[squiggler-app]

This PR contains the following updates:

Package	Change	Age	Confidence
oxfmt (source)	^0.73.0 → ^0.74.0

---

Release Notes

oxc-project/oxc (oxfmt)

v0.74.0: oxfmt v0.74.0

Compare Source

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#​27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#​26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#​27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#​27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#​27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#​27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#​27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#​27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#​27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#​27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#​27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#​27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#​27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#​27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#​27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#​27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#​27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#​27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#​27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#​27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#​27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#​27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#​27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#​27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#​27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#​27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#​27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#​27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#​27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#​27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#​27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#​27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#​27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#​27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#​27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#​27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#​27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#​27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#​27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#​27824) (leaysgur)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 3am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate using a curated preset maintained by . View repository job log here

---

Note

Low Risk
Dev-only formatter/tooling version bump and lockfile/workspace install policy tweaks; no runtime application code changes.

Overview
Bumps the root oxfmt dev dependency from ^0.73.0 to ^0.74.0, with pnpm-lock.yaml refreshed so resolved oxfmt and all @oxfmt/binding-* optional natives align on 0.74.0 (including transitive pins through sanity / @sanity/codegen in apps/studio).

In pnpm-workspace.yaml, minimumReleaseAgeExclude stops listing every @oxfmt/binding-*@0.73.0 entry and instead uses @oxfmt/* and oxfmt, so future oxfmt patch/minor bumps stay exempt without editing a long platform list.

^{Reviewed by Cursor Bugbot for commit 3dd288d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sanity-ui-storybook	Ready	Preview	Oct 20, 2026 6:21pm UTC
ui-docs	Ready	Preview	Oct 20, 2026 6:21pm UTC
ui-studio	Ready	Preview	Oct 20, 2026 6:21pm UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
sanity-ui-workshop	Ignored		Oct 20, 2026 6:21pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3dd288d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​oxfmt@​0.73.0 ⏵ 0.74.0	-7

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7fd8af4. Configure here.}

[stipsan]

@copilot CI install fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION for oxfmt and @oxfmt/binding-* 0.74.0. Please refresh pnpm-lock.yaml and, if needed, add name-level minimumReleaseAgeExclude entries in pnpm-workspace.yaml (e.g. oxfmt and '@oxfmt/*'), replacing any existing exact-version oxfmt@…/@oxfmt/binding-*@… pins. Do not add exact-version pins.

[Copilot]

@copilot CI install fails with ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION for oxfmt and @oxfmt/binding-* 0.74.0. Please refresh pnpm-lock.yaml and, if needed, add name-level `minimumReleaseAgeExcl...

Replaced the version-specific exclusions with oxfmt and @oxfmt/*; the existing lockfile already resolves 0.74.0 and passes pnpm’s policy check. Frozen install passes. Commit: 994d38f.

[squiggler-app]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[stipsan]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the conflicts, preserved the oxfmt@0.74.0 upgrade and name-level exclusions, and merged current main. The frozen lockfile and pnpm supply-chain checks pass. Merge commit: 31b5b79.

[stipsan]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the lockfile conflict, retained oxfmt@0.74.0 and the name-level exclusions, and merged the latest main. Frozen lockfile and pnpm supply-chain checks pass. Merge commit: 3dd288d.