chore(deps): update dependency oxfmt to ^0.70.0

[metamask-ci]

This PR contains the following updates:

Package	Change	Age	Confidence
oxfmt (source)	^0.44.0 → ^0.70.0

---

Release Notes

oxc-project/oxc (oxfmt)

v0.70.0: oxfmt v0.70.0

Compare Source

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#​26763) (leaysgur)

v0.69.0

Compare Source

v0.68.0

Compare Source

v0.67.0

Compare Source

🛡️ Security

• 9a612d5 deps: Update npm packages (#​26178) (renovate[bot])

v0.66.0

Compare Source

v0.65.0

Compare Source

v0.64.0

Compare Source

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#​25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#​25572) (leaysgur)

v0.63.0

Compare Source

v0.62.0

Compare Source

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#​25008) (leaysgur)

v0.61.0

Compare Source

v0.60.0

Compare Source

v0.59.0

Compare Source

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#​24286) (leaysgur)

v0.58.0

Compare Source

v0.57.0

Compare Source

v0.56.0

Compare Source

v0.55.0

Compare Source

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#​22935) (AliceLanniste)

v0.54.0

Compare Source

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#​22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#​22953) (leaysgur)

v0.53.0

Compare Source

v0.52.0

Compare Source

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#​22454) (leaysgur)

v0.51.0

Compare Source

v0.50.0

Compare Source

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#​22440) (leaysgur)

v0.49.0

Compare Source

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#​21700) (leaysgur)

v0.48.0

Compare Source

v0.47.0

Compare Source

v0.46.0

Compare Source

v0.45.0

Compare Source

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#​20989) (leaysgur)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	oxfmt@​0.44.0 ⏵ 0.70.0	+1			+1

View full report

[socket-security]

Caution

MetaMask internal reviewing guidelines:

• Do not ignore-all
• Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
• Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
  @SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Potential security risk (AI signal): npm oxfmt is 62.0% likely risky Notes: No direct spyware/exfiltration or explicit backdoor payload is evident in this fragment. However, it implements a high-impact dynamic loader: it reads resolved module source from disk, optionally transforms it, and executes it via vm.runInThisContext (generated wrapper), with optional disk caching of transformed code. If an attacker can influence module specifiers/paths, poison resolution inputs, or tamper with cache artifacts, this becomes a practical arbitrary code execution vector with elevated supply-chain risk. Treat this component as security-critical: ensure callers only pass trusted specifiers/paths, lock down cache directories, and protect against cache poisoning. Confidence: 0.62 Severity: 0.74 From: package.json → npm/oxfmt@0.70.0 ℹ Read more on: This package | This alert | What are AI-detected potential security risks? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: An AI system identified potential security problems in this package. It is advised to review the package thoroughly and assess the potential risks before installation. You may also consider reporting the issue to the package maintainer or seeking alternative solutions with a stronger security posture. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/oxfmt@0.70.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1bca389. Configure here.}

[cursor]

Stale oxfmt peer dependency range

Medium Severity

The oxfmt peer range remains ^0.44.0 after devDependencies moved to ^0.70.0. On 0.x, a caret range only allows patch bumps, so 0.70.0 does not satisfy the peer. Consumers who install current oxfmt as the README directs get an unsatisfied peer, and the advertised range no longer matches the version this package is tested against.

Additional Locations (1)

• packages/messenger-cli/package.json#L57-L58

 

^{Reviewed by Cursor Bugbot for commit 1bca389. Configure here.}