[vvillait88]

Summary

Maintenance sweep for 2026-10-22. Every change is a dev-only tool update, so no release.

• knip: 6.41.0 to 6.42.1.
• typescript-eslint: 8.71.2 to 8.72.0.
• packageManager: bun@1.4.4. CI's setup-bun follows this field. Bun 1.4.4 drops the compromised emSign ECC Root CA - G3 and rejects chains containing the blocked keys.
• Checked and current: every GitHub Action this repo uses is on its latest major.
• Held back: TypeScript 7. typescript-eslint 8.72.0 still peers typescript <6.1.0, so it would break lint.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. Nothing in the published package changes, so this does not bump the version or cut a release.

Test plan

• bun run lint, typecheck, knip, test (154 passed, 2 skipped) and build all pass.
• osv-scanner on bun.lock: no issues found.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: no blocking findings

Read at head e2d7f7d. Probes and numbers below.

Lock diff, every change accounted for (86 lines in bun.lock, 6 in package.json)

• typescript-eslint and all eight @typescript-eslint/* packages, 8.71.2 to 8.72.0, including the eight nested */@typescript-eslint/types entries.
• knip 6.41.0 to 6.42.1. Its new manifest raises oxc-parser to ^0.154.0 and unbash to ^6.0.0 (6.41.0 had ^5.0.0, read from the registry). That explains oxc-parser, @oxc-project/types and the 19 @oxc-parser/binding-* entries moving to 0.154.0, plus unbash 5.0.0 to 6.0.1.
• The nested rolldown/@oxc-project/types@0.154.0 entry is gone because the hoisted copy is now 0.154.0. osv-scanner counts 390 packages at base and 389 at head, which matches.
• The "libc": "glibc"/"musl" fields on the linux bindings come from the lockfile writer. The registry already carried libc on the 0.153.0 bindings, so this is serialization, not a metadata change.
• Nothing else moved. All 12 direct devDependencies are locked at their npm latest.

No runtime dependency moved. package.json has no dependencies, peerDependencies or optionalDependencies. typescript (6.0.3, the newest 6.x) and tsup (9.0.0) are unchanged, so dist/ builds from the same toolchain.

TypeScript 7 hold still stands. npm view typescript-eslint@8.72.0 peerDependencies gives typescript: ">=4.8.4 <6.1.0". The same range is in the lock's @typescript-eslint/tsconfig-utils@8.72.0 entry. npm latest for typescript is 7.0.2, so the hold is still the only reason this stays on 6.

Bun 1.4.4

• The bun-v1.4.4 tag was published 2026-10-22.
• The compare API puts both fixes inside the tag: oven-sh/bun #46159 ("crypto: update root certificates") is 47 commits behind it, and #46300 ("tls: reject chains containing blocked public keys, update root certificates to NSS 3.131.1") is 40 behind. Neither is ahead of the tag.
• The CI ci job log reads Obtained version 1.4.4 from package.json, then downloads bun-v1.4.4/bun-linux-aarch64.zip. bun --revision prints 1.4.4+38afee6c8 and bun install v1.4.4 runs with --frozen-lockfile.
• publish.yml uses the same setup-bun@v2 with no version input, so it follows the same field.

Actions are current. Latest releases: setup-bun v2.2.0, cache v6.1.0, setup-node v7.1.0, checkout v7.0.1. The newest tag on useblacksmith/checkout is v1.8.1. All of them are on the major this repo floats.

CI. gh pr checks 110 shows 9 rows, all pass, exit 0. Both required checks (ci, Dependency Scan) are present and green.

osv-scanner 2.7.0 (the latest release)

• Head bun.lock: 389 packages, no issues.
• Base bun.lock: 390 packages, no issues.
• osv-scanner.toml is empty of ignores, so the clean result does not depend on an allowlist.
• Positive control: a one-package bun.lock with lodash 4.17.15 reports 6 vulnerabilities, so the scanner was reaching the database.

No version bump and no release is correct. Everything that changed is a dev tool or the CI bun, the package has no runtime dependencies, and the build toolchain is unchanged. The published tarball would be identical to v2.9.2.