build: TS6 + oxc.rs

[erickzhao]

No description provided.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.67.0
	typescript@​5.9.3 ⏵ 6.0.3	+1		+1
	oxlint-tsgolint@​7.0.2001
	oxlint@​1.82.0

View full report

[dsanders11]

Good job adding these unused imports, Claude.

[claude]

Rebased onto main (at @MarshallOfSound's request) to clear the package.json / yarn.lock conflicts from the dependabot bumps since April.

While regenerating the lockfile I bumped the oxc tooling to current so the type-aware peer requirement lines up: oxlint ^1.82.0, oxlint-tsgolint ^7.0.2001, oxfmt ^0.67.0 (same versions as electron/lint-roller#201). No source or formatting changes were needed with the newer oxfmt; yarn install --immutable, yarn lint, yarn build and yarn test (235 tests) all pass locally.

---

Generated by Claude Code

[claude]

I reviewed this PR and didn't find any bugs. Because it migrates the project's lint/format tooling to oxfmt/oxlint, bumps TypeScript to a new major version, and pulls in a large dependency update (yarn.lock), a human look would still be worthwhile.

What was reviewed:

• The regex-escape cleanups and type-narrowing/void fixes in src/bin.ts, src/block-parsers.ts, src/markdown-helpers.ts — confirmed behavior-preserving (e.g. the \. removal in the extractReturnType regex has no effect since JS string/template literals already drop the backslash on non-special escapes).
• The mkdir error path in src/bin.ts — the added void doesn't introduce a new unhandled-rejection risk; that gap predates this PR.
• .oxlintrc.json's correctness: warn setting — yarn lint won't fail CI on correctness-only warnings, but this isn't a regression versus the prior Prettier-only setup (which didn't lint for correctness at all).

Extended reasoning...

Overview

This PR migrates tooling from Prettier to oxfmt/oxlint, bumps several devDependencies including a TypeScript major-version jump (^5.8.3 → ^6.0.2), reformats a handful of JSON config files, and makes small source fixes in src/bin.ts, src/block-parsers.ts, and src/markdown-helpers.ts (unnecessary regex character-class escapes, a narrower type cast, and a void on a previously-floating promise). Test files were reformatted/restructured to match, and CI now runs yarn lint instead of yarn prettier:check.

Security risks

No security-sensitive code paths (auth, crypto, permissions) are touched. The dependency bumps (oxfmt, oxlint, oxlint-tsgolint, TypeScript) are devDependencies only and don't ship in the published package's runtime surface beyond the compiled output, which the CI build+test steps would catch if broken.

Level of scrutiny

This warrants a light-to-moderate scrutiny pass: most of the diff is mechanical (formatter/linter swap, JSON reformatting, cosmetic regex fixes verified behavior-preserving), but the combination of a TypeScript major-version bump, a large yarn.lock delta, and a CI gate change (prettier:check → yarn lint) is exactly the kind of tooling-and-CI change where subtle breakage (e.g., a lint rule silently downgraded to warn-only, as noted in .oxlintrc.json) can slip past automated review. A maintainer (dsanders11) already approved after an inline comment that appears addressed (removal of now-unused type imports in tests/DocsParser.spec.ts), and no CHANGES_REQUESTED review is outstanding.

Other factors

Test coverage (vitest) and the CI build step should catch most functional regressions from the TypeScript bump. I did not find anything to add beyond what's noted above, but given the breadth of the tooling/CI change, flagging it for one more human pass seems worthwhile even without concrete findings.