build(deps-dev): bump oxfmt from 0.55.0 to 0.56.0 in the development-minor-and-patch group

[dependabot]

Bumps the development-minor-and-patch group with 1 update: oxfmt.

Updates oxfmt from 0.55.0 to 0.56.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• c4be770 release(apps): oxlint v1.71.0 && oxfmt v0.56.0 (#23707)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 28, 2026, 10:23 AM ET / 14:23 UTC.

Summary
Dependabot updates the direct dev dependency oxfmt from 0.55.0 to 0.56.0 and refreshes the matching pnpm lockfile entries.

Reproducibility: not applicable. this is a dependency update PR rather than a bug report. The relevant check is source and diff inspection plus the green CI/dependency-review status on the PR head.

Review metrics: 3 noteworthy metrics.

• Files changed: 2 files, 86 added and 86 removed. The patch is limited to the package manifest and lockfile, which keeps the review surface small.
• Dependency scope: 1 direct dev dependency updated. The direct dependency change affects repository formatting tooling, not published runtime CLI code.
• Checks observed: 7 successful checks. CI, CodeQL, Dependency Review, and secret scanning all passed on the PR head before review.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• No ClawSweeper repair lane is needed; this is ready for ordinary maintainer dependency-update review.

Security
Cleared: No concrete security or supply-chain concern was found; the diff changes only dev dependency metadata/lockfile entries and the dependency/security checks passed.

Review details

Best possible solution:

Merge through the normal Dependabot dependency-update path if maintainers are comfortable with the formatter update and checks remain green.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency update PR rather than a bug report. The relevant check is source and diff inspection plus the green CI/dependency-review status on the PR head.

Is this the best way to solve the issue?

Yes; updating the dev dependency and lockfile together is the narrow maintainable path for this routine formatter bump.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 24763d26cdff.

Label changes

Label justifications:

• P3: This is a low-risk development dependency update with no runtime CLI behavior changes or blocking findings.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real-behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Current main dependency: Current main still declares oxfmt as ^0.55.0, so the requested bump is not already implemented on the default branch. (package.json:38, 24763d26cdff)
• Formatter command surface: The dependency is used by the repository format scripts, including format and format:check, making this a development-tooling update rather than runtime CLI behavior. (package.json:21, 24763d26cdff)
• PR diff scope: The patch changes only package.json and pnpm-lock.yaml, moving oxfmt and its optional native binding lockfile entries from 0.55.0 to 0.56.0; the lockfile also refreshes transitive nanoid from 3.3.12 to 3.3.14. (package.json:38, 540fd621ec12)
• CI validation surface: The CI workflow installs with the frozen lockfile and runs typecheck, lint, pnpm format:check, tests, build, and package smoke checks, covering the formatter update path. (.github/workflows/ci.yml:24, 24763d26cdff)
• PR checks and mergeability: GitHub reports the PR as mergeable and clean, with seven successful observed checks including CI, CodeQL, Dependency Review, and secret scanning. (540fd621ec12)
• Package integrity ownership: CODEOWNERS marks package.json and pnpm-lock.yaml as package-integrity surfaces, which supports ordinary owner review for the dependency update. (.github/CODEOWNERS:16, 24763d26cdff)

Likely related people:

• steipete: Blame attributes the current package scripts and dependency block to the 0.7.0 release commit, and GitHub history shows additional recent package/dependency maintenance by this handle. (role: recent dependency and release area contributor; confidence: high; commits: 0cd24d07a262, 8880f675269c, 1d1284dba70e; files: package.json, pnpm-lock.yaml)
• dependabot[bot]: Prior merged dependency update commits for oxfmt and the development-minor-and-patch group came from Dependabot, including the current 0.55.0 update lineage. (role: recurring dependency update automation; confidence: medium; commits: ce9e83eceecc, 98f51b3daf23, d5e764d12a82; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[dependabot]

Looks like oxfmt is updatable in another way, so this is no longer needed.