chore(deps): update dev tooling, GitHub Actions, remove unused shikijs/transformers

- Update turbo 2.8.13 → 2.10.0
- Update oxlint 1.60.0 → 1.71.0
- Update @tsconfig/bun 1.0.9 → 1.0.10
- Update vscode-languageserver-types 3.17.5 → 3.18.0
- Update @parcel/watcher and 8 platform binaries 2.5.1 → 2.5.6
- Update GitHub Actions: actions/checkout v4 → v7, actions/github-script v7 → v9 (SHA-pinned)
- Remove unused @shikijs/transformers from packages/app and packages/ui
- Fix vscode-extension duplicate workspace name (tinycode → @tinycode/vscode-extension)

Constraint: bun install requires unique workspace package names
Not-tested: GitHub Actions SHA pins (workflow syntax validated, execution requires PR)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bobbyjohnstx

.github/workflows/audit.yml

@@ -20,7 +20,7 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -38,7 +38,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request' && steps.audit.outputs.exit_code != '0'
-        uses: actions/github-script@v7
+        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
         with:
           script: |
             const fs = require('fs');
@@ -52,7 +52,7 @@ jobs:
 
       - name: Create issue on schedule failure
         if: github.event_name == 'schedule' && steps.audit.outputs.exit_code != '0'
-        uses: actions/github-script@v7
+        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
         with:
           script: |
             const fs = require('fs');

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -28,7 +28,7 @@ jobs:
   typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -43,7 +43,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - uses: oven-sh/setup-bun@v2
         with:

bun.lock

@@ -39,7 +39,7 @@
       "@types/node": "24.12.2",
       "@types/semver": "7.7.1",
       "@tsconfig/node22": "22.0.2",
-      "@tsconfig/bun": "1.0.9",
+      "@tsconfig/bun": "1.0.10",
       "@cloudflare/workers-types": "4.20251008.0",
       "@openauthjs/openauth": "0.0.0-20250322224806",
       "@pierre/diffs": "1.1.0-beta.18",
@@ -88,11 +88,11 @@
     "@typescript/native-preview": "catalog:",
     "glob": "13.0.5",
     "husky": "9.1.7",
-    "oxlint": "1.60.0",
+    "oxlint": "1.71.0",
     "oxlint-tsgolint": "0.21.0",
     "prettier": "3.6.2",
     "semver": "7.8.5",
-    "turbo": "2.8.13"
+    "turbo": "2.10.0"
   },
   "dependencies": {
     "@tinycode/plugin": "workspace:*",

package.json

@@ -29,7 +29,7 @@
     "@happy-dom/global-registrator": "20.0.11",
     "@playwright/test": "catalog:",
     "@tailwindcss/vite": "catalog:",
-    "@tsconfig/bun": "1.0.9",
+    "@tsconfig/bun": "1.0.10",
     "@types/bun": "catalog:",
     "@types/luxon": "catalog:",
     "@types/node": "catalog:",
@@ -47,7 +47,6 @@
     "@xterm/xterm": "^5.5.0",
     "@xterm/addon-fit": "^0.10.0",
     "@xterm/addon-webgl": "^0.18.0",
-    "@shikijs/transformers": "3.9.2",
     "@solid-primitives/active-element": "2.1.3",
     "@solid-primitives/audio": "1.4.2",
     "@solid-primitives/event-bus": "1.1.2",

packages/app/package.json

@@ -63,13 +63,13 @@
     "@lydell/node-pty-linux-x64": "1.2.0-beta.12",
     "@lydell/node-pty-win32-arm64": "1.2.0-beta.12",
     "@lydell/node-pty-win32-x64": "1.2.0-beta.12",
-    "@parcel/watcher-darwin-arm64": "2.5.1",
-    "@parcel/watcher-darwin-x64": "2.5.1",
-    "@parcel/watcher-linux-arm64-glibc": "2.5.1",
-    "@parcel/watcher-linux-arm64-musl": "2.5.1",
-    "@parcel/watcher-linux-x64-glibc": "2.5.1",
-    "@parcel/watcher-linux-x64-musl": "2.5.1",
-    "@parcel/watcher-win32-arm64": "2.5.1",
-    "@parcel/watcher-win32-x64": "2.5.1"
+    "@parcel/watcher-darwin-arm64": "2.5.6",
+    "@parcel/watcher-darwin-x64": "2.5.6",
+    "@parcel/watcher-linux-arm64-glibc": "2.5.6",
+    "@parcel/watcher-linux-arm64-musl": "2.5.6",
+    "@parcel/watcher-linux-x64-glibc": "2.5.6",
+    "@parcel/watcher-linux-x64-musl": "2.5.6",
+    "@parcel/watcher-win32-arm64": "2.5.6",
+    "@parcel/watcher-win32-x64": "2.5.6"
   }
 }

packages/desktop/package.json

@@ -41,14 +41,14 @@
     "@octokit/webhooks-types": "7.6.1",
     "@tinycode/http-recorder": "workspace:*",
     "@tinycode/script": "workspace:*",
-    "@parcel/watcher-darwin-arm64": "2.5.1",
-    "@parcel/watcher-darwin-x64": "2.5.1",
-    "@parcel/watcher-linux-arm64-glibc": "2.5.1",
-    "@parcel/watcher-linux-arm64-musl": "2.5.1",
-    "@parcel/watcher-linux-x64-glibc": "2.5.1",
-    "@parcel/watcher-linux-x64-musl": "2.5.1",
-    "@parcel/watcher-win32-arm64": "2.5.1",
-    "@parcel/watcher-win32-x64": "2.5.1",
+    "@parcel/watcher-darwin-arm64": "2.5.6",
+    "@parcel/watcher-darwin-x64": "2.5.6",
+    "@parcel/watcher-linux-arm64-glibc": "2.5.6",
+    "@parcel/watcher-linux-arm64-musl": "2.5.6",
+    "@parcel/watcher-linux-x64-glibc": "2.5.6",
+    "@parcel/watcher-linux-x64-musl": "2.5.6",
+    "@parcel/watcher-win32-arm64": "2.5.6",
+    "@parcel/watcher-win32-x64": "2.5.6",
     "@standard-schema/spec": "1.0.0",
     "@tsconfig/bun": "catalog:",
     "@types/babel__core": "7.20.5",
@@ -66,7 +66,7 @@
     "drizzle-orm": "catalog:",
     "prettier": "3.6.2",
     "typescript": "catalog:",
-    "vscode-languageserver-types": "3.17.5",
+    "vscode-languageserver-types": "3.18.0",
     "why-is-node-running": "3.2.2"
   },
   "dependencies": {
@@ -118,7 +118,7 @@
     "@opentui/core": "catalog:",
     "@opentui/keymap": "catalog:",
     "@opentui/solid": "catalog:",
-    "@parcel/watcher": "2.5.1",
+    "@parcel/watcher": "2.5.6",
     "@pierre/diffs": "catalog:",
     "@silvia-odwyer/photon-node": "0.3.4",
     "@solid-primitives/event-bus": "1.1.2",

packages/tinycode/package.json

@@ -50,7 +50,6 @@
     "@tinycode/sdk": "workspace:*",
     "tinycode": "workspace:*",
     "@pierre/diffs": "catalog:",
-    "@shikijs/transformers": "3.9.2",
     "@solid-primitives/bounds": "0.1.3",
     "@solid-primitives/event-listener": "2.4.5",
     "@solid-primitives/media": "2.3.3",

packages/ui/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "tinycode",
+  "name": "@tinycode/vscode-extension",
   "displayName": "tinycode",
   "description": "AI coding assistant powered by local LLMs via tinycode",
   "version": "0.1.0",