[CallumHoward]

Combines the pending Dependabot bumps into one lockfile regeneration. Supersedes #77, #76, #73, #72, #71, #70, #68, #66, #64; Dependabot will auto-close each once this lands on main. #65 (Babel 8) is left open, to be closed by the upcoming Babel → oxc React Compiler migration.

Commits

• ab90336 stylelint: exempt Tailwind at-rules from at-rule-prelude-no-invalid. @csstools/css-syntax-patches-for-csstree 1.1.14 (transitive via stylelint) adds the CSS Mixins draft @apply grammar, which rejects Tailwind's @apply. Reuses the existing Tailwind at-rule list. Ordered first so every commit passes on its own.
• 575336e deps: bump everything. Floors are raised past Dependabot's targets to the newest versions clearing the 7-day minimumReleaseAge (e.g. oxlint 1.83 vs 1.73, Playwright 1.63 vs 1.61). oxlint-tsgolint goes 0.23 → 7.0.2002 because oxlint ≥1.75 requires ≥7.0.2001; 7.0.2000 is a renumber to track TypeScript 7, not a breaking change.
• e353ee3 dependabot: add vitest and catch-all dev-minor-patch groups. Dependabot assigns a package to the first group it matches (docs), so the catch-all only takes the leftovers. Validated against the SchemaStore dependabot-2.0 schema.
• a8162e7 → a66ff24 oxlint: oxlint 1.79 moved its native React Compiler rules into correctness, which duplicated every react-hooks-js/* report. These commits switch to the native react/* rules (same severities) and keep eslint-plugin-react-hooks only for the rules oxlint hasn't ported: component-hook-factories, memoized-effect-dependencies, config, gating. I ran probe files against each native rule: they fire once each, and none of the probes lost coverage compared with the JS plugin. react/rules-of-hooks and react/hooks both stay on even though they overlap. Only the former flags hooks in non-component functions, and only the latter flags first-class hook usage.

Heads-up: nitro

nitro is set to latest and ignored by Dependabot, so the install moved it from 3.0.260610-beta to 3.0.260903-beta without a Dependabot PR. That brings a new route-rules engine (GET answers HEAD, basicAuth rules → middleware) and ocache 0.3 defaults (swr: false, query/cookies ignored). None of these features are used here; only the nitro() Vite plugin is.

Notable upstream changes

• oxlint 1.69 → 1.83: native React Compiler rules (1.70, moved to correctness in 1.79; adopted above). Also newly default-on: oxc/bad-match-all-arg. Stricter rules-of-hooks (hooks in try), no-unused-vars (bare _), and no-irregular-whitespace (comments).
• oxfmt 0.54 → 0.58: CSS/SCSS/Less and CSS-in-JS now go through the native formatter instead of the Prettier fallback (0.57), matching Prettier 3.9.1 (0.58). format:check is clean.
• oxlint-tsgolint 0.23 → 7.0.2002: type-aware linting is declared stable. Changes are false-positive fixes only.
• eslint-plugin-playwright 2.10 → 2.12: new opt-in rules only; we don't extend recommended.
• @playwright/test 1.60 → 1.63: additive (test locks, page.localStorage, AbortSignal). Drops Debian 11 / Ubuntu 20.04.
• fallow 2.89 → 2.104: dupes now ignores imports and test/mock files by default. Impact history moves to the user config dir.
• @vitejs/plugin-react 6.0 → 6.1: new experimental native compiler option. The Babel preset path is unaffected.
• @tanstack/devtools-vite 0.7 → 0.8 / react-devtools 0.10.12: server events from the Nitro worker reach devtools; UI reworked, and the trigger defaults to floating.
• @tanstack/router / start / router-plugin: lane-based match loading. Link isTransitioning/data-transitioning removed; error-boundary error typed unknown; server-side navigate is a no-op. None of these are used here.
• stylelint 17.13 → 17.15: new opt-in selector-no-unmatchable; stricter selector-no-invalid. The csstree @apply change is handled above.
• vitest / coverage-v8 4.1.11, eslint-plugin-react-you-might-not-need-an-effect 1.0.2: no behavioral changes.

Verification

• format:check, lint (type-aware; a floating-promise probe confirmed tsgolint fires), lint:css, check, test, fallow, build, test:e2e: all pass locally.
• pnpm install --frozen-lockfile and pnpm peers check are clean. The lockfile diff (~2k lines) is version churn across platform bindings, with no format drift.

Interaction with #69

Both PRs touch pnpm-lock.yaml and dependabot.yml (different hunks). Whichever merges second needs a rebase and pnpm install, and should re-check that blockExoticSubdeps accepts the new tree.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

What changed in this PR

Consolidates pending dependency upgrades and updates linting and Dependabot configuration.

Changes:

• Regenerates dependency versions and lockfile.
• Adds Tailwind at-rule exemptions for Stylelint.
• Prevents duplicate Oxlint React Compiler diagnostics.
• Adds Vitest and development dependency groups.

File	Summary
stylelint.config.ts	Exempts Tailwind at-rules from validation.
package.json	Updates dependency versions.
oxlint.config.ts	Disables duplicate native React rules.
.github/​dependabot.yml	Expands dependency grouping.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.