[dependabot]

Bumps ultracite from 7.12.4 to 8.0.1.

Release notes

Sourced from ultracite's releases.

ultracite@8.0.1

Patch Changes

• 40d646a: ultracite fix --claude and --codex hand agents better information and report results more accurately:

  • Rule names reach the agent as they're written in the config, such as no-unused-vars and typescript/no-explicit-any, instead of Oxlint's eslint(no-unused-vars).
  • ESLint diagnostics now carry the rule's description and documentation URL, read with the json-with-metadata formatter. Biome diagnostics carry the rule's documentation URL and its description from biome explain, since Biome's JSON reporter includes no help text.
  • The prompt tells the agent that the run is non-interactive, so it explains a decision it can't make in its final message instead of asking a question and waiting for an answer that can't come.
  • Files are handed over in path order, so the same project gets its fix in the same file on every run. Before each file after the first, Ultracite lints it again: an earlier file's fix can clear its issues (breaking an import cycle fixes both files), and the agent was being handed diagnostics that no longer applied. A file with nothing left is skipped.
  • A file the agent deleted, or one that no longer parses, now counts as unfixed. Before, its issues could disappear from the report and show as fixed.

• 2543859: Update the vendored anti-slop Oxlint plugin to upstream commit 13909c9 and enable its three new rules in the ultracite/oxlint/anti-slop preset. require-readable-spacing restores blank lines around structural boundaries — top-level declarations, multiline bindings, control flow, returns, and blocks — a pattern AI-generated code tends to pack together, while consecutive single-line bindings stay grouped at any scope (dmmulroy/anti-slop#45). Its autofix only inserts whitespace and never removes existing blank lines, so ultracite fix restores the spacing without fighting the formatter. no-array-filter-map rejects adjacent eager filter/map passes over arrays, and no-reduce-accumulator-copy rejects reducers that copy their accumulator on every iteration. Expect a one-time whitespace-only diff from ultracite fix after upgrading if you extend the preset (#803).

• 0a671cc: On the ESLint toolchain, ultracite fix --hook no longer deletes an import an agent has just added. A post-edit hook runs between the agent's edits, so the import is unused until the code that uses it lands, and unused-imports/no-unused-imports removed it first. The hook run now turns that rule off, as the Biome hook already skips noUnusedImports (#483). no-unused-vars still reports the import if it stays unused.

• de08bd3: The ESLint core preset no longer configures a node resolver for import-x, which needed eslint-import-resolver-node, a package init never installed. The TypeScript resolver it keeps resolves JavaScript files too.

• c13e042: react/jsx-no-target-blank now checks forms as well as links (forms: true) in the Oxlint and ESLint React presets, as Biome's noBlankTarget already does. The rules file init writes for agents now says to add rel="noopener noreferrer" to target="_blank" links instead of rel="noopener", which Oxlint and ESLint report because it still sends the referrer. It also says to avoid import cycles again, which the Oxlint and ESLint core presets report.

• 9853406: The oxlint.config.ts that ultracite init writes now sets env: core.env. Oxlint doesn't carry env through extends, so the browser globals the core preset declares never reached projects, and rules that depend on them stayed quiet: no-implied-eval didn't report setTimeout("…") or setInterval("…"), and no-eval didn't report window.eval(…). Workspace configs written by init now repeat env: root.env alongside ignorePatterns and settings, and an .oxlintrc.json that init migrates keeps its env on top of core's. Re-run ultracite init to update an existing config, or add env: core.env to it yourself.

• 7984c6e: The Oxlint js-plugins preset now enables the 32 SonarJS rules that the ESLint core preset already runs without type information, including the security rules sonarjs/slow-regex, sonarjs/sql-queries, sonarjs/disabled-auto-escaping and sonarjs/dompurify-unsafe-config. SonarJS marks these rules requiresTypeChecking, but they also check the syntax tree, so they work through Oxlint's JS plugin bridge. The preset had left out every marked rule.

ultracite@8.0.0

Major Changes

• d0875c0: Every agent now reads Ultracite's rules from AGENTS.md. init writes the rules there once, whichever agents you pick, and only adds a file for the four agents that need one more step to see them:

  • Claude Code reads AGENTS.md only when the project has no CLAUDE.md, so init adds an @AGENTS.md import to the project's CLAUDE.md or .claude/CLAUDE.md when there is one.
  • Gemini CLI reads GEMINI.md by default, so init adds AGENTS.md to context.fileName in .gemini/settings.json, keeping GEMINI.md.
  • Aider gets .aider.conf.yml pointed at AGENTS.md, as before.
  • Replit Agent reads only replit.md, so it keeps a copy of the rules there.

  Firebender now reads AGENTS.md too. The init prompt asks which agents you use and lists AGENTS.md (Universal) plus those four.

  Projects set up by earlier versions move over the next time init runs: it takes Ultracite's block out of .claude/CLAUDE.md, GEMINI.md, .firebender/rules/ultracite.mdc and Aider's ultracite.md, removes a file left with nothing else in it, and adds the import or settings that agent needs. That happens whenever one of those files still holds the rules, whichever agents you pick, since a leftover .claude/CLAUDE.md stops Claude Code from reading AGENTS.md.

  A CLAUDE.md, GEMINI.md or replit.md that is a symbolic link to AGENTS.md, or that AGENTS.md links to, already gives that agent the rules, so init leaves it as it is. init never writes through or removes a symbolic link to another file; it prints what to add to that file instead.

• 3ee5b8c: Aider now loads Ultracite's rules and lints each file it edits. Aider reads no instructions file on its own, so the ultracite.md that init --agents aider used to write was never loaded. Now init writes the rules to AGENTS.md and merges two keys into .aider.conf.yml: read: AGENTS.md, and lint-cmd set to the project's ultracite fix, which Aider runs on every file it edits, asking the model to fix whatever is left. The rest of the file, comments included, stays as written, a lint-cmd that runs another linter is left alone, and an ultracite.md that holds nothing but the rules is removed. Aider keeps its own option in the init prompt, since the universal AGENTS.md option doesn't write .aider.conf.yml.

  The agent list also uses the current names for Deep Agents, goose and Gemini CLI. Their --agents IDs don't change.

• f4c8a32: Make every rule in the Biome core preset an error. noSuspiciousSemicolonInJsx came from Biome's recommended set at warning level, so ultracite check passed with it unless the React preset was on. It and the two other rules core inherited from that set, noDuplicateJsxProps and noVoidElementsWithChildren, are now set to error explicitly.

• ed5ed04: compat/compat is now an error in the ESLint core preset. It was the last warning-level rule in any preset, so ultracite check passed while it reported browser APIs your browserslist targets don't support. Set your targets in a browserslist key in package.json or a .browserslistrc file, or turn the rule off in your config if the project only runs on a server.

  A project that sets no targets is now checked against Baseline Widely available browsers (baseline widely available). eslint-plugin-compat used browserslist's defaults there, which include Opera Mini and Chrome 109, so fetch, URL and Array#toSorted() failed in almost every project. Ultracite only sets these targets when it finds no browserslist config from the directory ESLint runs in and no BROWSERSLIST environment variable, since the plugin would add them to your own targets rather than replace them. In a monorepo that sets targets only in its packages, add them at the root too, or set settings.browsers yourself.

• 16fa476: Lint the scripts in Vue, Svelte and Astro components with the ESLint core rules. Core's globs only matched .js and .ts files, so a .vue file got only the Vue rules, a .svelte file only the Svelte rules, and an .astro file's frontmatter only the Astro rules, while Oxlint already runs its core rules on those scripts. The vue, svelte and astro presets now apply core's rules to their components, including the TypeScript rules, with the type-checked ones off because a script block isn't part of a tsconfig.

  • Components now get core's filename rule like any other file, as on Oxlint, so a PascalCase component such as TaskList.vue is reported. SvelteKit route files (+page.svelte) are exempt, and Astro and Nuxt pages ([slug].astro, [id].vue) get the same route-aware pattern as other pages/ files, on ESLint and in Oxlint's JS plugins.
  • In Svelte components and rune modules, prefer-const, unicorn/no-top-level-assignment-in-function and sonarjs/declarations-in-global-scope are off: svelte/prefer-const replaces the first, and the other two misread $props() and $state in a component's scope. SvelteKit's PageProps and LayoutProps, and Astro's Props, are allowed by unicorn/name-replacements.

• ed5ed04: Cypress and Storybook rules move out of the ESLint core preset into opt-in framework presets, ultracite/eslint/cypress and ultracite/eslint/storybook. Core loaded both plugins for every project, so init installed eslint-plugin-cypress, eslint-plugin-storybook and the whole storybook package for every ESLint setup, whether or not the project used them.

  init now offers cypress and storybook with the other frameworks (--frameworks cypress storybook). It preselects them when cypress or storybook is in package.json, and installs their plugins only when you pick them. To keep linting Cypress specs and stories, add the presets to eslint.config.mjs after core:

  import core from "ultracite/eslint/core";
  import cypress from "ultracite/eslint/cypress";

... (truncated)

Commits

• 367d908 Version Packages (#849)
• 2543859 Update the vendored anti-slop plugin and enable require-readable-spacing (#811)
• ac533c7 Bump turbo to 2.11.8
• e9c264b Give each research post a share card with its own description
• 7f71068 Color the share cards like the homepage call to action
• 8f6d546 Keep a bare bun test out of research and tmp
• 4ea170b Document restriction rules, cycle reports and unused exports
• de08bd3 Drop the uninstalled node resolver from the ESLint core preset
• c13e042 Check forms for target="_blank" and fix the agent rules on it
• 7984c6e Run sonarjs's syntactic rules in Oxlint js-plugins and fix the parity check
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 09b7a6b4-f091-4467-9773-bce378138ecd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in a8049e0...76570d3 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Oct 25, 2026 4:43a.m.	Review ↗
Go		Oct 25, 2026 4:43a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.