chore(deps): Bump the minor-deps-updates-main group across 1 directory with 2 updates

[dependabot]

Bumps the minor-deps-updates-main group with 2 updates in the / directory: oxlint and undici.

Updates oxlint from 1.87.0 to 1.88.0

Release notes

Sourced from oxlint's releases.

oxlint v1.88.0

💥 BREAKING CHANGES

• 7730e14 ast: [BREAKING] Refactor comment attachment storage (#27512) (camc314)
• c904b61 ast: [BREAKING] Add comment attachment storage (#27393) (camc314)

🚀 Features

• bde9f69 oxlint/lsp: Show config errors to LSP client (#25486) (Sysix)
• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

🐛 Bug Fixes

• 82ecc43 linter/sort-keys: Compare natural order like ESLint (#27579) (Dunqing)
• 598ac03 linter/unicorn/prefer-bigint-literals: Unwrap redundant constructor call; don't auto-fix for lost precision (#25690) (Jacob Bandes-Storch)
• 2512213 linter: Prevent conflicting type import fixes (#27409) (camc314)
• 2349a31 oxfmt: Follow symlinked configs in discovery (#27389) (leaysgur)
• 6e573f9 oxlint,oxfmt: Set stderr blocking (#27363) (leaysgur)

⚡ Performance

• 91b588c linter/oxc/bad-array-method-on-arguments: Check arguments references once (#26930) (camc314)
• c5f47ed linter/plugins: Inline firstCommentAtOrAfter into call sites (#27539) (overlookmotel)
• c5f9235 linter/plugins: Use shift over multiply for powers of 2 (#27536) (overlookmotel)
• 8c57c5e linter: Share one source per file across type-aware diagnostics (#27462) (Max Schwenk)
• 19c227d minifier: Use ident when checking specific id names (#27208) (Armano)

📚 Documentation

• 98cc2b4 linter/plugins: Improve documentation for firstCommentAtOrAfter (#27538) (overlookmotel)
• 3bb54f6 linter: Update stale comment (#27519) (overlookmotel)
• 848a4e7 linter: Update fix metadata for tsgolint rules that already provide fixes (#27408) (Mikhail Baev)

Changelog

Sourced from oxlint's changelog.

[1.88.0] - 2026-10-13

🚀 Features

• 3c361a7 linter/unicorn/prefer-query-selector: Add allowWithVariables option (#27346) (Mikhail Baev)

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

... (truncated)

Commits

• 6941b4e release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (#27643)
• 3c361a7 feat(linter/unicorn/prefer-query-selector): add allowWithVariables option (...
• See full diff in compare view

Updates undici from 8.11.2 to 8.12.2

Release notes

Sourced from undici's releases.

v8.12.2

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

... (truncated)

Commits

• bb6cc0a Bumped v8.12.2 (#6021)
• b217373 fix(websocket): bound automatic PONG writes under backpressure
• 789ef26 fix(eventsource): bound retained SSE parser state
• 4f7ef68 fix(sri): accept non-lowercase algorithm tokens
• f851f31 fix(decompress): converge downstream handler throws to per-request errors
• b5084c7 fix(fetch): abort excessive content encoding responses
• 26c2bfb fix(cache): prevent cross-origin redirect cache confusion
• f75eac0 fix: preserve Agent connection options
• e257e9f fix: handle post-connect TLS certificate errors
• a65ec32 Bumped v8.12.1 (#6010)
• Additional commits viewable in compare view