chore(deps): update dependency knip to v6

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
knip (source)	^5.85.0 → ^6.21.0

---

Release Notes

webpro-nl/knip (knip)

v6.21.0: Release 6.21.0

Compare Source

• Detect Vite config dependencies (resolve #​1721) (8754c43)
• fix: Update timerifyMethods to include resolveFromAST (#​1814) (3c8deac) - thanks @​gwagjiug!
• Fix crash on null root export in package.json (resolve #​1815) (9b8af2b)
• Fix unresolved subpath imports with a colon prefix (resolve #​1816) (f89db41)
• Detect Next.js entry files in subdirectory (resolve #​1817) (f32c6ea)

v6.20.0: Release 6.20.0

Compare Source

• Add raw transfer opt-out (resolve #​1813) (6f08c68)
• Fix cached plugin config cycles (resolve #​1811) (2bc2f24)

v6.19.0: Release 6.19.0

Compare Source

• feat: support new optional sveltekit config pattern via vite config (#​1810) (3fee8bf) - thanks @​fubits1!
• Optimize hot path string scanning (e30cfe7)
• Update astro snapshot (71e71a7)

v6.18.0: Release 6.18.0

Compare Source

• Update dependencies (pin oxc-resolver) (7dda4ec)
• Resolve tsconfig paths for non-TS importers independent of oxc ownership (3b71565)
• Format (64865f8)
• Fix false positive for Vitest mocks (#​1802) (ec93e20) - thanks @​remcohaszing!
• Mark npx-run binaries optional unless --no-install (resolve #​1803) (203c31e)
• Ignore pnpm [WARN] lines in ecosystem snapshots (392835a)
• Update slonik snapshot (62d802b)
• Update Jest entry patterns for Jest 30 (#​1808) (d2caedd) - thanks @​gwagjiug!
• Report stale workspaces configuration keys as configuration hints (#​1807) (9083c16) - thanks @​WooWan!

v6.17.2: Release 6.17.2

Compare Source

• Fix up jest plugin (63dbd65)
• Detect coverage provider from bare vitest --coverage flag (#​1800) (dc11d9f) - thanks @​WooWan!
• Don't disable configuration hints in workspace-scoped runs (#​1791) (8ce1ec8) - thanks @​WooWan!
• Detect react-email v6 packages from non-numeric version ranges (resolve #​1798) (27a1cae)
• Discover workspaces included after a negated pattern (resolve #​1797) (630e152)

v6.17.1: Release 6.17.1

Compare Source

• Remove ignoreBinaries w/ tar (b13d0ca)
• Wrap up docs/refs (29f3e46)
• Update dependencies (7b2f345)
• Fix up vscode-languageclient imports (820c233)

v6.17.0: Release 6.17.0

Compare Source

• chore(mcp): add package metadata links (#​1783) (e3d93b9) - thanks @​sh962214-hub!
• fix(capacitor): detect iOS platform with Swift Package Manager (#​1787) (e6cc533) - thanks @​jthrilly!
• Support ignoreIssues per workspace (resolve #​1782) (15a329a)
• Add commitlint.config.mts (resolve #​1784) (fa8eb6d)
• Treat scoped and tilde SCSS imports as packages (resolve #​1786) (98aa962)
• Add followCursor setting for Imports/Exports views (resolve #​1788) (67a0be8)
• Flag undeclared sibling imports in published workspaces (resolve #​1792) (aeabff7)
• Fix type-check errors in vscode-knip (12f266e)
• Note Markdown formatting with pnpm remark (bdffeec)
• Bump some doc-related dependencies (3334193)
• Update vscode-knip tool descriptions (be34178)
• Overhaul docs (55e3f3b)
• Improve mcp guidance (67483f0)
• Fix repeated --fix-type arg (9bb0512)
• Resolve module paths from selected tsconfig (resolve #​1794) (1c2f398)
• Update sanity snapshot (4ebce9c)
• Add tar to globally ignored binaries (resolve #​1796) (8c028e5)

v6.16.1: Release 6.16.1

Compare Source

• Resolve SvelteKit ./$types in monorepos (resolve #​1778) (370ef4c)

v6.16.0: Release 6.16.0

Compare Source

• Update sponsors data + fix sponsors layout on narrow screen (fadf13a)
• Detect binaries and entry files in node:child_process calls (fc3598c)
• It works™ (2d9ce84)
• Extend known issues doc w/ workaround (close #​1763) (fcd444b)
• Support ignoreExportsUsedInFile per workspace (close #​1495) (4b898a9)
• feat(vscode): add workspaceRoot config option to enable use in a VSCode workspace that does not have package.json at the workspace root (#​1667) (7c1ebef) - thanks @​anmilleriii!
• Replace minimist with node:util.parseArgs (resolve #​1492) (b360c5c)
• Preserve minimist numeric coercion and --no-x negation (c12153c)
• Simplify parseArgs adapter (ba15e41)
• Detect and credit registered custom elements (resolve #​1394) (62dcda5)
• Add Lit and FAST plugins to detect @​customElement classes (348d2c9)
• Add new testimonials (77fd7ed)
• Scope custom path aliases per workspace (resolve #​1775) (d908099)
• Restructure tests (ec4c779)
• Simplify boolean check in parseArgs adapter (ba6865d)
• Scope static custom-element define detection to the FAST plugin (94632cd)
• Add Custom Elements feature docs page (230bd73)
• Update known-issues.md (f1f4c1b)
• Fix crash on backtick string literals in plugin config (resolve #​1776) (f1adc7f)
• Format (e4720ca)
• Fix backtick string literals in require() and plugin-name config arrays (#​1776) (d14eb05)
• Credit custom elements via aliases, scoped registries, and static blocks (d7cbe12)
• Improve Stencil plugin: credit @​Component and recognize test files (152d730)
• Add Catalyst plugin to credit bare @​controller custom elements (8a37f8c)
• Document Stencil, Catalyst, static-block custom el reg. (105fba3)
• Auto-format md (f4fcf4e)

v6.15.0: Release 6.15.0

Compare Source

• Report exported type used only in inferred-return function body (resolve #​1765) (2413408)
• Work that EXPORTS.md again (7e13451)
• Update npmx ecosystem snapshot (dfc4011)
• Link dependencies key with notes (closes #​1764) (e3e66ce)
• Resolve tsconfig paths when loading plugin configs (#​1762) (0177c74) - thanks @​jakeleventhal!
• Avoid caching failed plugin config loads (#​1768) (5e201cd) - thanks @​jakeleventhal!
• Resolve extensionless .sass imports in SCSS compiler (#​1770) (30c2283) - thanks @​sebacardello!
• fix(vite): detect inline module script entry points in index.html (#​1772) (51f4edd) - thanks @​lucas-spin!
• Harden vite inline module script import detection (b8abcfd)
• Use RecordableHistogram for timerified function stats (d575c69)
• Add orval plugin (resolves #​1751) (4c82aa8)
• Add treatTagHintsAsErrors and --no-tag-hints (resolves #​1767) (4b6a573)
• Add nano-spawn plugin (resolves #​1769) (b2cad06)
• Simplify glob cache validation and ignore-list assembly (df1a960)
• Dedupe ignore-pattern collection and dependency fixing (d49b626)
• Simplify installed-binaries collection in manifest metadata (5514394)
• Flatten control flow in ConfigurationChief (010d570)
• Inline trivial installed-binaries and types-included accessors (b5afb9f)
• Format (eb4b178)
• Replace @​wdio/types dev dep with inline types (a3747d6)
• Bump dependencies (822ab39)
• Work AGENTS.md, etcetera (361bd48)
• Remove rootDirs workaround resolved by oxc-resolver 11.20.0 (e190a9f)
• Add nuxt no-root-tsconfig fixture guarding alias resolution (e3e5bc9)
• Allow extra args for release-it (f9c5995)
• Add @​vercel as platinum sponsor (c4c06a9)
• Overhaul & improve --trace functionailty (60df0b0)
• Re-gen plugins.md (0f9d044)

v6.14.2: Release 6.14.2

Compare Source

• Fix vscode-knip build: pin native oxc bindings to bundled JS version (1b45a41)
• Release vscode-knip@​2.1.5 (328892e)
• Fix Astro plugin to support both possible middleware entry points (#​1749) (33e0cc1) - thanks @​schmalz-dmi!
• Fix LICENSE link (#​1760) (829620f) - thanks @​vortispy!
• Fix GraphQL Codegen script config dependencies (#​1756) (e841c63) - thanks @​jakeleventhal!
• Set pnpm config via env vars, disable verify-deps in ecosystem tests (53c1224)
• Update slonik ecosystem snapshot (f18410b)
• Fix Serverless TypeScript plugin dependencies (#​1757) (ebde7f8) - thanks @​jakeleventhal!
• Fix extended tsconfig type dependency attribution (#​1758) (f600b09) - thanks @​jakeleventhal!
• Fix Bun binary dependency tracking (#​1759) (1b28923) - thanks @​jakeleventhal!
• Detect Babel plugins/presets in Vite plugin options (resolve #​1761) (2753d69)

v6.14.1: Release 6.14.1

Compare Source

• Detect dynamic imports in Svelte compiler (#​1747) (e1c1b17) - thanks @​jinhyuk9714!
• Detect dynamic import attributes; share import matcher with Astro-MDX (9dae641)
• Work the docs (close #​1746) (919cba2)

v6.14.0: Release 6.14.0

Compare Source

• Resolve imports satisfied via transitive peerDeps (d654ec7)
• Don't flag undeclared sibling workspace imports as unlisted (#​1742) (e7122a1)
• Update github-actions reporter snapshots (2308b5a)
• Cache syncGlob() results like defaultGlob() does (6c34287)
• Trim redundant statSync calls in FileEntryCache (eee3b89)
• Cache parsed .gitignore patterns across --cache runs (7ffdc2f)
• Tighten cache module callsites (64e5072)
• Extract shared disk-cache helper used by glob and gitignore caches (0987421)
• Simplify CacheConsultant: replace trampoline with default arrow methods (bebe750)
• Pin pnpm minimumReleaseAge and trustPolicy (77efb32)
• Eliminate rescanFrontier polling in walkAndAnalyze (38d91b6)
• Reduce findWorkspaceByFilePath per-call overhead (9149437)
• Memoize DependencyDeputy.getDependencies (a661a21)
• Tighten module-graph map helpers (drop double-lookup + optional chains) (c11d62f)
• Add --duration flag for zero-overhead duration measurement (d4b59d8)
• Cover analysis pipeline with --performance timerify (694dbf4)
• Align --help text (6f12997)
• Add cli arg shorthands: -p, -s, -w, -D, -f, -F, -u (f21a587)
• Format (8db5346)
• This one's okay (662ceaf)

v6.13.1: Release 6.13.1

Compare Source

• Add jest.config.{cts,mts} (#​1743) (44738d6) - thanks @​joshkel!
• Update ecosystem tests (74420a6)
• Fix export * as re-exported namespace case (5923af4)
• Add .mts and .cts config files to some plugins (69d1e83)
• Docusaurus: ignore @generated/*, handle local plugin paths (ce5f767)
• Nx: expand {projectRoot} / {workspaceRoot} token variables (8715312)

v6.13.0: Release 6.13.0

Compare Source

• Add mercurial (hg) to command constants (#​1737) (abb08b0) - thanks @​unrevised6419!
• Expand wildcards in Jest projects (#​1710) (7cb2d37) - thanks @​joshkel!
• Add knex visitor to scan source files for config (resolve #​1736) (4c96fd2)
• Refactor to a better split of ast helpers (6e726a2)
• Handle package.json exports for outDir="." (resolve #​1738) (42497c2)
• Fix star re-exported namespace case (resolve #​1739) (e566c4b)
• Strip comments in scripts in compilers (resolve #​1740) (a123d5c)
• Update rolldown snapshot (edfee2b)
• Source-map subpath imports + collect pairs from referenced tsconfigs (7c5acc4)
• Tighten source-mapping utilities (0b68b81)
• Update dependencies (8788c1a)
• Remove obsolete internal jsdoc tag (0fed975)
• Add @​serhalp and @​stevennevins to sponsors (thank you!) (999a5e3)
• Fix astro config after bump (f63537a)

v6.12.2: Release 6.12.2

Compare Source

• Fix symbol reporter file paths with --directory (#​1733) (d54074d) - thanks @​cyphercodes!
• fix(webpack): reference TS loaders for .ts/.cts config (close #​1732) (f37c5da)
• fix(serverless-framework): skip functions without handler (close #​1735) (616739d)
• ci(integration): disable minimumReleaseAge for test installs (081dfc8)
• ci(snapshots): query — add CreateQueriesOptions to unused types (5dd0b8a)

v6.12.1: Release 6.12.1

Compare Source

• fix: type-only imports in monorepos (#​1715) (de33a2c) - thanks @​lishaduck!
• Bump jiti to ^2.7.0 (#​1729) (0fe8dc3) - thanks @​re-taro!
• Fix Vercel config detection (#​1726) (370236d) - thanks @​jakeleventhal!
• Fix inferred declaration export references (#​1728) (4dcd756) - thanks @​jakeleventhal!
• Remove stale root watch script (#​1731) (2d555a1) - thanks @​jeffrey-takuma!
• Update sponsorships script/numbers (c3dcc8f)
• Add orgs using knip (78fd581)
• Yolo (7e689bf)

v6.12.0: Release 6.12.0

Compare Source

• Use venz light/dark responsive svg img (2354194)
• Fix types/path references (4afc873)
• Move on to pnpm 11 (b106065)
• Fix up ecosystem tests (c226a72)
• Add shell binaries to global ignore list (#​1716) (ddcf7de) - thanks @​jakeleventhal!
• Fix declaration export regression and document (resolve #​1722) (3a2c22b)
• Update snapshot after 3a2c22b (8300078)
• Detect babel.plugins/presets in @​vitejs/plugin-react via function-form defineConfig (resolve #​1723) (d56ee51)
• Lift defineConfig-arg unwrapper to ast-helpers, route findCallArg through it (7195b0a)
• Fix PostCSS detection for @​tailwindcss/postcss (#​1719) (60f8482) - thanks @​jakeleventhal!
• Allow > inside SFC <script> attribute values (resolve #​1714) (9e5501f)
• Resolve Cypress reporter set per testing type (resolve #​1724) (7cc4fc1)
• Add Vercel config plugin (#​1720) (10f97c1) - thanks @​jakeleventhal!
• Direct config hint title to stderr (53236b5)
• Some light housekeeping (727f842)
• Fix up ecosystem tests (0db3300)
• Fix --no-exit-code condition for isTreatConfigHintsAsErrors (f27c3f4)
• A friendlier message (aab1e83)
• Mark plugin-name fallback binaries as optional in knownBinsOnly mode (c709a5a)

v6.11.0: Release 6.11.0

Compare Source

• Ignore & remove uninteresting lines in snapshots (767ebaf)
• Flag stale @internal tags in production mode (resolve #​1658) (dd1caed)
• Add compiler-extensions in tsc-files mode (resolve #​1708) (ea867ad)

v6.10.0: Release 6.10.0

Compare Source

• Ecosystem patches → snapshots (1803f9f)
• Fix unlisted pkg when only @​types/pkg listed (resolve #​1707) (62082b6)
• Don't report imports matching engines.X as unlisted (23582e0)
• Treat imports in .d.ts files as type-only (84caac5)
• Treat tsconfig compilerOptions.types as type-only (ce18854)
• Resolve hoisted deps from monorepo root in single-package mode (resolve #​1711) (23b756f)

v6.9.0: Release 6.9.0

Compare Source

• Expose types for JSON reporter (961b734)

v6.8.0: Release 6.8.0

Compare Source

• feat: add WXT plugin (#​1703) (9167557) - thanks @​sebastianbreguel!
• Add support for pnpm@​11 new commands (#​1706) (c937697) - thanks @​PatrykWalach!
• Fix case of spread export → other exports used (resolve #​1705) (0f94d2d)
• Add more pnpm commands + tests (f2819b3)
• Bump oxc-parser (5c21d27)

v6.7.0: Release 6.7.0

Compare Source

• Fix markdown reporter column width (resolve #​1700) (4713108)
• Handle Vitest agent and minimal reporters (#​1701) (a71ead1) - thanks @​dskwrite!
• Add e2e tests w/ tsgo defs + lib consumption (98113e6)
• Fix pkg name inconsistencies (544c3e6)
• Add export {} to maintain module shape (27d8a02)
• Strip leading UTF-8 BOM before parsing package.json (47e4029)
• Skip workspace with invalid JSON manifest (bfb4867)
• Preserve out-of-bound writes to stdout/err (95faad8)
• Consistent prefix in logError/logWarning (2c6d8a0)
• Don't exit on config file load error (0914bd3)
• Fix tsgo resolution in e2e tests (a689501)

v6.6.3: Release 6.6.3

Compare Source

• Use venz chart svg directly from CDN (ba7e907)
• Bump that plugin counter (abae75b)
• Fix plugin title (f2b8fcf)
• Work Table util class: fix bugs, tighten API, water-fill widths (2eb4045)
• Questionable.. (970a0db)
• Fmt (14538ec)
• Ensure output is flushed on exit (#​1699) (9533365) - thanks @​joshkel!
• Use currentColor to support light/dark themes (7ea055a)
• Tighten type-chain alignment + gate via ignoreExportsUsedInFile (resolve #​1698) (0910b33)
• Eating our own dog food ↻ (d5aa1f6)

v6.6.2: Release 6.6.2

Compare Source

• Don't track typeof value refs at top of exported type alias (resolve #​1697) (1a99048)
• Treat Props as used when Astro.props is referenced (resolve #​1629) (46cb338)
• Update dependencies (dcf5315)

v6.6.1: Release 6.6.1

Compare Source

• Fix website papercuts (#​1696) (c6d9c43) - thanks @​skoeva!
• fix(rslib): resolve entry points from rslib config (#​1695) (af83d68) - thanks @​rpereira-anchor!
• Update react-email plugin for react-email@​6 (#​1694) (200db55) - thanks @​krystofspiller!
• Introduce Manifest wrapper with scriptNames + getMajor helpers (6fded2f)

v6.6.0: Release 6.6.0

Compare Source

• picocolors → styleText (e7abd6b)
• @​nodelib/fs.walk → fdir (6f781b8)
• Improve performance, but only slightly (c2c0323)
• Fix package-entry hint for bare specifier in main (resolve #​1693) (2e8cf47)
• Extract vite.resolve.alias from Astro config AST (resolve #​1692) (fab5871)
• Add plugin-contributed source-map rules (e11c2b1)
• Add @sveltejs/package plugin (resolve #​1690) (8b2d402)
• Windows ❤️ (91964e4)

v6.5.0: Release 6.5.0

Compare Source

• Drop project-extension-redundant config hint (resolve #​1683) (f860929)
• Add instructions to .agents/PLUGINS.md (e2943ed)
• Add a plugin for react-email (#​1684) (d8ae4d3) - thanks @​xaqrox!
• Replace fast-glob with tinyglobby (#​1462) (9f6b4c8) - thanks @​gameroman!
• Added plugin for Serverless framework (#​1478) (f885f1d) - thanks @​BenCrinion-IW!
• Add args to Prettier plugin to resolve --config CLI flag (#​1685) (f4658c8) - thanks @​xaqrox!
• fix(util): tolerate JSONC and array extends in findRootDirsBase (#​1681) (f7e5464) - thanks @​Hoffs!
• Format (15bd7e7)
• Inherit outDir/rootDir from tsconfig project references (resolve #​1680) (b89b4f7)
• tsc → tsgo (a6e09ca)
• Update dependencies (4cb05c9)
• Housekeep (28c56cb)
• Test test test (7eb4ab3)
• Add pino plugin with transportCall visitor (resolve #​1480) (53a033e)
• Add signal to projects using knip (dbedd66)
• Tune logos (3148f4d)
• Tweak knip-run tool response (4294038)
• Add workspace option to knip-run tool (64c4aae)
• Remove old lingering experimentalTags (e503d10)
• Fix compiler type (resolve #​1689) (e7a69ad)

v6.4.1: Release 6.4.1

Compare Source

• license (2d3d8d8)
• Handle file path arguments in Bun plugin (resolve #​1678) (cdbe298)

v6.4.0: Release 6.4.0

Compare Source

• chore: change license file to have more conventional casing (#​1664) (ed97e6a) - thanks @​Zamiell!
• fix: whitelist spelling error (#​1666) (bcad120) - thanks @​Zamiell!
• Add Panda CSS plugin (#​1671) (7ab0d4d) - thanks @​Faithfinder!
• fix(rspack): detect plugins from swc-loader (#​1675) (1431ff3) - thanks @​TkDodo!
• docs: fix broken anchor link in DEVELOPMENT.md ([#​1677](https://redirect.github.com/w

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@​5.85.0 ⏵ 6.21.0			+1	+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/knip@6.21.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report