail to parse a config that names the rule, so the oxlint peer range moves to ^1.86.0.

  Requires oxlint >= 1.86.0

• 2a9348c: Update the ESLint presets' plugins: eslint 10.12, eslint-plugin-unicorn 77, eslint-plugin-jsdoc 65, @typescript-eslint 8.71, eslint-plugin-sonarjs 4.2.2, eslint-plugin-react-doctor and oxlint-plugin-react-doctor 0.9.16, plus patch releases of the Next.js, TanStack Query, n, Solid and Storybook plugins.

  The ESLint core preset enables every non-deprecated JavaScript rule from unicorn, so it now also runs unicorn 77's 21 new JavaScript rules, including no-unnecessary-parameters, no-unsafe-json-serialization, prefer-promise-static-methods and a set of no-invalid-* checks for DOM, Intl, Response, Temporal and property descriptor arguments. It also enables the new type-aware @typescript-eslint/no-unsafe-enum-assignment. Unicorn 77 moves its CSS-only rules to eslint-cssicorn; the preset never enabled them for JavaScript files, so nothing is lost.

• 864cde1: Raise the eslint peer dependency to ^10.9.0. The ESLint core preset configures no-unmodified-loop-condition with checkConditionalExpressions, an option ESLint 10.0 to 10.8 reject, so every preset except Vue failed with Key "rules": Key "no-unmodified-loop-condition" on those releases even though the old ^10.0.0 range allowed them (eslint-plugin-unicorn also needs ESLint 10.4 or later). ultracite init and ultracite upgrade now install a release that loads the presets, and ultracite doctor and your package manager flag older ones. @eslint/js, which is no longer versioned with ESLint, keeps its own ^10.0.1 range.

  Requires eslint >= 10.9.0

• d7563b3: ultracite init now skips every prompt when you pass any of --pm, --editors, --agents, --hooks, --integrations, --frameworks or --workspace-framework, as documented. Before, the editor, agent, hook, skill and (with --frameworks) integration prompts still asked, which stalled scaffolding tools that call init without a TTY. --js-plugins with a linter other than Oxlint now stops init with an error instead of being silently ignored, and without --linter it skips the linter prompt.

• 6c7e149: ultracite init no longer hangs on a .pre-commit-config.yaml or lefthook config with CRLF line endings and many consecutive comment lines. The check that keeps the file's sequence indentation could backtrack exponentially on that input.

• 3dc6431: On Windows, a linter or formatter that isn't installed is now reported as missing instead of as "exited with code 1". ultracite check and ultracite fix warn and skip CSS linting when the optional Stylelint is missing, as they already did on macOS and Linux, and ultracite fix --agent now skips a missing Stylelint on every platform instead of failing.

• 7f085b2: Type jsPlugins as a non-null array on the Oxlint presets that always ship plugins (js-plugins, shadcn, anti-slop, next/js-plugins, tanstack/js-plugins) and on selectJsPlugins()'s return value, so spreading several of them into a root jsPlugins array typechecks.

• 45e7f86: The ESLint core preset enables unicorn/prefer-combined-guards's new checkMultiStatementBodies option, so consecutive guards whose bodies repeat the same statements before the same exit (for example, two if blocks that each log and continue) are reported and can be combined with ||. In TypeScript, the rule only combines bodies when type information shows every reference has the same type in both.

• d5523c5: ultracite init takes --workspace-framework <path>=<framework> for monorepos whose workspaces use different frameworks. For each workspace, it writes an Oxlint, Biome or ESLint config in that directory that extends the root config and adds the workspace's presets, so framework rules only run where they apply and editors see the same rules as ultracite check.

ultracite@7.12.2

Patch Changes

• 0f192a7: ultracite init no longer wipes an existing Biome config it can't read. Previously a biome.json or biome.jsonc with a syntax error, or a nested monorepo config with "extends": "//", was treated as empty and replaced with just the Ultracite extends, losing every other setting. Now:

  • A config with a syntax error is left unchanged, with a warning asking you to fix it and re-run init.
  • A nested config that extends the root config ("extends": "//") is left unchanged, since the Ultracite presets belong in the root config.
  • A string extends is turned into a list that also includes the Ultracite presets.
  • Updates edit the file in place, so comments and formatting in biome.jsonc are preserved.

  ultracite doctor and the check/fix resolution check now follow a nested config that extends "//" to the root config, instead of warning that the nested config doesn't extend ultracite/biome/core.

• c68ba48: ultracite check and ultracite fix handle their arguments and missing tools more reliably:

  • check now treats explicit files the way fix does. Oxlint only gets files it can lint, Prettier runs with --ignore-unknown, and oxfmt with --no-error-on-unmatched-pattern. Before, ultracite check README.md or ultracite check Dockerfile src/index.ts failed even though nothing was wrong.
  • Linter flags that take a value keep it, even when the value looks like a file: --tsconfig tsconfig.json, -c .oxlintrc.json, --config-path biome.json, --only lint/suspicious/noDebugger, --since origin/main and similar. Before, the value was treated as a lint target, so ultracite fix --tsconfig tsconfig.json skipped Oxlint entirely and only formatted tsconfig.json. Ultracite's own --claude, --codex, --hook and --unsafe never take a value, so the next argument is always a target.
  • ultracite fix --unsafe with the ESLint toolchain no longer fails with ESLint's "Invalid option '--unsafe'". ESLint has no unsafe fixes, so the flag is dropped with a warning.
  • A linter that isn't installed is reported with a plain message instead of a stack trace. The other tools still run first. Stylelint is optional in the ESLint toolchain, as ultracite doctor already said, so a project without it now skips CSS linting with a warning instead of failing. "No linter configuration found" is also printed without a stack trace.
  • Linters installed in the project's node_modules/.bin are found even when Ultracite isn't run through a package manager script, npx or bunx, for example ./node_modules/.bin/ultracite check.

• f61f393: ultracite init now looks for existing ESLint, Prettier and Stylelint configs in the same order the tools do, so when a project has more than one, init updates the one the tool actually loads. For example, Prettier reads .prettierrc.json before prettier.config.mjs, and ESLint reads eslint.config.js before eslint.config.mjs. Before, init could update a config the tool ignored and leave the active one in place. Stylelint's .stylelintrc.ts and stylelint.config.ts are now recognised too.

• 242cd2a: ultracite init now updates an existing .vscode/settings.json or .zed/settings.json in place, so your comments and formatting are kept. Before, the file was re-serialised as plain JSON, which stripped every comment. A settings file with a syntax error is now left unchanged with a warning. Before, it was rewritten with whatever part the parser could recover, which dropped the rest.

  For the ESLint toolchain, init now also installs the Prettier VS Code extension (esbenp.prettier-vscode), since the settings it writes make Prettier the default formatter. Before, only the ESLint extension was installed, so format-on-save did nothing until you added Prettier yourself.

• c273393: ultracite init now checks every flag value before it changes anything in the project. An unknown value for --linter, --pm, --frameworks, --editors, --agents, --hooks, --integrations or --js-plugins stops init with a message listing the valid values. Previously a misspelled --linter (for example --linter Biome) deleted every existing Biome, ESLint, Prettier, Stylelint, Oxlint and oxfmt config file and then crashed.

... (truncated)

Commits

• de9b415 Version Packages (#841)
• 1cdaf87 Add opt-in gdp presets for gdp-ts authorization proofs
• 4815654 Version Packages (#831)
• 3dc6431 fix: skip missing optional Stylelint on Windows (#840)
• d7563b3 refactor: decompose init workflow into focused phases (#839)
• 62cd83b Downgrade the workspace framework and TSDoc changesets to patch
• 45e7f86 Enable checkMultiStatementBodies on unicorn/prefer-combined-guards
• 864cde1 Raise the eslint peer range to the first release that loads the presets
• 66debf7 Update the transitive stylelint lock to 17.16.0
• 2a9348c Update the ESLint family
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.