chore: bump the repository-tooling group across 1 directory with 5 updates

[dependabot]

Bumps the repository-tooling group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/claude-code	2.1.232	2.1.250
@biomejs/biome	2.5.8	2.5.11
@j178/prek	0.4.13	0.4.14
@openai/codex	0.147.0	0.149.1
cspell	10.0.1	10.1.0

Updates @anthropic-ai/claude-code from 2.1.232 to 2.1.250

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.250

What's changed

• Bug fixes and reliability improvements

v2.1.248

What's changed

• Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files
• Added experimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configured
• Added claude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)
• Added server-managed settings diagnostics: a startup warning when the settings fail to load, and a /doctor and /status line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom ANTHROPIC_BASE_URL)
• Added a warning in /web-setup when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it
• Added /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials, so members can request a higher usage limit from their admin
• Added cross-session messaging (SendMessage / ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
• Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
• Fixed the ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turn
• Fixed Claude Desktop and Cowork sessions disappearing after 30 days: the transcript cleanup now keeps desktop-written sessions while they are in the app (unless org policy manages retention); the new desktopSessionCleanupPeriodDays setting caps the exemption
• Fixed being sent to the login screen when another Claude Code process held the token refresh lock while the session token had expired; the request now fails with a retryable error instead
• Windows: Fixed the claude agents list not responding to the keyboard after detaching from a session, or when launched in a terminal tab left in win32-input-mode
• Fixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when ANTHROPIC_API_KEY or an API key helper is set); it now falls back to the API-key sign-in
• Fixed model names in /model and fast-mode switch notices to render as code, so suffixes like [1m] display literally instead of as a link
• Fixed claude agents skipping the workspace trust prompt when the CI environment variable is set
• Fixed claude agents crashing on launch when the PR-status cache held a malformed entry
• Fixed agent view resurrecting a weeks-old background session after the machine was off: such a session now shows as stopped at its real end, and opening it asks before resuming its saved conversation
• Fixed agent view sometimes opening an older conversation, and dropping the typed prompt, when starting a new session
• Fixed claude agents: opening a stopped session that you already resumed in another terminal no longer starts a second process on that conversation; the row now says it is open in a terminal
• Fixed claude agents and claude rm refusing to delete a session ("has commits that are not pushed anywhere") when its worktree branch was already merged into your checked-out default branch (e.g. local main) but not yet pushed
• Fixed background sessions waiting silently when a PermissionRequest or PreToolUse hook prints an invalid answer: the claude agents row now names the hook and the schema error
• Fixed hooks silently treating a stdout {…} object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message
• Fixed /mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now appears under its real scope
• Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented
• Fixed /login to a Claude apps gateway hanging when the managed-settings security approval dialog was required
• Fixed gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY) never running when apiKeyHelper is the only credential
• Fixed claude logs leaving mouse tracking, bracketed paste and the alternate screen switched on in the terminal it was run from
• Fixed the trust dialog's list of repo permission rules showing a garbled character when a long rule was cut off in the middle of an emoji
• Fixed the permission mode indicator staying hidden behind the "Press Ctrl-C again to exit" hint when you press shift+tab right after ctrl+c
• Fixed /ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine
• Fixed Remote Control sessions occasionally never showing a permission prompt or the latest messages on the connected device after the CLI silently reconnected
• Fixed cloud sessions occasionally failing at startup when the container's session credentials were not yet readable
• Fixed claude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the subcommand
• Fixed startup warnings (e.g. "N MCP servers need authentication") rendering one column right of the rest of the transcript
• Fixed a backgrounded worktree session losing its checkout: the background session now holds the worktree's lock while it runs, so cleanup and git worktree remove leave it alone
• Fixed @-mentions of other sessions not matching names typed with non-Latin characters (for example Korean entered through an IME)
• Fixed an invalid crossSessionInbound value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed
• Fixed rate-limit, usage, and fast-mode messages telling you to run /usage-credits when that command isn't available for your organization (e.g. hidden with DISABLE_EXTRA_USAGE_COMMAND)
• [VSCode] Fixed a chat tab getting stuck on "No conversation found" when its session was never saved; it now starts a new conversation instead
• Improved the Workflow tool's prompt footprint: its description is now about 1k tokens instead of 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill
• Improved the prompt-footer PR badge to check GitHub less often while the pull request is unchanged; a push or a gh pr command still refreshes it right away
• Improved managed settings: client-side timeout, MCP startup-mode, and stream-watchdog env vars no longer trigger the settings-approval prompt

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.250

• Bug fixes and reliability improvements

2.1.248

• Added --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files
• Added experimental.cacheTtl ("5m" or "1h") to agent frontmatter: a per-agent prompt cache TTL used when no subagent TTL setting is configured
• Added claude self-hosted-runner --client-label <label> (or SELF_HOSTED_RUNNER_CLIENT_LABEL) to override the label the runner registers with (default: hostname)
• Added server-managed settings diagnostics: a startup warning when the settings fail to load, and a /doctor and /status line explaining a load failure or why they weren't fetched (Bedrock/Vertex/third-party provider, custom ANTHROPIC_BASE_URL)
• Added a warning in /web-setup when the GitHub CLI token lacks the workflow scope, since pushes to very large repositories can be rejected without it
• Added /usage-credits for Enterprise organizations billed through AWS Marketplace, self-serve Enterprise, and Enterprise trials, so members can request a higher usage limit from their admin
• Added cross-session messaging (SendMessage / ListAgents) between sessions on the same machine on Bedrock, Vertex, and Foundry, and when telemetry is disabled
• Fixed a prompt-cache miss (and lost extended-thinking context) roughly once an hour in long sessions, caused by tool definitions being re-rendered after an OAuth token refresh
• Fixed the ScheduleWakeup tool definition changing between a session and its --resume when the account had entered usage overage, causing a full prompt-cache miss on the resumed session's first turn
• Fixed Claude Desktop and Cowork sessions disappearing after 30 days: the transcript cleanup now keeps desktop-written sessions while they are in the app (unless org policy manages retention); the new desktopSessionCleanupPeriodDays setting caps the exemption
• Fixed being sent to the login screen when another Claude Code process held the token refresh lock while the session token had expired; the request now fails with a retryable error instead
• Windows: Fixed the claude agents list not responding to the keyboard after detaching from a session, or when launched in a terminal tab left in win32-input-mode
• Fixed the recommended Console sign-in in /login failing with an OAuth error before showing a sign-in URL on machines where it can't be used (for example when ANTHROPIC_API_KEY or an API key helper is set); it now falls back to the API-key sign-in
• Fixed model names in /model and fast-mode switch notices to render as code, so suffixes like [1m] display literally instead of as a link
• Fixed claude agents skipping the workspace trust prompt when the CI environment variable is set
• Fixed claude agents crashing on launch when the PR-status cache held a malformed entry
• Fixed agent view resurrecting a weeks-old background session after the machine was off: such a session now shows as stopped at its real end, and opening it asks before resuming its saved conversation
• Fixed agent view sometimes opening an older conversation, and dropping the typed prompt, when starting a new session
• Fixed claude agents: opening a stopped session that you already resumed in another terminal no longer starts a second process on that conversation; the row now says it is open in a terminal
• Fixed claude agents and claude rm refusing to delete a session ("has commits that are not pushed anywhere") when its worktree branch was already merged into your checked-out default branch (e.g. local main) but not yet pushed
• Fixed background sessions waiting silently when a PermissionRequest or PreToolUse hook prints an invalid answer: the claude agents row now names the hook and the schema error
• Fixed hooks silently treating a stdout {…} object that isn't valid JSON as plain text; it's now reported as a hook error with the parse message
• Fixed /mcp listing a project .mcp.json entry that declares the claude.ai connector type under the trusted "claude.ai" heading; it now appears under its real scope
• Fixed MCP servers whose headersHelper supplies the Authorization header falling into OAuth discovery on a 401 instead of re-running the helper and retrying the call as documented
• Fixed /login to a Claude apps gateway hanging when the managed-settings security approval dialog was required
• Fixed gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY) never running when apiKeyHelper is the only credential
• Fixed claude logs leaving mouse tracking, bracketed paste and the alternate screen switched on in the terminal it was run from
• Fixed the trust dialog's list of repo permission rules showing a garbled character when a long rule was cut off in the middle of an emoji
• Fixed the permission mode indicator staying hidden behind the "Press Ctrl-C again to exit" hint when you press shift+tab right after ctrl+c
• Fixed /ultrareview and locally seeded cloud sessions uploading uncommitted edits to prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine
• Fixed Remote Control sessions occasionally never showing a permission prompt or the latest messages on the connected device after the CLI silently reconnected
• Fixed cloud sessions occasionally failing at startup when the container's session credentials were not yet readable
• Fixed claude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the subcommand
• Fixed startup warnings (e.g. "N MCP servers need authentication") rendering one column right of the rest of the transcript
• Fixed a backgrounded worktree session losing its checkout: the background session now holds the worktree's lock while it runs, so cleanup and git worktree remove leave it alone
• Fixed @-mentions of other sessions not matching names typed with non-Latin characters (for example Korean entered through an IME)
• Fixed an invalid crossSessionInbound value being silently ignored: it now warns and holds cross-session messages (user settings) or refuses them (managed settings) until fixed
• Fixed rate-limit, usage, and fast-mode messages telling you to run /usage-credits when that command isn't available for your organization (e.g. hidden with DISABLE_EXTRA_USAGE_COMMAND)
• [VSCode] Fixed a chat tab getting stuck on "No conversation found" when its session was never saved; it now starts a new conversation instead
• Improved the Workflow tool's prompt footprint: its description is now about 1k tokens instead of 5.7k, with the script-writing reference moved into a bundled workflow-authoring skill
• Improved the prompt-footer PR badge to check GitHub less often while the pull request is unchanged; a push or a gh pr command still refreshes it right away
• Improved managed settings: client-side timeout, MCP startup-mode, and stream-watchdog env vars no longer trigger the settings-approval prompt
• Improved /ultrareview <PR#> to check before launch that the GitHub account connected to your Claude account can access the repository, and to explain how to fix it, instead of failing after the cloud session starts
• Improved cross-session messaging: falls back to a private per-user /tmp directory when the default one can't be used, and the notice and /status name the directory to fix

... (truncated)

Commits

• 92bb685 chore: Update CHANGELOG.md and feed.xml
• c336b74 chore: Update CHANGELOG.md and feed.xml
• cad6304 chore: Update CHANGELOG.md and feed.xml
• 005c5da chore: Update CHANGELOG.md and feed.xml
• 1af51fd chore: Update CHANGELOG.md and feed.xml
• 3bbe157 chore: Update CHANGELOG.md and feed.xml
• 8b6ef81 chore: Update CHANGELOG.md and feed.xml
• 45bdfa9 chore: Update CHANGELOG.md and feed.xml
• 5cfc0a1 chore: Update CHANGELOG.md and feed.xml
• 16440d0 chore: Update CHANGELOG.md and feed.xml
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.8 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates @j178/prek from 0.4.13 to 0.4.14

Release notes

Sourced from @​j178/prek's releases.

0.4.14

Release Notes

Released on 2026-08-17.

Enhancements

• Support check-yaml unsafe mode (#2546)

Performance

• Reuse allocations in common filters (#2548)

Bug fixes

• Accept non-finite floats in check-yaml (#2545)
• Allow comment-heavy YAML in check-yaml (#2554)
• Sanitize captured terminal output before replay (#2552)

Contributors

• @​j178

Install prek 0.4.14

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install prek

Download prek 0.4.14

File	Platform	Checksum
prek-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
prek-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
prek-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum

... (truncated)

Changelog

Sourced from @​j178/prek's changelog.

0.4.14

Released on 2026-08-17.

Enhancements

• Support check-yaml unsafe mode (#2546)

Performance

• Reuse allocations in common filters (#2548)

Bug fixes

• Accept non-finite floats in check-yaml (#2545)
• Allow comment-heavy YAML in check-yaml (#2554)
• Sanitize captured terminal output before replay (#2552)

Contributors

• @​j178

Commits

• 432eeb0 Bump version to 0.4.14 (#2571)
• 6b6d429 Update Rust crate ignore to v0.4.33 (#2564)
• 27d0cf8 Update prek hooks (#2555)
• aaf407b Update Rust crate aws-lc-rs to v1.18.0 (#2569)
• 3ddddfd Update Rust crate xml to v1.4.0 (#2570)
• fc90ec6 Update Rust crate similar to v3.1.2 (#2567)
• 50e60d4 Update Rust crate thiserror to v2.0.20 (#2568)
• 70a4c06 Update Rust crate liblzma to v0.4.8 (#2565)
• 7b8dcaa Update Rust crate globset to v0.4.20 (#2563)
• 3e075d3 Update Rust crate clap_complete to v4.6.9 (#2562)
• Additional commits viewable in compare view

Updates @openai/codex from 0.147.0 to 0.149.1

Commits

• See full diff in compare view

Updates cspell from 10.0.1 to 10.1.0

Release notes

Sourced from cspell's releases.

v10.1.0

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>

This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

• package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.
• No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.
• Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

1. One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.
2. A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.
3. Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.
4. cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

---

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.1.0 (2026-08-22)

Features

feat(cspell-junit-reporter): add JUnit XML reporter package (#8945)

Closes #4570.

Adds @cspell/cspell-junit-reporter, a new workspace package modeled on packages/cspell-json-reporter, that emits a JUnit-compatible XML report of a cspell run.

The issue asked for a minimal mapping along the lines of:

<testsuite tests="3">
  <testcase classname="File1" name"/>
  <testcase classname="File2" name="AnotherSuccessfulTest"/>
  <testcase classname="foo3" name="AFailingTest">
    <failure type="prohibited word"> zzz </failure>
  </testcase>
</testsuite>

This PR follows that shape but wraps it in a <testsuites> root and groups by file (one <testsuite> per file, suite name = file path), since that is the convention used by other widely-consumed JUnit reporters (for example ESLint's JUnit formatter) and is what most CI JUnit parsers expect. The package README documents the full mapping.

• package.json, tsconfig.json, test framework, and files/exports/publishConfig shape are copied from cspell-json-reporter. Version pinned to 10.0.1 to match the monorepo's locked versioning.
• No third-party XML library was added. The repo has no existing XML dependency, so a small escaping helper (src/utils/escapeXml.ts) and a pure XML-string builder (src/utils/buildJUnitXml.ts) were written in-repo, consistent with the monorepo's small-utility-file convention.
• Unit tests (32) cover: no files, a clean file (single passing testcase), a file with issues, escaping of special characters in paths/words/messages, a skipped file, and non-issue processing errors (error emitter routed to a dedicated cspell-errors testsuite using <error>).

Assumptions the issue thread left ambiguous, called out for review:

1. One <testsuite> per file rather than one flat suite for the whole run. Matches common JUnit reporter convention and keeps per-file counts meaningful in CI UIs.
2. A clean file gets one synthetic passing <testcase name="no issues found"> so a suite is never reported with tests="0", which some JUnit consumers treat as suspicious.
3. Settings are intentionally slimmer than cspell-json-reporter's (outFile, suiteName only). JUnit XML has no natural place for arbitrary debug/progress log dumps.
4. cspell processing errors are reported as <error> elements, distinct from spelling <failure> elements, per the JUnit failure-vs-error distinction.

Verified locally: tsc -b clean, vitest 32/32, eslint and prettier clean, and the full monorepo build:prod succeeds with the package in the workspace. One environment note: the package's CLI smoke-test script wasn't runnable locally (repo requires Node >=22.18.0, local was 22.17.0 — the sibling json-reporter fails identically there), so CI is the first place it will run.

---

Fixes

fix: allow substitutions across ignored ranges (#9017)

... (truncated)

Commits

• 401518c v10.1.0
• acf8449 chore: Prepare Release v10.1.0 (auto-deploy) (#8883)
• 3078371 fix: Workflow Bot -- Update Dictionaries (main) (#9024)
• f557824 ci: Workflow Bot -- Update ALL Dependencies (main) (#9014)
• 1c11da6 ci: Workflow Bot -- Update ALL Dependencies (main) (#8970)
• 67448c8 chore: bump the development-dependencies group across 1 directory with 16 upd...
• ce30dc7 chore: bump chalk from 5.6.2 to 6.0.0 (#8973)
• 9703748 ci: Workflow Bot -- Update ALL Dependencies (main) (#8952)
• c8b94a7 doc: Update Node version requirement to 22 (#8940)
• 69c4b7f chore: bump commander from 14.0.3 to 15.0.0 (#8925)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions