chore(deps-dev): bump knip from 5.88.1 to 6.22.0 by dependabot[bot] · Pull Request #527 · databuddy-analytics/Databuddy

dependabot · 2026-07-01T04:17:40Z

Bumps knip from 5.88.1 to 6.22.0.

Release notes

Release 6.22.0

Support XO v1+ (#1819) (1dffe368b5c336d190e358ab4c2e2240e3d50e26) - thanks @patrik-csak!

feat: detect execaNode scripts in execa visitor (#1824) (5095ae1ccd0ceb083d4434e827443f03ba19a1ff) - thanks @gwagjiug!

Skip optional peerDeps referenced only via a host (resolve #1823) (7759a9894f2ac1d9425cf682e1e3c400f0976080)

docs: update npmjs.com links to npmx.dev (#1826) (11fe8bd248c839c6eeb95b06c8204c25294e0adb) - thanks @serhalp!

docs: fix semi-broken link to DEVELOPMENT.md in CONTRIBUTING.md (#1827) (a5302b2466be1294633b1f40e86ca81a00605293) - thanks @serhalp!

feat: add support for Lunaria (#1825) (3e1b8212086dfae26fa7f368f245285ec82af14d) - thanks @trueberryless!

Fix lint issues (76c92e2328a94257afead6ae497a747a9e2944ea)

Release 6.21.0

Detect Vite config dependencies (resolve #1721) (8754c43368112922c6f80d1f8d1d8ddb6cb29f25)

fix: Update timerifyMethods to include resolveFromAST (#1814) (3c8deac3b856def31c16372f85525bf867105132) - thanks @gwagjiug!

Fix crash on null root export in package.json (resolve #1815) (9b8af2b343e1aacae46fedcb155252f56f9bae61)

Fix unresolved subpath imports with a colon prefix (resolve #1816) (f89db4192ff7ff6c873828ed19fe40d379566b49)

Detect Next.js entry files in subdirectory (resolve #1817) (f32c6ea215dde54a59af7b91fd8bdd2177cc2881)

Release 6.20.0

Add raw transfer opt-out (resolve #1813) (6f08c680ac4acd6edf0806ba3c1c5c8f7bca24cd)

Fix cached plugin config cycles (resolve #1811) (2bc2f2420ca71db1ae70846626c6152896d270ee)

Release 6.19.0

feat: support new optional sveltekit config pattern via vite config (#1810) (3fee8bf608e0862d7bcdd1377cfb859a9185f17d) - thanks @fubits1!

Optimize hot path string scanning (e30cfe796423e3ecd9adff42291f3c4de6604d2b)

Update astro snapshot (71e71a71b888a1b8034d4438635e94831d62b330)

Release 6.18.0

Update dependencies (pin oxc-resolver) (7dda4eccc65c6d61ef2546442eb752b2a73edab9)

Resolve tsconfig paths for non-TS importers independent of oxc ownership (3b71565e72107d43cbd6d2ddec7ab2fbbf65c001)

Format (64865f8247b8956def52f1a387234562fbddd667)

Fix false positive for Vitest mocks (#1802) (ec93e2013deb53902b406463b30fa6386445f9c9) - thanks @remcohaszing!

Mark npx-run binaries optional unless --no-install (resolve #1803) (203c31e1b2bd77eb9c94f82121f353fbf0671c67)

Ignore pnpm [WARN] lines in ecosystem snapshots (392835a39b9429a3d85d712025da4c6531b8ece6)

Update slonik snapshot (62d802bf8d53d7790f6322f481a290e09812cbcc)

Update Jest entry patterns for Jest 30 (#1808) (d2caeddf32ba99ca12e5c26e891b7974392f981a) - thanks @gwagjiug!

Report stale workspaces configuration keys as configuration hints (#1807) (9083c16b3313fbebf5cb3cd11cadf45ac773bc3d) - thanks @WooWan!

Release 6.17.2

Fix up jest plugin (63dbd653b6e1be08a36401f5f728b351ab69e81b)

Detect coverage provider from bare vitest --coverage flag (#1800) (dc11d9fc5458e6e1f734013eb82403eab07af2c1) - thanks @WooWan!

Don't disable configuration hints in workspace-scoped runs (#1791) (8ce1ec8160a786dad90903e43c3ef646ffba9464) - thanks @WooWan!

Detect react-email v6 packages from non-numeric version ranges (resolve #1798) (27a1caeb1bff6abcccd7140c7e92e4a57197ad47)

Discover workspaces included after a negated pattern (resolve #1797) (630e152f6f687d9404cc25ffa01f0d49737d9229)

Release 6.17.1

Remove ignoreBinaries w/ tar (b13d0ca1ce0a201b7e66f725039d9f346b4d424e)

Wrap up docs/refs (29f3e46cc765a70643bcf2ef96e940ff371f39c6)

Update dependencies (7b2f3458176110900204fa49e50650ac50d1f4db)

Fix up vscode-languageclient imports (820c2335ca63f329f862eb8ec5c264bd8d5f09eb)

Release 6.17.0

... (truncated)

Commits

c053755 Release knip@6.22.0
76c92e2 Fix lint issues
3e1b821 feat: add support for Lunaria (#1825)
11fe8bd docs: update npmjs.com links to npmx.dev (#1826)
7759a98 Skip optional peerDeps referenced only via a host (resolve #1823)
5095ae1 feat: detect execaNode scripts in execa visitor (#1824)
1dffe36 Support XO v1+ (#1819)
6b328d5 Release knip@6.21.0
f32c6ea Detect Next.js entry files in subdirectory (resolve #1817)
f89db41 Fix unresolved subpath imports with a colon prefix (resolve #1816)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by cubic

Upgrade dev dependency knip from 5.88.1 to ^6.22.0 to keep our dead‑code/deps scanning up to date and pick up recent fixes and framework support. No runtime impact.

^{Written for commit c1c2802. Summary will update on new commits.}

Bumps [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) from 5.88.1 to 6.22.0. - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.22.0/packages/knip) --- updated-dependencies: - dependency-name: knip dependency-version: 6.22.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-07-01T04:17:45Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview, Comment	Jul 1, 2026 10:48am
databuddy-status	Ready	Preview, Comment	Jul 1, 2026 10:48am
documentation	Ready	Preview, Comment	Jul 1, 2026 10:48am

unkey-deploy · 2026-07-01T04:18:57Z

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
api (preview)	Ready	Visit Preview	Inspect	Jul 1, 2026 10:47am

socket-security · 2026-07-01T10:47:22Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@5.88.1 ⏵ 6.23.0	⁺¹		⁺¹	⁺¹

View full report

socket-security · 2026-07-01T10:47:24Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/evlog@2.17.0` → `npm/nuxt@4.4.5` → `npm/knip@6.23.0` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

izadoesdev · 2026-07-01T10:49:15Z

Reviewed and repaired before merge.

What changed after review:

Merged current staging into the branch.
Added the missing bun.lock update for the Knip bump. Because the manifest uses ^6.22.0, the lockfile resolves the current compatible knip@6.23.0.

Risk check:

Knip is currently only a root dev dependency; no repo scripts, CI jobs, or config files invoke it.
Product/runtime risk is low.
Noted local-tooling caveat from the major bump: newer Knip requires newer Node 20.x/22.x than the broad root node >=20 engine, but this does not affect app runtime or current CI usage.

Verification:

Local: bun install --frozen-lockfile --ignore-scripts, bun run lint, bun run check-types passed.
Local: installed ./node_modules/.bin/knip --version reports 6.23.0.
Fresh GitHub checks are green: Lint, Check Types, Test, Dashboard Playwright, CodeQL/Analyze, health checks, Socket, and Vercel previews.

Decision: approving and merging into staging.

izadoesdev

Approved after lockfile repair, local tool smoke, and fresh green CI/Vercel.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026

dependabot Bot requested a review from izadoesdev as a code owner July 1, 2026 04:17

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026

vercel Bot deployed to Preview – databuddy-status July 1, 2026 04:18 View deployment

unkey-deploy Bot deployed to links - preview July 1, 2026 04:18 View deployment

unkey-deploy Bot deployed to api - preview July 1, 2026 04:19 View deployment

vercel Bot deployed to Preview – dashboard July 1, 2026 04:19 View deployment

vercel Bot deployed to Preview – documentation July 1, 2026 04:19 View deployment

izadoesdev added 2 commits July 1, 2026 13:43

chore(deps): merge staging into knip bump

b31de30

chore(deps): sync knip lockfile

c1c2802

unkey-deploy Bot deployed to links - preview July 1, 2026 10:46 View deployment

vercel Bot deployed to Preview – databuddy-status July 1, 2026 10:47 View deployment

unkey-deploy Bot deployed to api - preview July 1, 2026 10:47 View deployment

vercel Bot deployed to Preview – documentation July 1, 2026 10:48 View deployment

vercel Bot deployed to Preview – dashboard July 1, 2026 10:48 View deployment

izadoesdev approved these changes Jul 1, 2026

View reviewed changes

izadoesdev merged commit 1fa3afa into staging Jul 1, 2026
15 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/staging/knip-6.22.0 branch July 1, 2026 10:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump knip from 5.88.1 to 6.22.0#527

chore(deps-dev): bump knip from 5.88.1 to 6.22.0#527
izadoesdev merged 3 commits into
stagingfrom
dependabot/npm_and_yarn/staging/knip-6.22.0

dependabot Bot commented on behalf of github Jul 1, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

vercel Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

unkey-deploy Bot commented Jul 1, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 1, 2026

Uh oh!

socket-security Bot commented Jul 1, 2026

Uh oh!

izadoesdev commented Jul 1, 2026

Uh oh!

izadoesdev left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 1, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 6.22.0

Release 6.21.0

Release 6.20.0

Release 6.19.0

Release 6.18.0

Release 6.17.2

Release 6.17.1

Release 6.17.0

Summary by cubic

Uh oh!

vercel Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

unkey-deploy Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 1, 2026

Uh oh!

socket-security Bot commented Jul 1, 2026

Uh oh!

izadoesdev commented Jul 1, 2026

Uh oh!

izadoesdev left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jul 1, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented Jul 1, 2026 •

edited

Loading

unkey-deploy Bot commented Jul 1, 2026 •

edited

Loading