chore(deps-dev): bump the tooling-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the tooling-minor-patch group with 6 updates in the / directory:

Package	From	To
prettier	3.9.6	3.9.9
tsx	4.23.13	4.23.15
eslint-plugin-prettier	5.5.5	5.5.6
dependency-cruiser	18.3.1	18.4.0
jscpd	5.2.1	5.3.3
knip	6.35.1	6.38.0

Updates prettier from 3.9.6 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
</tr></table> 

... (truncated)

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Updates eslint-plugin-prettier from 5.5.5 to 5.5.6

Release notes

Sourced from eslint-plugin-prettier's releases.

v5.5.6

Patch Changes

• #791 b5c96a3 Thanks @​JounQin! - chore: bump all (dev)Dependencies

Changelog

Sourced from eslint-plugin-prettier's changelog.

5.5.6

Patch Changes

• #791 b5c96a3 Thanks @​JounQin! - chore: bump all (dev)Dependencies

Commits

• 4f33ea5 chore: release eslint-plugin-prettier (#792)
• 4745b54 ci: declare workflow-level contents: read on 2 workflows (#790)
• b5c96a3 chore: bump all (dev)Dependencies (#791)
• e867680 chore(deps): update all dependencies (#766)
• e8e2f7f chore: testing eslint v10 (#779)
• ca076d9 chore: update dev dependencies (#780)
• 42e6369 build(deps): Bump the actions group with 2 updates (#778)
• 53ff214 Remove empty NPM_TOKEN from release.yml
• See full diff in compare view

Updates dependency-cruiser from 18.3.1 to 18.4.0

Release notes

Sourced from dependency-cruiser's releases.

v18.4.0

✨ features

To improve visibility of the state of the baseline (.dependency-cruiser-known-violations.json)...

• ...the err, err-html and markdown reporters now show the number of stale entries in the baseline. (c617e580/ e9ad4ce6/ be91a27c/ 993ac9df)
• ... the err, null, azure-devops and teamcity reporters can exit with a non-zero exit code when the baseline contains stale entries (set baseline.staleEntriesSeverity to error to enable).
  (#1100 / 0dbd7610)
• ... the new baseline-mode 'format' sorts the baseline so future diffs are easier to read after manual edits. (077d4431/ 3e465ea1)

Thanks to @​yunusdim and @​BPScott for the raising the issues and providing the suggestions and feedback that birthed these 🙇.

📖 documentation

• e41450b9 doc(cli): adds note to --baseline that severities are ignored on comparison

👷 maintenance

• 9f402bbb/ ab42c712 chore(npm): updates all external devDependencies
• c9d8fb5d chore(npm): adds upem policy to prevent accidents when @​types/node publishes a super-old version as 'latest'

Commits

• 7c22858 18.4.0
• 9f402bb chore(npm): updates all external devDependencies
• 993ac9d feat(report/markdown): adds baseline stale count (#1101)
• c9d8fb5 chore(npm): adds upem policy to prevent accidents when @​types/node publishes ...
• 0dbd761 feat: adds option to make stale entries in the baseline a non-zero-exit-code ...
• be91a27 feat(report/err-html): adds baseline stale count and table (#1099)
• e9ad4ce feat(report/err): adds stale baseline count (#1098)
• c617e58 feat(analyze): adds baseline stats to the summary (#1097)
• 3e465ea feat(baseline): renames baseline-mode 'view' to 'format' & sorts the baseline...
• 077d443 feat(baseline): adds dry-run ('view') mode (#1096)
• Additional commits viewable in compare view

Updates jscpd from 5.2.1 to 5.3.3

Release notes

Sourced from jscpd's releases.

Release v5.3.3

New Features

• Semantic clones, experimental: --semantic. The token passes match runs of tokens, so they miss two functions that do the same job with different code. Such a function may be renamed and restructured, or written in another language, like a validation rule that a Rust backend enforces and a Svelte frontend repeats (Type-4 clones). --semantic (config key semantic) embeds every function with a code embedding model and reports the pairs whose vectors point the same way as clones of kind semantic.
  • jscpd embeds the functions of JavaScript, TypeScript, JSX, TSX, Vue, Svelte, Astro, Python, Rust, Go, Java, Kotlin, C#, C, C++, PHP, Ruby, Scala and Swift files that clear --min-tokens and --min-lines. It embeds each function's code without comments, starting at the name the function is declared under.
  • Two functions pair only if they are in different files, neither calls the other, and the clones already found do not cover both. Each must be the other's closest match among the functions of its language; a function that is only close to the best match needs a higher similarity. The cosine must reach --semantic-threshold for a pair across languages, or --semantic-same-threshold for a pair within one language (0.4125 and 0.6375 with the default model), and it must stand at least 3 standard deviations above each function's background. --semantic-scope same keeps the pairs within one language, and --semantic-scope cross keeps the pairs across languages.
  • The default model, CodeRankEmbed (MIT), runs inside jscpd on the CPU once jscpd --semantic-download has fetched it (548 MB, pinned by revision and SHA-256), and a scan makes no network call. In a comparison of nine open models, it found more known clones than jina-embeddings-v2-base-code at the same precision, and reviewers judged more of its pairs to be duplicates. jscpd also runs jina-embeddings-v2-base-code, which is faster: jscpd --semantic-download jina-embeddings-v2-base-code fetches it (324 MB), and --semantic-model jina-embeddings-v2-base-code scans with it.
  • --semantic-url sends the functions to an OpenAI-compatible embeddings API instead, such as Ollama, llama.cpp, text-embeddings-inference or a hosted API. jscpd reads the API key only from JSCPD_SEMANTIC_API_KEY, and sends it only to a URL given on the command line or to a server on this machine. A config file can neither hold a key nor send code to another host on its own.
  • jscpd caches the vectors, so a repeat run embeds only the functions whose code changed. Each set of scanned paths has its own cache file. Once the vectors of changed and deleted functions make up more than a quarter of that file, the next run that embeds something rewrites it without them. --semantic-rebuild-cache embeds everything again and replaces the file at once.
  • Each model scores similarity on its own scale, so each model gets its own thresholds. jscpd --semantic-models lists the nine models jscpd has calibrated, with their thresholds, licenses and where they run. --semantic-model takes any of them by the name in that list (CodeRankEmbed), by Hugging Face id or by Ollama name, and the thresholds follow the model. The rule for groups of copies has two more settings, tuned with jina-embeddings-v2-base-code: a near-best margin of 0.05 and a floor of 0.8. jscpd scales both for every other model by the model's gap between its two thresholds, which gives 0.075 and 0.7125 for CodeRankEmbed. Qwen3-Embedding-0.6B and jina-code-embeddings-0.5b expect an instruction before the text, and jscpd puts the one they were calibrated with before every function; the config key prefix replaces it. A model that jscpd has not calibrated gets 0.6 and 0.75, and the run warns about it.
  • The console prints Clone found (rust, semantic ~0.78), -r ai prints [~0.78 semantic], JSON carries "kind": "semantic" and similarity, and SARIF uses the rule jscpd/semantic-code. --kind semantic keeps only these clones. The code lives in a new crate, cpd-semantic, and a run without --semantic works as before.
  • fixtures/semantic-demo is a runnable example: a Rust API and a SvelteKit frontend with 8 rules written on both sides and 2 features written twice in one language. (#1101, #1103, #1105, #1108, #1110)

Bug Fixes

• A scan path inside another scanned its files twice. With jscpd . src, or a config file that lists src next to src/generated, jscpd walked every file under the inner path once for each path and reported each of those files as a clone of itself. --semantic embedded their functions twice and paired each one with itself. Version 4 read those files once, and so does jscpd now, as it already did with --follow-symlinks. See fixtures/nested-paths-demo. (#1106)

• Svelte components lost two kinds of use to --dead-code. Svelte reads a store as $name, in the script and in the markup, and that is often the only use that import { page } from '$app/stores' gets, so --dead-code reported the import as unused with 100% confidence. It also reported a name as an unused symbol when the markup read it only inside the ${…} of a template literal, as in href={(p) => `/?${base}&page=${p}`}, because the markup scan skipped template literals the way it skips plain strings. $name now counts as a read of name (runes such as $state and $props, and $$props, do not), and jscpd reads the placeholders of a template literal as code in every component format. On two SvelteKit apps, sshx and the RealWorld example, the six and three findings of basta 0.3.0 were all of these two kinds, and neither app has a finding now. See fixtures/dead-code-demo. (#1102)

• Positions in files with Windows line endings drifted. The generic tokenizer, which reads Python, Go, Java, C# and most other formats, moved one byte forward per line where a CRLF line ends in two bytes, so every position was short by the number of lines above it. The position values in the JSON report were off, and an --ignore-pattern match removed tokens a byte behind per line, which changed the token counts of the clones around it. Files with CRLF endings now report true byte offsets, and where a pattern applies, their clones can count different tokens than before. Files with LF endings are unaffected. See fixtures/crlf-demo. (#1101)

Dependencies

• paste is gone from the build. The crate is unmaintained (RUSTSEC-2024-0436), and candle's matrix kernels, pulp and tokenizers still depend on it. The workspace now patches it with a small local crate that hands its one macro to pastey, its maintained successor, so cargo audit and cargo deny pass without an ignore for the advisory. The patch goes away once those crates release their switch to pastey. sha2 moved to 0.11, and every other dependency to its latest compatible release. (#1107, #1109)
• oxc moved to 0.151 and ruff to 0.0.15, each as one family of crates (#1098), and clap to 4.6.7 (#1097).

Deprecations

• --min-duplicated-lines never did anything, and now says so. Since the first 5.x release, the docs described it as a minimum percentage of duplication to report, but no code ever read it: a scan with --min-duplicated-lines 100 found the same clones as one without it. jscpd now hides the flag from --help and prints a warning when it is passed, and a later release will remove it. The flag is still accepted, so a script that passes it keeps working. To fail a run on too much duplication, use --threshold; to set the smallest clone worth reporting, use --min-lines or --min-tokens. (#1100)

Published Packages

• basta@0.3.0 on crates.io
• cpd-core@0.1.19 on crates.io
• cpd-finder@0.1.19 on crates.io
• cpd-reporter@0.1.20 on crates.io
• cpd-tokenizer@0.1.18 on crates.io
• cpd@5.3.3 on npm
• jscpd@5.3.3 on npm
• jscpd-darwin-arm64@5.3.3 on npm
• jscpd-darwin-x64@5.3.3 on npm
• jscpd-linux-x64-gnu@5.3.3 on npm
• jscpd-linux-arm64-gnu@5.3.3 on npm
• jscpd-linux-x64-musl@5.3.3 on npm
• jscpd-linux-arm64-musl@5.3.3 on npm
• jscpd-windows-x64-msvc@5.3.3 on npm
• jscpd-windows-arm64-msvc@5.3.3 on npm
• jscpd==5.3.3 on PyPI

... (truncated)

Commits

• b018556 release: cpd-v5.3.3
• beb5528 release: cpd-v5.3.2
• e90cf5e release: cpd-v5.3.1
• 9257686 release: cpd-v5.3.0
• See full diff in compare view

Updates knip from 6.35.1 to 6.38.0

Release notes

Sourced from knip's releases.

Release 6.38.0

• Include co-authors in docs contributor list (0c334100df59d89a512ad598ec50e7f62f6da0c3)
• Filter bots and agents from docs contributors (617f70d8179c6b8668ca41fe5df77ced5e2b37c0)
• Update Eve plugin conventions (#2049) (260dbb91a85f3a3bc2727e8f255d73df3737552c) - thanks @​matchai!
• Add args example to that doc page (50b271b98fc930a05a3b045a2f691486f9f06528)
• Add Turborepo plugin (#2055) (e49d3db05f1d69ce7db3efcb8467a4af63c27379) - thanks @​changbaebang!
• Support import-x/* settings in ESLint plugin (#2050) (1a34cf82a3d6a1202717ef910bedba55838e9dd9) - thanks @​bytedoe!
• Resolve file option in Mocha configuration files (#2051) (9b5c5f60468c8a92a3e74adca5c0931f008677af) - thanks @​giaBaoJS!
• Support oxlint extends (#2054) (a149a98219bb14b15f446fc5f8c4f815e28b2183) - thanks @​matthewnitschke-wk!
• Fix import.meta handling in built-in compilers (#2059) (8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded) - thanks @​vdavid!
• Fix tag hints for enum and namespace members (#2061) (8a8805e48945863248429d18b7f6c4e4b7dc9ebd) - thanks @​devYRPauli!
• Flag unused member tags in tagged enums and namespaces (584e53ff3e0846fbfe04fa5b5bfefe2420576a34)
• feat: resolve MDX content mapper remarkPlugins (#2060) (34dbccf25359f9e9fefe9d0be6ef2ec0252223cc) - thanks @​gioboa!
• Refactor and separate concerns w/ new typescript-content-mapper plugin (11e94509bd0f350d747facf4003fc5b248d1b02d)
• Resolve mdx content mapper providerImportSource (7b5825117f97f2f87b7141509a254f88d0957cf7)
• Fix config → entry in plop plugin (25a380c9e1165b76583d69b48b5fa7cdf5db0ae2)

Release 6.37.0

• fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (#2048) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks @​RobHannay!
• fix: enable JSX in the config loader (#1959) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks @​addielaruee!
• Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)
• Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)
• Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)
• Separate shell binary expectations from reporting exemptions (resolve #2022) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)
• Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)
• Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)
• Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)
• Fix --format name resolution in the ESLint plugin (#2046) (1269e98bb700384811fadc124d69ea720832037e) - thanks @​bytedoe!

Release 6.36.0

• Add @​tailwindcss/webpack as Tailwind plugin enabler (#2027) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks @​igas!
• Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)
• Explain ambiguous star exports in traces (#2025) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks @​gioboa!
• Fix eslintrc parserOptions.parser handling in ESLint plugin (#2028) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks @​bytedoe!
• fix(compilers): require word boundary around import keyword (#2029) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks @​thanadolps!
• fix: recover from corrupt cache file (#2034) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks @​gioboa!
• fix: fix trailing comma on dependency removal (#2033) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks @​gioboa!
• Document built-in compiler scope (a05e155276dad4ead16992580d17572cebf045e7)
• Add babel, khan and oxc to projects and optimize svgs (1c26560b98bc3109e93d15761d02f089213bfb6c)
• Add section to test preview packages & extension (d911c18385f0aa41f53653a2a15cc90a1e0251b8)
• Fix shared info/exclude handling in linked Git worktrees (#2037) (c1f18d5a7d25fc5a614747bbcbd62d043457eb48) - thanks @​kenfdev!
• Shard Node specs on Windows and enable Bun test parallelism (66e966b6edec4460b40b05847fefa9f90ee69068)
• Add Varlock plugin support (#2000) (e4fbf46acff08e78370e72b142e795bd81f28561) - thanks @​Joehoel!
• Apply NODE_OPTIONS inputs to package manager binaries (#2038) (c8df8a28e9a19484efe7097f984abc0c6556aff5) - thanks @​giaBaoJS!
• Handle array form of import/resolver setting in ESLint plugin (#2041) (a80d386a80fdafc89c610d4887ec82184ac178db) - thanks @​bytedoe!
• fix(node): add valueless Node CLI flags to boolean options (#2042) (4c6768501f7115a894d7ece9e5c32090b684cc6f) - thanks @​shoutoutuoadi325!
• fix(typedoc): accept string form of plugin and theme options (#2043) (ce387b05c8f136546e860ec73e29557563c63afa) - thanks @​giaBaoJS!
• Add textlint plugin (#2039) (532dab595fc9a910e320418dc0390222fb2d7478) - thanks @​anandghegde!
• fix: Correctly resolve Vitest setupFiles from nested configs (#2040) (84a494334e125d229dc865893b21d69d0d201e85) - thanks @​CruseCtrl!
• Add n8n to projects (3f756a7e70c4164d57a7dbbd58f3604afe4043e2)

... (truncated)

Commits

• c0e42f8 Release knip@6.38.0
• 25a380c Fix config → entry in plop plugin
• 7b58251 Resolve mdx content mapper providerImportSource
• 11e9450 Refactor and separate concerns w/ new typescript-content-mapper plugin
• 34dbccf feat: resolve MDX content mapper remarkPlugins (#2060)
• 584e53f Flag unused member tags in tagged enums and namespaces
• 8a8805e Fix tag hints for enum and namespace members (#2061)
• 8b0c850 Fix import.meta handling in built-in compilers (#2059)
• a149a98 Support oxlint extends (#2054)
• 9b5c5f6 Resolve file option in Mocha configuration files (#2051)
• Additional commits viewable in compare view

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}