chore(deps): lock file maintenance

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.claude/settings.json

@@ -0,0 +1,26 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "fp=$(cat | jq -r '.tool_input.file_path // empty') && [ -n \"$fp\" ] && case \"$fp\" in */fzf-tmux|*/yarn.lock|*/.yarn/*) echo \"BLOCKED: $fp is a vendor/lock file — do not edit directly\" >&2; exit 2;; esac; exit 0"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "fp=$(cat | jq -r '.tool_input.file_path // empty') && [ -n \"$fp\" ] && [ -f \"$fp\" ] && case \"$fp\" in *.sh|*/bin/*) head -1 \"$fp\" | grep -qE '^#!.*(ba)?sh' && command -v shfmt > /dev/null && shfmt -i 2 -bn -ci -sr -fn -w \"$fp\";; esac; exit 0"
+          }
+        ]
+      }
+    ]
+  }
+}

.claude/skills/shell-validate/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: shell-validate
+description: Validate shell scripts after editing. Apply when writing or modifying any shell script in local/bin/ or scripts/.
+user-invocable: false
+allowed-tools: Bash, Read, Grep
+---
+
+After editing any shell script in `local/bin/`, `scripts/`, or `config/` (files with a `#!` shebang or `# shellcheck shell=` directive), validate it:
+
+## 1. Determine the shell
+
+- `/bin/sh` or `#!/usr/bin/env sh` shebang -> POSIX, use `sh -n`
+- `/bin/bash` or `#!/usr/bin/env bash` shebang -> Bash, use `bash -n`
+- `# shellcheck shell=bash` directive (no shebang) -> use `bash -n`
+- `# shellcheck shell=sh` directive (no shebang) -> use `sh -n`
+- No shebang and no directive -> default to `bash -n`
+
+## 2. Syntax check
+
+Run the appropriate syntax checker:
+
+```bash
+bash -n <file>   # for bash scripts
+sh -n <file>     # for POSIX sh scripts
+```
+
+If syntax check fails, fix the issue before proceeding.
+
+## 3. ShellCheck
+
+Run `shellcheck <file>`. The project `.shellcheckrc` already disables SC2039, SC2166, SC2154, SC1091, SC2174, SC2016. Only report and fix warnings that are NOT in that exclude list.
+
+## Key files to never validate (not shell scripts)
+
+- `local/bin/fzf-tmux` (vendor file)
+- `*.md` files
+- `*.bats` test files (Bats, not plain shell)

.github/workflows/linters.yml

@@ -31,9 +31,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Yarn Lock Changes
-        uses: Simek/yarn-lock-changes@c7543145aaafdd8fc925cea5d85b2bd5a73091f8 # v0.14.0
+        uses: Simek/yarn-lock-changes@59f47ee499424d2c2437c5aebf863b5c6d50a5bc # v0.14.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run PR Lint
-        uses: ivuorinen/actions/pr-lint@f371da218e9152e7d29ee39358454e41010c36dc # v2026.02.03
+        uses: ivuorinen/actions/pr-lint@c40f80e9c569f700ce5275766dcfeba99c168899 # v2026.02.10

.github/workflows/sync-labels.yml

@@ -30,4 +30,4 @@ jobs:
       issues: write
 
     steps:
-      - uses: ivuorinen/actions/sync-labels@f371da218e9152e7d29ee39358454e41010c36dc # v2026.02.03
+      - uses: ivuorinen/actions/sync-labels@c40f80e9c569f700ce5275766dcfeba99c168899 # v2026.02.10

.nvmrc

@@ -1 +1 @@
-24.13.0
+24.13.1

.pre-commit-config.yaml

@@ -59,7 +59,7 @@ repos:
         args: [-i, "2", -bn, -ci, -sr, -fn, -w]
 
   - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.10
+    rev: v1.7.11
     hooks:
       - id: actionlint
 
@@ -76,7 +76,7 @@ repos:
       - id: fish_indent
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.15.0
+    rev: v0.15.1
     hooks:
       - id: ruff-check
         args: [--fix]

.python-version

@@ -1 +1 @@
-3.14.2
+3.14.3

CLAUDE.md

@@ -34,6 +34,8 @@ yarn install
 yarn lint              # Run biome + prettier + editorconfig-checker
 yarn lint:biome        # Biome only
 yarn lint:ec           # EditorConfig checker only
+yarn lint:md-table     # Markdown table formatting check
+yarn fix:md-table      # Auto-fix markdown tables
 
 # Formatting
 yarn fix:biome         # Autofix with biome (JS/TS/JSON/MD)
@@ -74,12 +76,24 @@ which loads:
 Zsh additionally uses **antidote** (in `tools/antidote/`)
 for plugin management and **oh-my-posh** for the prompt.
 
+### msgr — Messaging Helper
+
+`local/bin/msgr` provides colored output functions (`msgr msg`,
+`msgr run`, `msgr yay`, `msgr err`, `msgr warn`). Sourced by `dfm`
+and most scripts in `local/bin/`.
+
 ### dfm — Dotfiles Manager
 
 `local/bin/dfm` is the main management script. Key commands:
-- `dfm install all` — install everything (called during `./install`)
+- `dfm install all` — install everything in tiered stages
 - `dfm brew install` / `dfm brew update` — Homebrew management
+- `dfm apt upkeep` — APT package maintenance (Debian/Ubuntu)
+- `dfm dotfiles fmt` / `dfm dotfiles shfmt` — format configs/scripts
+- `dfm helpers <name>` — inspect aliases, colors, env, functions, path
 - `dfm docs all` — regenerate documentation under `docs/`
+- `dfm check arch` / `dfm check host` — system info
+- `dfm scripts` — run scripts from `scripts/` (discovered via `@description` tags)
+- `dfm tests` — test visualization helpers
 
 ### Submodules
 
@@ -118,6 +132,26 @@ SC2039 (POSIX `local`), SC2166 (`-o` in test),
 SC2154 (unassigned variables), SC1091 (source following),
 SC2174 (mkdir -p -m), SC2016 (single-quote expressions).
 
+## Gotchas
+
+- **POSIX scripts**: `x-ssh-audit`, `x-codeql`, `x-until-error`,
+  `x-until-success`, `x-ssl-expiry-date` use `/bin/sh`.
+  Validate with `sh -n`, not `bash -n`.
+- **Vendor file**: `local/bin/fzf-tmux` is vendored from
+  junegunn/fzf — do not modify.
+- **Fish config**: `config/fish/` has its own config chain
+  (`config.fish`, `exports.fish`, `alias.fish`) plus 80+ functions.
+- **Python**: Two scripts (`x-compare-versions.py`,
+  `x-git-largest-files.py`) linted by Ruff (config in `pyproject.toml`).
+
+## Claude Code Configuration
+
+- **Hooks** (`.claude/settings.json`):
+  - *PreToolUse*: Blocks edits to `fzf-tmux`, `yarn.lock`, `.yarn/`
+  - *PostToolUse*: Auto-runs `shfmt` on shell scripts after Edit/Write
+- **Skills** (`.claude/skills/`):
+  - `shell-validate`: Auto-validates shell scripts (syntax + shellcheck)
+
 ## Package Manager
 
 Yarn (v4.12.0) is the package manager. Do not use npm.

config/exports

@@ -4,15 +4,15 @@
 
 # Set XDG directories if not already set
 # https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
-[ -z "$XDG_CONFIG_HOME" ] && export XDG_CONFIG_HOME="$HOME/.config"
+[ -z "${XDG_CONFIG_HOME:-}" ] && export XDG_CONFIG_HOME="$HOME/.config"
-[ -z "$XDG_DATA_HOME" ] && export XDG_DATA_HOME="$HOME/.local/share"
+[ -z "${XDG_DATA_HOME:-}" ] && export XDG_DATA_HOME="$HOME/.local/share"
-[ -z "$XDG_CACHE_HOME" ] && export XDG_CACHE_HOME="$HOME/.cache"
+[ -z "${XDG_CACHE_HOME:-}" ] && export XDG_CACHE_HOME="$HOME/.cache"
-[ -z "$XDG_STATE_HOME" ] && export XDG_STATE_HOME="$HOME/.local/state"
+[ -z "${XDG_STATE_HOME:-}" ] && export XDG_STATE_HOME="$HOME/.local/state"
-[ -z "$XDG_BIN_HOME" ] && export XDG_BIN_HOME="$HOME/.local/bin"
+[ -z "${XDG_BIN_HOME:-}" ] && export XDG_BIN_HOME="$HOME/.local/bin"
-[ -z "$XDG_RUNTIME_DIR" ] && export XDG_RUNTIME_DIR="$HOME/.local/run"
+[ -z "${XDG_RUNTIME_DIR:-}" ] && export XDG_RUNTIME_DIR="$HOME/.local/run"
 
 # if DOTFILES is not set, set it to the default location
-[ -z "$DOTFILES" ] && export DOTFILES="$HOME/.dotfiles"
+[ -z "${DOTFILES:-}" ] && export DOTFILES="$HOME/.dotfiles"
 
 export PATH="$XDG_BIN_HOME:$DOTFILES/local/bin:$XDG_DATA_HOME/bob/nvim-bin:$XDG_DATA_HOME/cargo/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
 
@@ -448,9 +448,9 @@ export ZSHZ_DATA="$XDG_STATE_HOME/z"
 export CHEAT_USE_FZF=true
 export SQLITE_HISTORY="${XDG_CACHE_HOME}/sqlite_history"
 
-[ -f "$XDG_CONFIG_HOME/exports-secret" ] && source "$XDG_CONFIG_HOME/exports-secret"
+if [ -f "$XDG_CONFIG_HOME/exports-secret" ]; then source "$XDG_CONFIG_HOME/exports-secret"; fi
-[ -f "$XDG_CONFIG_HOME/exports-local" ] && source "$XDG_CONFIG_HOME/exports-local"
+if [ -f "$XDG_CONFIG_HOME/exports-local" ]; then source "$XDG_CONFIG_HOME/exports-local"; fi
 # shellcheck source=./exports-lakka
-[ -f "$XDG_CONFIG_HOME/exports-$(hostname)" ] && source "$XDG_CONFIG_HOME/exports-$(hostname)"
+if [ -f "$XDG_CONFIG_HOME/exports-$(hostname)" ]; then source "$XDG_CONFIG_HOME/exports-$(hostname)"; fi
 # shellcheck source=./exports-lakka-secret
-[ -f "$XDG_CONFIG_HOME/exports-$(hostname)-secret" ] && source "$XDG_CONFIG_HOME/exports-$(hostname)-secret"
+if [ -f "$XDG_CONFIG_HOME/exports-$(hostname)-secret" ]; then source "$XDG_CONFIG_HOME/exports-$(hostname)-secret"; fi

config/shared.sh

@@ -5,7 +5,7 @@
 # shellcheck shell=bash
 
 # Defaults
-[[ -z "$DOTFILES" ]] && export DOTFILES="$HOME/.dotfiles"
+[[ -z "${DOTFILES:-}" ]] && export DOTFILES="$HOME/.dotfiles"
 DOTFILES_CURRENT_SHELL=$(basename "$SHELL")
 export DOTFILES_CURRENT_SHELL
 
@@ -76,9 +76,9 @@ x-path-prepend "$DOTFILES/local/bin"
 x-path-prepend "$XDG_BIN_HOME"
 
 # Custom completion paths
-[[ -z "$ZSH_CUSTOM_COMPLETION_PATH" ]] && export ZSH_CUSTOM_COMPLETION_PATH="$XDG_CONFIG_HOME/zsh/completion"
+[[ -z "${ZSH_CUSTOM_COMPLETION_PATH:-}" ]] && export ZSH_CUSTOM_COMPLETION_PATH="$XDG_CONFIG_HOME/zsh/completion"
 x-dc "$ZSH_CUSTOM_COMPLETION_PATH"
-export FPATH="$ZSH_CUSTOM_COMPLETION_PATH:$FPATH"
+export FPATH="$ZSH_CUSTOM_COMPLETION_PATH:${FPATH:-}"
 
 if ! declare -f msg > /dev/null; then
   # Function to print messages if VERBOSE is enabled

local/bin/dfm

@@ -12,6 +12,7 @@
 : "${DOTFILES:=$HOME/.dotfiles}"
 : "${BREWFILE:=$DOTFILES/config/homebrew/Brewfile}"
 : "${HOSTFILES:=$DOTFILES/hosts}"
+export DOTFILES BREWFILE HOSTFILES
 
 SCRIPT=$(basename "$0")
 
@@ -71,33 +72,57 @@ section_install()
 
   MENU=(
     "all:Installs everything in the correct order"
+    "apt-packages:Install apt packages (Debian/Ubuntu)"
     "cargo:Install rust/cargo packages"
     "cheat-databases:Install cheat external cheatsheet databases"
     "composer:Install composer"
+    "dnf-packages:Install dnf packages (Fedora/RHEL)"
     "fonts:Install programming fonts"
     "gh:Install GitHub CLI Extensions"
+    "git-crypt:Install git-crypt from source"
     "go:Install Go Packages"
     "imagick:Install ImageMagick CLI"
     "macos:Setup nice macOS defaults"
     "npm-packages:Install NPM Packages"
+    "ntfy:Install ntfy notification tool"
     "nvm-latest:Install latest lts node using nvm"
     "nvm:Install Node Version Manager (nvm)"
+    "python-packages:Install Python packages via uv"
+    "xcode-cli-tools:Install Xcode CLI tools (macOS)"
     "z:Install z"
   )
 
   case "$1" in
     all)
       msgr msg "Starting to install all and reloading configurations..."
-      $0 install macos
+
-      $0 install fonts
+      # Tier 0: Platform foundations (OS packages, build tools)
+      [[ "$(uname)" == "Darwin" ]] && $0 install macos
+      [[ "$(uname)" == "Darwin" ]] && $0 install xcode-cli-tools
+      command -v apt &> /dev/null && $0 install apt-packages
+      command -v dnf &> /dev/null && $0 install dnf-packages
+
+      # Tier 1: Package managers & fonts
       $0 brew install
+      $0 install fonts
+
+      # Tier 2: Language packages (depend on runtimes from Tier 1)
       $0 install cargo
       $0 install go
       $0 install composer
-      $0 install cheat-databases
       $0 install nvm
       $0 install npm-packages
+      $0 install python-packages
+
+      # Tier 3: Tool-dependent installers
+      $0 install cheat-databases
+      $0 install gh
+      $0 install git-crypt
+      $0 install ntfy
+
+      # Tier 4: Independent utilities
       $0 install z
+
       msgr msg "Reloading configurations again..."
       # shellcheck disable=SC1091
       source "$DOTFILES/config/shared.sh"
@@ -112,7 +137,7 @@ section_install()
 
     cheat-databases)
       msgr run "Installing cheat databases..."
-      for database in "$DOTFILES"/scripts/install-cheat-*; do
+      for database in "$DOTFILES"/scripts/install-cheat-*.sh; do
         bash "$database" \
           && msgr run_done "Cheat: $database run"
       done
@@ -184,6 +209,42 @@ section_install()
         && msgr yay "NPM Packages have been installed!"
       ;;
 
+    apt-packages)
+      msgr run "Installing apt packages..."
+      bash "$DOTFILES/scripts/install-apt-packages.sh" \
+        && msgr yay "apt packages installed!"
+      ;;
+
+    dnf-packages)
+      msgr run "Installing dnf packages..."
+      bash "$DOTFILES/scripts/install-dnf-packages.sh" \
+        && msgr yay "dnf packages installed!"
+      ;;
+
+    git-crypt)
+      msgr run "Installing git-crypt..."
+      bash "$DOTFILES/scripts/install-git-crypt.sh" \
+        && msgr yay "git-crypt installed!"
+      ;;
+
+    ntfy)
+      msgr run "Installing ntfy..."
+      bash "$DOTFILES/scripts/install-ntfy.sh" \
+        && msgr yay "ntfy installed!"
+      ;;
+
+    python-packages)
+      msgr run "Installing Python packages..."
+      bash "$DOTFILES/scripts/install-python-packages.sh" \
+        && msgr yay "Python packages installed!"
+      ;;
+
+    xcode-cli-tools)
+      msgr run "Installing Xcode CLI tools..."
+      bash "$DOTFILES/scripts/install-xcode-cli-tools.sh" \
+        && msgr yay "Xcode CLI tools installed!"
+      ;;
+
     z)
       msgr run "Installing z..."
       bash "$DOTFILES/scripts/install-z.sh" \

tests/dfm.bats

@@ -5,8 +5,141 @@ setup()
   export DOTFILES="$PWD"
 }
 
+# ── Group 1: Main help & routing ──────────────────────────────
+
 @test "dfm help shows usage" {
   run bash local/bin/dfm help
   [ "$status" -eq 0 ]
   [[ "$output" == *"Usage: dfm"* ]]
 }
+
+@test "dfm with no args shows full usage with all sections" {
+  run bash local/bin/dfm
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Usage: dfm"* ]]
+  [[ "$output" == *"dfm install"* ]]
+  [[ "$output" == *"dfm check"* ]]
+  [[ "$output" == *"dfm helpers"* ]]
+  [[ "$output" == *"dfm docs"* ]]
+  [[ "$output" == *"dfm dotfiles"* ]]
+  [[ "$output" == *"dfm scripts"* ]]
+}
+
+@test "dfm with invalid section shows usage" {
+  run bash local/bin/dfm nonexistent
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Usage: dfm"* ]]
+}
+
+# ── Group 2: Install menu completeness ────────────────────────
+
+@test "dfm install menu shows all entries" {
+  run bash local/bin/dfm install
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"all"* ]]
+  [[ "$output" == *"apt-packages"* ]]
+  [[ "$output" == *"cargo"* ]]
+  [[ "$output" == *"cheat-databases"* ]]
+  [[ "$output" == *"composer"* ]]
+  [[ "$output" == *"dnf-packages"* ]]
+  [[ "$output" == *"fonts"* ]]
+  [[ "$output" == *"gh"* ]]
+  [[ "$output" == *"git-crypt"* ]]
+  [[ "$output" == *"go"* ]]
+  [[ "$output" == *"imagick"* ]]
+  [[ "$output" == *"macos"* ]]
+  [[ "$output" == *"npm-packages"* ]]
+  [[ "$output" == *"ntfy"* ]]
+  [[ "$output" == *"nvm-latest"* ]]
+  [[ "$output" == *"nvm"* ]]
+  [[ "$output" == *"python-packages"* ]]
+  [[ "$output" == *"xcode-cli-tools"* ]]
+  [[ "$output" == *"z"* ]]
+}
+
+@test "dfm install with invalid subcommand shows menu" {
+  run bash local/bin/dfm install nonexistent
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"dfm install"* ]]
+}
+
+# ── Group 3: Other section menus ──────────────────────────────
+
+@test "dfm helpers menu shows entries" {
+  run bash local/bin/dfm helpers
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"aliases"* ]]
+  [[ "$output" == *"colors"* ]]
+  [[ "$output" == *"path"* ]]
+  [[ "$output" == *"env"* ]]
+}
+
+@test "dfm docs menu shows entries" {
+  run bash local/bin/dfm docs
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"all"* ]]
+  [[ "$output" == *"tmux"* ]]
+  [[ "$output" == *"nvim"* ]]
+  [[ "$output" == *"wezterm"* ]]
+}
+
+@test "dfm dotfiles menu shows entries" {
+  run bash local/bin/dfm dotfiles
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"fmt"* ]]
+  [[ "$output" == *"shfmt"* ]]
+  [[ "$output" == *"yamlfmt"* ]]
+}
+
+@test "dfm check menu shows entries" {
+  run bash local/bin/dfm check
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"arch"* ]]
+  [[ "$output" == *"host"* ]]
+}
+
+@test "dfm scripts menu lists install scripts" {
+  run bash local/bin/dfm scripts
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"cargo-packages"* ]]
+  [[ "$output" == *"fonts"* ]]
+  [[ "$output" == *"z"* ]]
+}
+
+@test "dfm tests menu shows entries" {
+  run bash local/bin/dfm tests
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"msgr"* ]]
+  [[ "$output" == *"params"* ]]
+}
+
+# ── Group 4: Check commands ───────────────────────────────────
+
+@test "dfm check arch returns current arch" {
+  run bash local/bin/dfm check arch
+  [ "$status" -eq 0 ]
+  [ -n "$output" ]
+}
+
+@test "dfm check arch with matching value exits 0" {
+  local current_arch
+  current_arch="$(uname)"
+  run bash local/bin/dfm check arch "$current_arch"
+  [ "$status" -eq 0 ]
+}
+
+@test "dfm check arch with non-matching value exits 1" {
+  run bash local/bin/dfm check arch FakeArch
+  [ "$status" -eq 1 ]
+}
+
+@test "dfm check host returns current hostname" {
+  run bash local/bin/dfm check host
+  [ "$status" -eq 0 ]
+  [ -n "$output" ]
+}
+
+@test "dfm check host with non-matching value exits 1" {
+  run bash local/bin/dfm check host fakehostname
+  [ "$status" -eq 1 ]
+}

yarn.lock

@@ -6,17 +6,17 @@ __metadata:
   cacheKey: 10c0
 
 "@biomejs/biome@npm:^2.3.1":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/biome@npm:2.3.11"
+  resolution: "@biomejs/biome@npm:2.4.0"
   dependencies:
-    "@biomejs/cli-darwin-arm64": "npm:2.3.11"
+    "@biomejs/cli-darwin-arm64": "npm:2.4.0"
-    "@biomejs/cli-darwin-x64": "npm:2.3.11"
+    "@biomejs/cli-darwin-x64": "npm:2.4.0"
-    "@biomejs/cli-linux-arm64": "npm:2.3.11"
+    "@biomejs/cli-linux-arm64": "npm:2.4.0"
-    "@biomejs/cli-linux-arm64-musl": "npm:2.3.11"
+    "@biomejs/cli-linux-arm64-musl": "npm:2.4.0"
-    "@biomejs/cli-linux-x64": "npm:2.3.11"
+    "@biomejs/cli-linux-x64": "npm:2.4.0"
-    "@biomejs/cli-linux-x64-musl": "npm:2.3.11"
+    "@biomejs/cli-linux-x64-musl": "npm:2.4.0"
-    "@biomejs/cli-win32-arm64": "npm:2.3.11"
+    "@biomejs/cli-win32-arm64": "npm:2.4.0"
-    "@biomejs/cli-win32-x64": "npm:2.3.11"
+    "@biomejs/cli-win32-x64": "npm:2.4.0"
   dependenciesMeta:
     "@biomejs/cli-darwin-arm64":
       optional: true
@@ -36,88 +36,88 @@ __metadata:
       optional: true
   bin:
     biome: bin/biome
-  checksum: 10c0/b9764070c3d1583466a8861d37dc480c18103f7bb52115db0f265a38e6343d69792c9beea094e0b3db0905cb365b9a82ad2a0f3f05b7f04873a8f9b444263140
+  checksum: 10c0/c10de983720ac20df56755f42f48b2b56fcc1082d364193f1410d07b62c4b7c3437abdbc9cfd60f2a65cd0f3baa7abf8d09a85cd6962b1363f77034e877c13b3
   languageName: node
   linkType: hard
 
-"@biomejs/cli-darwin-arm64@npm:2.3.11":
+"@biomejs/cli-darwin-arm64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-darwin-arm64@npm:2.3.11"
+  resolution: "@biomejs/cli-darwin-arm64@npm:2.4.0"
   conditions: os=darwin & cpu=arm64
   languageName: node
   linkType: hard
 
-"@biomejs/cli-darwin-x64@npm:2.3.11":
+"@biomejs/cli-darwin-x64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-darwin-x64@npm:2.3.11"
+  resolution: "@biomejs/cli-darwin-x64@npm:2.4.0"
   conditions: os=darwin & cpu=x64
   languageName: node
   linkType: hard
 
-"@biomejs/cli-linux-arm64-musl@npm:2.3.11":
+"@biomejs/cli-linux-arm64-musl@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-linux-arm64-musl@npm:2.3.11"
+  resolution: "@biomejs/cli-linux-arm64-musl@npm:2.4.0"
   conditions: os=linux & cpu=arm64 & libc=musl
   languageName: node
   linkType: hard
 
-"@biomejs/cli-linux-arm64@npm:2.3.11":
+"@biomejs/cli-linux-arm64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-linux-arm64@npm:2.3.11"
+  resolution: "@biomejs/cli-linux-arm64@npm:2.4.0"
   conditions: os=linux & cpu=arm64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@biomejs/cli-linux-x64-musl@npm:2.3.11":
+"@biomejs/cli-linux-x64-musl@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-linux-x64-musl@npm:2.3.11"
+  resolution: "@biomejs/cli-linux-x64-musl@npm:2.4.0"
   conditions: os=linux & cpu=x64 & libc=musl
   languageName: node
   linkType: hard
 
-"@biomejs/cli-linux-x64@npm:2.3.11":
+"@biomejs/cli-linux-x64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-linux-x64@npm:2.3.11"
+  resolution: "@biomejs/cli-linux-x64@npm:2.4.0"
   conditions: os=linux & cpu=x64 & libc=glibc
   languageName: node
   linkType: hard
 
-"@biomejs/cli-win32-arm64@npm:2.3.11":
+"@biomejs/cli-win32-arm64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-win32-arm64@npm:2.3.11"
+  resolution: "@biomejs/cli-win32-arm64@npm:2.4.0"
   conditions: os=win32 & cpu=arm64
   languageName: node
   linkType: hard
 
-"@biomejs/cli-win32-x64@npm:2.3.11":
+"@biomejs/cli-win32-x64@npm:2.4.0":
-  version: 2.3.11
+  version: 2.4.0
-  resolution: "@biomejs/cli-win32-x64@npm:2.3.11"
+  resolution: "@biomejs/cli-win32-x64@npm:2.4.0"
   conditions: os=win32 & cpu=x64
   languageName: node
   linkType: hard
 
-"@isaacs/balanced-match@npm:^4.0.1":
+"@isaacs/cliui@npm:^9.0.0":
-  version: 4.0.1
+  version: 9.0.0
-  resolution: "@isaacs/balanced-match@npm:4.0.1"
+  resolution: "@isaacs/cliui@npm:9.0.0"
-  checksum: 10c0/7da011805b259ec5c955f01cee903da72ad97c5e6f01ca96197267d3f33103d5b2f8a1af192140f3aa64526c593c8d098ae366c2b11f7f17645d12387c2fd420
+  checksum: 10c0/971063b7296419f85053dacd0a0285dcadaa3dfc139228b23e016c1a9848121ad4aa5e7fcca7522062014e1eb6239a7424188b9f2cba893a79c90aae5710319c
-  languageName: node
-  linkType: hard
-
-"@isaacs/brace-expansion@npm:^5.0.1":
-  version: 5.0.1
-  resolution: "@isaacs/brace-expansion@npm:5.0.1"
-  dependencies:
-    "@isaacs/balanced-match": "npm:^4.0.1"
-  checksum: 10c0/e5d67c7bbf1f17b88132a35bc638af306d48acbb72810d48fa6e6edd8ab375854773108e8bf70f021f7ef6a8273455a6d1f0c3b5aa2aff06ce7894049ab77fb8
   languageName: node
   linkType: hard
 
 "@types/node@npm:^24.0.1":
-  version: 24.10.9
+  version: 24.10.13
-  resolution: "@types/node@npm:24.10.9"
+  resolution: "@types/node@npm:24.10.13"
   dependencies:
     undici-types: "npm:~7.16.0"
-  checksum: 10c0/e9e436fcd2136bddb1bbe3271a89f4653910bcf6ee8047c4117f544c7905a106c039e2720ee48f28505ef2560e22fb9ead719f28bf5e075fdde0c1120e38e3b2
+  checksum: 10c0/4ff0b9b060b5477c0fec5b11a176f294be588104ab546295db65b17a92ba0a6077b52ad92dd3c0d2154198c7f9d0021e6c1d42b00c9ac7ebfd85632afbcc48a4
+  languageName: node
+  linkType: hard
+
+"balanced-match@npm:^4.0.2":
+  version: 4.0.2
+  resolution: "balanced-match@npm:4.0.2"
+  dependencies:
+    jackspeak: "npm:^4.2.3"
+  checksum: 10c0/493eee4bece3f8b270cea8d3d6d1122ce008dd6b0d5aca8a3f1e623be6897be18c926018eadc454bd719bb7cc46d939c39fa2a05fff86b30f65382f020f6926d
   languageName: node
   linkType: hard
 
@@ -130,6 +130,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"brace-expansion@npm:^5.0.2":
+  version: 5.0.2
+  resolution: "brace-expansion@npm:5.0.2"
+  dependencies:
+    balanced-match: "npm:^4.0.2"
+  checksum: 10c0/60c765e5df6fc0ceca3d5703202ae6779db61f28ea3bf93a04dbf0d50c22ef8e4644e09d0459c827077cd2d09ba8f199a04d92c36419fcf874601a5565013174
+  languageName: node
+  linkType: hard
+
 "debug@npm:^4.3.4":
   version: 4.4.3
   resolution: "debug@npm:4.4.3"
@@ -185,13 +194,13 @@ __metadata:
   linkType: hard
 
 "glob@npm:^13.0.0":
-  version: 13.0.1
+  version: 13.0.3
-  resolution: "glob@npm:13.0.1"
+  resolution: "glob@npm:13.0.3"
   dependencies:
-    minimatch: "npm:^10.1.2"
+    minimatch: "npm:^10.2.0"
     minipass: "npm:^7.1.2"
     path-scurry: "npm:^2.0.0"
-  checksum: 10c0/af7b863dec8dff74f61d7d6e53104e1f6bbdd482157a196cade8ed857481e876ec35181b38a059b2a7b93ea3b08248f4ff0792fef6dc91814fd5097a716f48e4
+  checksum: 10c0/333dc5c40ca0e50400465d8f5c45aa7cdd32580c4d1a4c502dfb4fb9c469a936b8e0c6bbd09cd6353fd05982e48d7f79e819159a36fb3e0a41ee722607bc11a9
   languageName: node
   linkType: hard
 
@@ -216,6 +225,15 @@ __metadata:
   languageName: unknown
   linkType: soft
 
+"jackspeak@npm:^4.2.3":
+  version: 4.2.3
+  resolution: "jackspeak@npm:4.2.3"
+  dependencies:
+    "@isaacs/cliui": "npm:^9.0.0"
+  checksum: 10c0/b5c0c414f1607c2aa0597f4bf2c03b8443897fccd5fd3c2b3e4f77d556b2bc7c3d3413828ba91e0789f6fb40ad90242f7f89fb20aee9e9d705bc1681f7564f67
+  languageName: node
+  linkType: hard
+
 "jsonfile@npm:^6.0.1":
   version: 6.2.0
   resolution: "jsonfile@npm:6.2.0"
@@ -240,9 +258,9 @@ __metadata:
   linkType: hard
 
 "lru-cache@npm:^11.0.0":
-  version: 11.2.5
+  version: 11.2.6
-  resolution: "lru-cache@npm:11.2.5"
+  resolution: "lru-cache@npm:11.2.6"
-  checksum: 10c0/cc98958d25dddf1c8a8cbdc49588bd3b24450e8dfa78f32168fd188a20d4a0331c7406d0f3250c86a46619ee288056fd7a1195e8df56dc8a9592397f4fbd8e1d
+  checksum: 10c0/73bbffb298760e71b2bfe8ebc16a311c6a60ceddbba919cfedfd8635c2d125fbfb5a39b71818200e67973b11f8d59c5a9e31d6f90722e340e90393663a66e5cd
   languageName: node
   linkType: hard
 
@@ -271,12 +289,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimatch@npm:^10.1.2":
+"minimatch@npm:^10.2.0":
-  version: 10.1.2
+  version: 10.2.0
-  resolution: "minimatch@npm:10.1.2"
+  resolution: "minimatch@npm:10.2.0"
   dependencies:
-    "@isaacs/brace-expansion": "npm:^5.0.1"
+    brace-expansion: "npm:^5.0.2"
-  checksum: 10c0/0cccef3622201703de6ecf9d772c0be1d5513dcc038ed9feb866c20cf798243e678ac35605dac3f1a054650c28037486713fe9e9a34b184b9097959114daf086
+  checksum: 10c0/256e72812bb99a86cdc788bf46a4da3f6e139db9123e20ed85a6795b93fdc0b76468ac511eb5535a023adb02a53fd598f971e990d0ca3bd6de6d41ea0199def1
   languageName: node
   linkType: hard