[dependabot]

Bumps ultracite from 7.11.1 to 8.0.1.

Release notes

Sourced from ultracite's releases.

ultracite@8.0.1

Patch Changes

• 40d646a: ultracite fix --claude and --codex hand agents better information and report results more accurately:

  • Rule names reach the agent as they're written in the config, such as no-unused-vars and typescript/no-explicit-any, instead of Oxlint's eslint(no-unused-vars).
  • ESLint diagnostics now carry the rule's description and documentation URL, read with the json-with-metadata formatter. Biome diagnostics carry the rule's documentation URL and its description from biome explain, since Biome's JSON reporter includes no help text.
  • The prompt tells the agent that the run is non-interactive, so it explains a decision it can't make in its final message instead of asking a question and waiting for an answer that can't come.
  • Files are handed over in path order, so the same project gets its fix in the same file on every run. Before each file after the first, Ultracite lints it again: an earlier file's fix can clear its issues (breaking an import cycle fixes both files), and the agent was being handed diagnostics that no longer applied. A file with nothing left is skipped.
  • A file the agent deleted, or one that no longer parses, now counts as unfixed. Before, its issues could disappear from the report and show as fixed.

• 2543859: Update the vendored anti-slop Oxlint plugin to upstream commit 13909c9 and enable its three new rules in the ultracite/oxlint/anti-slop preset. require-readable-spacing restores blank lines around structural boundaries — top-level declarations, multiline bindings, control flow, returns, and blocks — a pattern AI-generated code tends to pack together, while consecutive single-line bindings stay grouped at any scope (dmmulroy/anti-slop#45). Its autofix only inserts whitespace and never removes existing blank lines, so ultracite fix restores the spacing without fighting the formatter. no-array-filter-map rejects adjacent eager filter/map passes over arrays, and no-reduce-accumulator-copy rejects reducers that copy their accumulator on every iteration. Expect a one-time whitespace-only diff from ultracite fix after upgrading if you extend the preset (#803).

• 0a671cc: On the ESLint toolchain, ultracite fix --hook no longer deletes an import an agent has just added. A post-edit hook runs between the agent's edits, so the import is unused until the code that uses it lands, and unused-imports/no-unused-imports removed it first. The hook run now turns that rule off, as the Biome hook already skips noUnusedImports (#483). no-unused-vars still reports the import if it stays unused.

• de08bd3: The ESLint core preset no longer configures a node resolver for import-x, which needed eslint-import-resolver-node, a package init never installed. The TypeScript resolver it keeps resolves JavaScript files too.

• c13e042: react/jsx-no-target-blank now checks forms as well as links (forms: true) in the Oxlint and ESLint React presets, as Biome's noBlankTarget already does. The rules file init writes for agents now says to add rel="noopener noreferrer" to target="_blank" links instead of rel="noopener", which Oxlint and ESLint report because it still sends the referrer. It also says to avoid import cycles again, which the Oxlint and ESLint core presets report.

• 9853406: The oxlint.config.ts that ultracite init writes now sets env: core.env. Oxlint doesn't carry env through extends, so the browser globals the core preset declares never reached projects, and rules that depend on them stayed quiet: no-implied-eval didn't report setTimeout("…") or setInterval("…"), and no-eval didn't report window.eval(…). Workspace configs written by init now repeat env: root.env alongside ignorePatterns and settings, and an .oxlintrc.json that init migrates keeps its env on top of core's. Re-run ultracite init to update an existing config, or add env: core.env to it yourself.

• 7984c6e: The Oxlint js-plugins preset now enables the 32 SonarJS rules that the ESLint core preset already runs without type information, including the security rules sonarjs/slow-regex, sonarjs/sql-queries, sonarjs/disabled-auto-escaping and sonarjs/dompurify-unsafe-config. SonarJS marks these rules requiresTypeChecking, but they also check the syntax tree, so they work through Oxlint's JS plugin bridge. The preset had left out every marked rule.

ultracite@8.0.0

Major Changes

• d0875c0: Every agent now reads Ultracite's rules from AGENTS.md. init writes the rules there once, whichever agents you pick, and only adds a file for the four agents that need one more step to see them:

  • Claude Code reads AGENTS.md only when the project has no CLAUDE.md, so init adds an @AGENTS.md import to the project's CLAUDE.md or .claude/CLAUDE.md when there is one.
  • Gemini CLI reads GEMINI.md by default, so init adds AGENTS.md to context.fileName in .gemini/settings.json, keeping GEMINI.md.
  • Aider gets .aider.conf.yml pointed at AGENTS.md, as before.
  • Replit Agent reads only replit.md, so it keeps a copy of the rules there.

  Firebender now reads AGENTS.md too. The init prompt asks which agents you use and lists AGENTS.md (Universal) plus those four.

  Projects set up by earlier versions move over the next time init runs: it takes Ultracite's block out of .claude/CLAUDE.md, GEMINI.md, .firebender/rules/ultracite.mdc and Aider's ultracite.md, removes a file left with nothing else in it, and adds the import or settings that agent needs. That happens whenever one of those files still holds the rules, whichever agents you pick, since a leftover .claude/CLAUDE.md stops Claude Code from reading AGENTS.md.

  A CLAUDE.md, GEMINI.md or replit.md that is a symbolic link to AGENTS.md, or that AGENTS.md links to, already gives that agent the rules, so init leaves it as it is. init never writes through or removes a symbolic link to another file; it prints what to add to that file instead.

• 3ee5b8c: Aider now loads Ultracite's rules and lints each file it edits. Aider reads no instructions file on its own, so the ultracite.md that init --agents aider used to write was never loaded. Now init writes the rules to AGENTS.md and merges two keys into .aider.conf.yml: read: AGENTS.md, and lint-cmd set to the project's ultracite fix, which Aider runs on every file it edits, asking the model to fix whatever is left. The rest of the file, comments included, stays as written, a lint-cmd that runs another linter is left alone, and an ultracite.md that holds nothing but the rules is removed. Aider keeps its own option in the init prompt, since the universal AGENTS.md option doesn't write .aider.conf.yml.

  The agent list also uses the current names for Deep Agents, goose and Gemini CLI. Their --agents IDs don't change.

• f4c8a32: Make every rule in the Biome core preset an error. noSuspiciousSemicolonInJsx came from Biome's recommended set at warning level, so ultracite check passed with it unless the React preset was on. It and the two other rules core inherited from that set, noDuplicateJsxProps and noVoidElementsWithChildren, are now set to error explicitly.

• ed5ed04: compat/compat is now an error in the ESLint core preset. It was the last warning-level rule in any preset, so ultracite check passed while it reported browser APIs your browserslist targets don't support. Set your targets in a browserslist key in package.json or a .browserslistrc file, or turn the rule off in your config if the project only runs on a server.

  A project that sets no targets is now checked against Baseline Widely available browsers (baseline widely available). eslint-plugin-compat used browserslist's defaults there, which include Opera Mini and Chrome 109, so fetch, URL and Array#toSorted() failed in almost every project. Ultracite only sets these targets when it finds no browserslist config from the directory ESLint runs in and no BROWSERSLIST environment variable, since the plugin would add them to your own targets rather than replace them. In a monorepo that sets targets only in its packages, add them at the root too, or set settings.browsers yourself.

• 16fa476: Lint the scripts in Vue, Svelte and Astro components with the ESLint core rules. Core's globs only matched .js and .ts files, so a .vue file got only the Vue rules, a .svelte file only the Svelte rules, and an .astro file's frontmatter only the Astro rules, while Oxlint already runs its core rules on those scripts. The vue, svelte and astro presets now apply core's rules to their components, including the TypeScript rules, with the type-checked ones off because a script block isn't part of a tsconfig.

  • Components now get core's filename rule like any other file, as on Oxlint, so a PascalCase component such as TaskList.vue is reported. SvelteKit route files (+page.svelte) are exempt, and Astro and Nuxt pages ([slug].astro, [id].vue) get the same route-aware pattern as other pages/ files, on ESLint and in Oxlint's JS plugins.
  • In Svelte components and rune modules, prefer-const, unicorn/no-top-level-assignment-in-function and sonarjs/declarations-in-global-scope are off: svelte/prefer-const replaces the first, and the other two misread $props() and $state in a component's scope. SvelteKit's PageProps and LayoutProps, and Astro's Props, are allowed by unicorn/name-replacements.

• ed5ed04: Cypress and Storybook rules move out of the ESLint core preset into opt-in framework presets, ultracite/eslint/cypress and ultracite/eslint/storybook. Core loaded both plugins for every project, so init installed eslint-plugin-cypress, eslint-plugin-storybook and the whole storybook package for every ESLint setup, whether or not the project used them.

  init now offers cypress and storybook with the other frameworks (--frameworks cypress storybook). It preselects them when cypress or storybook is in package.json, and installs their plugins only when you pick them. To keep linting Cypress specs and stories, add the presets to eslint.config.mjs after core:

  import core from "ultracite/eslint/core";
  import cypress from "ultracite/eslint/cypress";

... (truncated)

Commits

• 367d908 Version Packages (#849)
• 2543859 Update the vendored anti-slop plugin and enable require-readable-spacing (#811)
• ac533c7 Bump turbo to 2.11.8
• e9c264b Give each research post a share card with its own description
• 7f71068 Color the share cards like the homepage call to action
• 8f6d546 Keep a bare bun test out of research and tmp
• 4ea170b Document restriction rules, cycle reports and unused exports
• de08bd3 Drop the uninstalled node resolver from the ESLint core preset
• c13e042 Check forms for target="_blank" and fix the agent rules on it
• 7984c6e Run sonarjs's syntactic rules in Oxlint js-plugins and fix the parity check
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
vecstore-sdk	Ready	Preview	Oct 23, 2026 2:48am UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: 8557501

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 28c07311-609e-400c-b32c-0587e418b223

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	ultracite@​7.11.1 ⏵ 8.0.1			+2	+1

View full report

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/vecstore-sdk@70

commit: 8557501