[dependabot]

Bumps ultracite from 7.12.4 to 8.0.2.

Release notes

Sourced from ultracite's releases.

ultracite@8.0.2

Patch Changes

• 9f80955: Make ultracite fix --claude and --codex judge each retry by what the previous edit actually did. An issue that's still reported gets the old note asking for a structurally different approach, but one that only appeared after the edit is now handed back as new, with the agent told to build on the fix rather than undo it. Before, a correct ARIA button pattern that then tripped prefer-tag-over-role, or a correct <button> missing its type, was treated as a failed fix and thrown away. When an issue needs a person's decision, the agent now lists it at the end of its final message. Ultracite stops retrying it and shows the agent's explanation in the summary, where it used to be discarded. The handoff also gets three fixes. Biome's a11y rules now reach the agent with their help text and documentation link, which a pattern that didn't allow digits in a rule group had dropped. A path Oxlint has no files to lint, such as a Markdown file, no longer crashes the run. And Biome's internal errors, such as internalError/io for a file it can't write, are no longer handed to the agent as lint issues.
• 30e03ef: Give jsx-a11y/label-has-associated-control in ultracite/oxlint/react the options the ESLint react preset already sets: <Label> counts as a label, <Input>, <Select>, <Textarea>, <Checkbox> and <Radio> count as controls, and a control is found up to three levels deep. Oxlint used to miss a <Label> with no control, and flagged an <Input> inside a <label>, or an input nested three deep, as unlabelled. Biome's noLabelWithoutControl in ultracite/biome/core gets the same label and control components.
• 947ca03: Turn off promise/prefer-await-to-then in ultracite/oxlint/core and ultracite/eslint/core, and github/no-then in ultracite/oxlint/js-plugins and ultracite/eslint/core. Both rules match .then(), .catch() and .finally() by method name, without type information, so they flagged APIs that aren't promises, such as Zod's .catch() fallback. They also flagged a fire-and-forget promise given a .catch() handler. Oxlint closed the false positive as not planned. promise/always-return and promise/catch-or-return are now on in both presets, so an unhandled promise chain is still reported. In ESLint, unicorn/prefer-await moves to ultracite/eslint/type-aware, where it uses type information to skip calls that aren't on a promise. The test-file overrides that turned promise/prefer-await-to-then off in the jest and vitest presets are gone, since the rule is off everywhere.
• c198d06: Stop unicorn/no-useless-undefined in ultracite/oxlint/core from checking function call arguments. A required parameter typed string | undefined has to be passed undefined explicitly, but Oxlint flagged consume(undefined) and ultracite fix rewrote it to consume(), which TypeScript rejects with TS2554. The rule can't see parameter types, so it now runs with checkArguments: false. It still reports let value = undefined, return undefined and the rest of its checks. ultracite/eslint/core sets the same option. eslint-plugin-unicorn already skipped arguments in TypeScript files, and now skips them in JavaScript too. Biome's noUselessUndefined never checked arguments.

ultracite@8.0.1

Patch Changes

• 40d646a: ultracite fix --claude and --codex hand agents better information and report results more accurately:

  • Rule names reach the agent as they're written in the config, such as no-unused-vars and typescript/no-explicit-any, instead of Oxlint's eslint(no-unused-vars).
  • ESLint diagnostics now carry the rule's description and documentation URL, read with the json-with-metadata formatter. Biome diagnostics carry the rule's documentation URL and its description from biome explain, since Biome's JSON reporter includes no help text.
  • The prompt tells the agent that the run is non-interactive, so it explains a decision it can't make in its final message instead of asking a question and waiting for an answer that can't come.
  • Files are handed over in path order, so the same project gets its fix in the same file on every run. Before each file after the first, Ultracite lints it again: an earlier file's fix can clear its issues (breaking an import cycle fixes both files), and the agent was being handed diagnostics that no longer applied. A file with nothing left is skipped.
  • A file the agent deleted, or one that no longer parses, now counts as unfixed. Before, its issues could disappear from the report and show as fixed.

• 2543859: Update the vendored anti-slop Oxlint plugin to upstream commit 13909c9 and enable its three new rules in the ultracite/oxlint/anti-slop preset. require-readable-spacing restores blank lines around structural boundaries — top-level declarations, multiline bindings, control flow, returns, and blocks — a pattern AI-generated code tends to pack together, while consecutive single-line bindings stay grouped at any scope (dmmulroy/anti-slop#45). Its autofix only inserts whitespace and never removes existing blank lines, so ultracite fix restores the spacing without fighting the formatter. no-array-filter-map rejects adjacent eager filter/map passes over arrays, and no-reduce-accumulator-copy rejects reducers that copy their accumulator on every iteration. Expect a one-time whitespace-only diff from ultracite fix after upgrading if you extend the preset (#803).

• 0a671cc: On the ESLint toolchain, ultracite fix --hook no longer deletes an import an agent has just added. A post-edit hook runs between the agent's edits, so the import is unused until the code that uses it lands, and unused-imports/no-unused-imports removed it first. The hook run now turns that rule off, as the Biome hook already skips noUnusedImports (#483). no-unused-vars still reports the import if it stays unused.

• de08bd3: The ESLint core preset no longer configures a node resolver for import-x, which needed eslint-import-resolver-node, a package init never installed. The TypeScript resolver it keeps resolves JavaScript files too.

• c13e042: react/jsx-no-target-blank now checks forms as well as links (forms: true) in the Oxlint and ESLint React presets, as Biome's noBlankTarget already does. The rules file init writes for agents now says to add rel="noopener noreferrer" to target="_blank" links instead of rel="noopener", which Oxlint and ESLint report because it still sends the referrer. It also says to avoid import cycles again, which the Oxlint and ESLint core presets report.

• 9853406: The oxlint.config.ts that ultracite init writes now sets env: core.env. Oxlint doesn't carry env through extends, so the browser globals the core preset declares never reached projects, and rules that depend on them stayed quiet: no-implied-eval didn't report setTimeout("…") or setInterval("…"), and no-eval didn't report window.eval(…). Workspace configs written by init now repeat env: root.env alongside ignorePatterns and settings, and an .oxlintrc.json that init migrates keeps its env on top of core's. Re-run ultracite init to update an existing config, or add env: core.env to it yourself.

• 7984c6e: The Oxlint js-plugins preset now enables the 32 SonarJS rules that the ESLint core preset already runs without type information, including the security rules sonarjs/slow-regex, sonarjs/sql-queries, sonarjs/disabled-auto-escaping and sonarjs/dompurify-unsafe-config. SonarJS marks these rules requiresTypeChecking, but they also check the syntax tree, so they work through Oxlint's JS plugin bridge. The preset had left out every marked rule.

ultracite@8.0.0

Major Changes

• d0875c0: Every agent now reads Ultracite's rules from AGENTS.md. init writes the rules there once, whichever agents you pick, and only adds a file for the four agents that need one more step to see them:

  • Claude Code reads AGENTS.md only when the project has no CLAUDE.md, so init adds an @AGENTS.md import to the project's CLAUDE.md or .claude/CLAUDE.md when there is one.
  • Gemini CLI reads GEMINI.md by default, so init adds AGENTS.md to context.fileName in .gemini/settings.json, keeping GEMINI.md.
  • Aider gets .aider.conf.yml pointed at AGENTS.md, as before.
  • Replit Agent reads only replit.md, so it keeps a copy of the rules there.

  Firebender now reads AGENTS.md too. The init prompt asks which agents you use and lists AGENTS.md (Universal) plus those four.

  Projects set up by earlier versions move over the next time init runs: it takes Ultracite's block out of .claude/CLAUDE.md, GEMINI.md, .firebender/rules/ultracite.mdc and Aider's ultracite.md, removes a file left with nothing else in it, and adds the import or settings that agent needs. That happens whenever one of those files still holds the rules, whichever agents you pick, since a leftover .claude/CLAUDE.md stops Claude Code from reading AGENTS.md.

  A CLAUDE.md, GEMINI.md or replit.md that is a symbolic link to AGENTS.md, or that AGENTS.md links to, already gives that agent the rules, so init leaves it as it is. init never writes through or removes a symbolic link to another file; it prints what to add to that file instead.

• 3ee5b8c: Aider now loads Ultracite's rules and lints each file it edits. Aider reads no instructions file on its own, so the ultracite.md that init --agents aider used to write was never loaded. Now init writes the rules to AGENTS.md and merges two keys into .aider.conf.yml: read: AGENTS.md, and lint-cmd set to the project's ultracite fix, which Aider runs on every file it edits, asking the model to fix whatever is left. The rest of the file, comments included, stays as written, a lint-cmd that runs another linter is left alone, and an ultracite.md that holds nothing but the rules is removed. Aider keeps its own option in the init prompt, since the universal AGENTS.md option doesn't write .aider.conf.yml.

  The agent list also uses the current names for Deep Agents, goose and Gemini CLI. Their --agents IDs don't change.

• f4c8a32: Make every rule in the Biome core preset an error. noSuspiciousSemicolonInJsx came from Biome's recommended set at warning level, so ultracite check passed with it unless the React preset was on. It and the two other rules core inherited from that set, noDuplicateJsxProps and noVoidElementsWithChildren, are now set to error explicitly.

• ed5ed04: compat/compat is now an error in the ESLint core preset. It was the last warning-level rule in any preset, so ultracite check passed while it reported browser APIs your browserslist targets don't support. Set your targets in a browserslist key in package.json or a .browserslistrc file, or turn the rule off in your config if the project only runs on a server.

  A project that sets no targets is now checked against Baseline Widely available browsers (baseline widely available). eslint-plugin-compat used browserslist's defaults there, which include Opera Mini and Chrome 109, so fetch, URL and Array#toSorted() failed in almost every project. Ultracite only sets these targets when it finds no browserslist config from the directory ESLint runs in and no BROWSERSLIST environment variable, since the plugin would add them to your own targets rather than replace them. In a monorepo that sets targets only in its packages, add them at the root too, or set settings.browsers yourself.

• 16fa476: Lint the scripts in Vue, Svelte and Astro components with the ESLint core rules. Core's globs only matched .js and .ts files, so a .vue file got only the Vue rules, a .svelte file only the Svelte rules, and an .astro file's frontmatter only the Astro rules, while Oxlint already runs its core rules on those scripts. The vue, svelte and astro presets now apply core's rules to their components, including the TypeScript rules, with the type-checked ones off because a script block isn't part of a tsconfig.

  • Components now get core's filename rule like any other file, as on Oxlint, so a PascalCase component such as TaskList.vue is reported. SvelteKit route files (+page.svelte) are exempt, and Astro and Nuxt pages ([slug].astro, [id].vue) get the same route-aware pattern as other pages/ files, on ESLint and in Oxlint's JS plugins.

... (truncated)

Commits

• 2077efd Version Packages (#852)
• 947ca03 Turn off name-only promise chain rules
• c198d06 Skip call arguments in no-useless-undefined
• a1da2b9 Escape pipes in sort-keys table code spans safely
• c95c3f2 Publish the sort-keys research post
• f8960ac Publish the TODO comments research post
• a74ed7a Remove the video package (#853)
• 3efbc33 Mirror the new agent-fix retry loop in the research harness
• da6f772 Say which presets carry the accessibility rules
• 30e03ef Give Oxlint and Biome the label components ESLint already uses
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: da9dce6b-fb2f-4368-9164-6c102621beb7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in d8d0fc2...43a4805 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Nov 1, 2026 3:41a.m.	Review ↗
Go		Nov 1, 2026 3:41a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.