[usagizmo]

Summary

Brings every dependency to its latest release, clears all bun audit findings, runs package bins on Bun, and adds an audit step to CI.

Dependencies

Package	Before	After
Bun (packageManager / engines)	1.4.2	1.4.4
@types/bun	1.4.2	1.4.4
markuplint	5.0.1	5.4.0
oxfmt	0.71.0	0.77.0
oxlint	1.86.0	1.92.0
husky, lint-staged, typescript, browser-sync	already latest	—

Transitive updates include follow-redirects 1.16.1 → 1.16.3 (GHSA-mrwp-f3q8-3g9p, high).

overrides lifts two advisories that the parents' ranges still pin:

• glob → ^14.0.4 (GHSA-3g3m-2fjr-6pw4) and minimatch → ^11.0.5 (GHSA-g3hv-75wg-m249), used by markuplint / eslint internals through named exports only.
• resp-modifier (browser-sync) keeps minimatch ^3.1.5: it calls require('minimatch') as a function, which v11 no longer supports, and 3.x is outside the advisory range.

bun audit: 4 vulnerabilities (1 high, 3 moderate) → 0.

Node.js

Nothing in the repo calls Node directly, but bins such as browser-sync, husky, and lint-staged have #!/usr/bin/env node shebangs, so they ran on Node whenever it was installed. bunfig.toml sets [run] bun = true, so they now run on Bun even with Node on PATH.

Supply chain

• bunfig.toml: install.minimumReleaseAge = 86400 skips npm versions published less than 1 day ago.
• CI: a bun audit --audit-level=high step.
• .gitignore: dropped npm / Yarn / PnP leftovers.

Breaking changes

• oxfmt 0.71 → 0.77 and oxlint 1.86 → 1.92 can change formatting or add lint findings in projects made from this template. This repo itself formats and lints clean.
• Package bins now run on Bun instead of Node. Any Node-only behaviour in a future dependency would surface here.
• CI fails on a high or critical advisory, even when the PR does not touch dependencies.
• Installing a version published within the last 24 hours (e.g. a same-day hotfix) needs minimumReleaseAge lowered or the package excluded.

Test plan

• bun install --frozen-lockfile from a clean node_modules
• bun run lint, bun run check, bun run test
• bun audit → no vulnerabilities
• With Node removed from PATH: lint / check / test / dev all pass
• bun run dev: BrowserSync process runs on the Bun binary and injects its client snippet
• Pre-commit hook (lint-staged + test) runs on each commit

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
dev-template-pages	Ready	Preview	Nov 8, 2026 9:17pm UTC