chore(deps-dev): bump the markuplint group across 1 directory with 3 updates

[dependabot]

Bumps the markuplint group with 3 updates in the / directory: @markuplint/jsx-parser, @markuplint/react-spec and markuplint.

Updates @markuplint/jsx-parser from 4.18.3 to 5.0.0

Release notes

Sourced from @​markuplint/jsx-parser's releases.

v5.0.0

Highlights

• v5 rule system redesign: wai-aria split into granular per-check ARIA rules, specConformance metadata, and named rule groups with nodeRules in the config schema.
• AST overhaul: parser output now uses UUID-based node references (parentNodeUuid/pairNodeUuid) instead of object references, and token properties are simplified across every framework parser.
• New parsers: Markdown and MDX parsers added; htmx-parser removed and alpine-parser simplified (migration guide included).
• ARIA 1.3 by default: default ARIA specification version moves from 1.2 to 1.3, adding DPub ARIA roles, context-role validation, and generic-role transparency.
• Legacy API removed: the deprecated v1 API is gone; MLCore.verify() now returns a VerifyResult and RuleSeed.fix() is replaced by inline fix callbacks on report().
• Tooling migration: ESLint/Prettier replaced by oxlint/oxfmt repo-wide; @markuplint/spec-generator merged into @markuplint/html-spec.
• VS Code extension republished under the markuplint Marketplace publisher (markuplint.vscode-markuplint).

---

Breaking Changes

Rule engine & API

• MLCore.verify() now returns VerifyResult instead of Violation[]; RuleSeed.fix() is removed in favor of inline fix callbacks passed to report().
• Deprecated v1 API removed (feat!: remove deprecated v1 API).
• --config no longer implicitly loads the default config alongside it (feat!: stop loading default config when --config is specified, #1862).
• autoLoad removed from APIOptions and from resolveRules() — rules are now always auto-loaded unconditionally; MLResultInfo_v1 interface removed.
• getIndent() removed from the public API; getLine()/getCol() (and Token.getLine()/Token.getCol()) removed — use getPosition() / Token.getPosition() instead.
• CLI no longer forces a severity.parseError default — projects linting malformed HTML that relied on non-fatal parse5 events showing up by default must now pass --severity-parse-error error or set severity.parseError explicitly. Fatal parser errors are unaffected.
• ConfigProvider#resolve(targetFile, names, false) no longer clears the provider's caches by itself — call the new ConfigProvider#invalidate() first.
• Deprecated-rule violations now report ruleId: 'rule-deprecation' instead of ruleId: 'config-error'; consumers filtering by ruleId === 'config-error' must also check for 'rule-deprecation'.

AST & parsers

• parentNode/pairNode object references removed from AST nodes; use parentNodeUuid/pairNodeUuid string fields instead (MLDOM resolves nodes via UUID lookup).
• AST token properties simplified across all framework parsers (Astro, Pug, Svelte, Vue, JSX, HTML) — selfClosingSolidus replaced by tagCloseChar; conditional-block metadata replaced by blockBehavior.
• endOfUnquotedValueChars no longer includes / by default — unquoted attribute values preserve /, matching the WHATWG "attribute value (unquoted) state". Pass endOfUnquotedValueChars: ['\t','\n','\f','\r',' ','/','>'] explicitly to restore the old behavior.
• MLMarkupLanguageParser interface and Parse type alias removed; @markuplint/file-resolver drops MLMarkupLanguageParser support.
• htmx-parser package removed.

Config

• deepmerge replaced by shallow merge in config resolution; rule-value array merges now override instead of concatenating (#1104); pretenders merge behavior changed.
• Array support for specs removed from @markuplint/ml-config; deprecated rule types removed.
• ignoreOmittedElements default changed to true (#3136); ruleCommonSettings wired through with allowWarnings defaulting to true.
• invalid-attr rule: deprecated attrs option and the { type: X } value wrapper removed. Named rules wrapping invalid-attr (e.g. a11y/no-accesskey) now only run their configured allow/disallow checks and no longer fall back to full HTML-spec validation — extend markuplint:html-standard or set "invalid-attr": true to keep spec validation.
• markuplint:html-standard now enables the base invalid-attr rule; rdfa/meta-property is no longer a named rule (behavior preserved via the unnamed nodeRule) — remove any rules: { "rdfa/meta-property": false } override.
• pretenders entries whose selector matches a standard HTML element are now ignored (e.g. <marquee as="div"> no longer suppresses violations on the real element).

ARIA / accessibility

• Default ARIA specification version changes from 1.2 to 1.3, which can change lint results for ARIA-version-dependent rules.
• wai-aria-disallowed-props: autonomous custom elements with an ARIA-implied naming attribute but no explicit role (e.g. <my-widget aria-label="x">) now report an error — add an explicit role or drop the naming attribute. Customized built-in elements (<button is="x-y">) are unaffected.
• landmark-roles no longer requires complementary landmarks to be top-level, matching axe-core's deprecation of that check.

Tooling & packaging

• @markuplint/spec-generator removed — its functionality is now internal to @markuplint/html-spec.
• ESLint and Prettier are no longer used anywhere in the repo/toolchain — use oxlint and oxfmt.
• VS Code extension is now published under the markuplint publisher (markuplint.vscode-markuplint); the legacy yusukehirao.vscode-markuplint listing is deprecated from v5.0.0-rc.3 onward and receives no further updates.

... (truncated)

Changelog

Sourced from @​markuplint/jsx-parser's changelog.

5.0.0 (2026-09-11)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.7 (2026-08-31)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.6 (2026-08-30)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.5 (2026-08-28)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.4 (2026-04-19)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.3 (2026-04-19)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.2 (2026-04-15)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-rc.1 (2026-03-27)

• feat!: adapt framework parsers to UUID-based node references (6d543b8)

BREAKING CHANGES

• Parser output no longer contains parentNode/pairNode object references. Use parentNodeUuid/pairNodeUuid string fields instead.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

5.0.0-rc.0 (2026-03-12)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-alpha.3 (2026-02-26)

Note: Version bump only for package @​markuplint/jsx-parser

5.0.0-alpha.2 (2026-02-23)

Note: Version bump only for package @​markuplint/jsx-parser

... (truncated)

Commits

• c99706f chore(release): publish
• 8d7a3b8 chore(release): publish
• c02c3a0 chore(release): publish
• 8d87463 chore(release): publish
• aa8b7ca chore: raise minimum Node.js version to 24 (#3978)
• 613e224 docs: shrink operational docs and establish JSDoc-first policy
• 83cc0d2 docs: keep only rationale in code comments
• 5952d49 docs: remove explanatory markdown files
• 91a8448 test(jsx-parser): pin upstream raw-text invariant for #3825
• 90d9732 chore(deps): update typescript-eslint monorepo to v8.59.0 (#3764)
• Additional commits viewable in compare view

Updates @markuplint/react-spec from 4.18.0 to 5.0.0

Release notes

Sourced from @​markuplint/react-spec's releases.

v5.0.0

Highlights

• v5 rule system redesign: wai-aria split into granular per-check ARIA rules, specConformance metadata, and named rule groups with nodeRules in the config schema.
• AST overhaul: parser output now uses UUID-based node references (parentNodeUuid/pairNodeUuid) instead of object references, and token properties are simplified across every framework parser.
• New parsers: Markdown and MDX parsers added; htmx-parser removed and alpine-parser simplified (migration guide included).
• ARIA 1.3 by default: default ARIA specification version moves from 1.2 to 1.3, adding DPub ARIA roles, context-role validation, and generic-role transparency.
• Legacy API removed: the deprecated v1 API is gone; MLCore.verify() now returns a VerifyResult and RuleSeed.fix() is replaced by inline fix callbacks on report().
• Tooling migration: ESLint/Prettier replaced by oxlint/oxfmt repo-wide; @markuplint/spec-generator merged into @markuplint/html-spec.
• VS Code extension republished under the markuplint Marketplace publisher (markuplint.vscode-markuplint).

---

Breaking Changes

Rule engine & API

• MLCore.verify() now returns VerifyResult instead of Violation[]; RuleSeed.fix() is removed in favor of inline fix callbacks passed to report().
• Deprecated v1 API removed (feat!: remove deprecated v1 API).
• --config no longer implicitly loads the default config alongside it (feat!: stop loading default config when --config is specified, #1862).
• autoLoad removed from APIOptions and from resolveRules() — rules are now always auto-loaded unconditionally; MLResultInfo_v1 interface removed.
• getIndent() removed from the public API; getLine()/getCol() (and Token.getLine()/Token.getCol()) removed — use getPosition() / Token.getPosition() instead.
• CLI no longer forces a severity.parseError default — projects linting malformed HTML that relied on non-fatal parse5 events showing up by default must now pass --severity-parse-error error or set severity.parseError explicitly. Fatal parser errors are unaffected.
• ConfigProvider#resolve(targetFile, names, false) no longer clears the provider's caches by itself — call the new ConfigProvider#invalidate() first.
• Deprecated-rule violations now report ruleId: 'rule-deprecation' instead of ruleId: 'config-error'; consumers filtering by ruleId === 'config-error' must also check for 'rule-deprecation'.

AST & parsers

• parentNode/pairNode object references removed from AST nodes; use parentNodeUuid/pairNodeUuid string fields instead (MLDOM resolves nodes via UUID lookup).
• AST token properties simplified across all framework parsers (Astro, Pug, Svelte, Vue, JSX, HTML) — selfClosingSolidus replaced by tagCloseChar; conditional-block metadata replaced by blockBehavior.
• endOfUnquotedValueChars no longer includes / by default — unquoted attribute values preserve /, matching the WHATWG "attribute value (unquoted) state". Pass endOfUnquotedValueChars: ['\t','\n','\f','\r',' ','/','>'] explicitly to restore the old behavior.
• MLMarkupLanguageParser interface and Parse type alias removed; @markuplint/file-resolver drops MLMarkupLanguageParser support.
• htmx-parser package removed.

Config

• deepmerge replaced by shallow merge in config resolution; rule-value array merges now override instead of concatenating (#1104); pretenders merge behavior changed.
• Array support for specs removed from @markuplint/ml-config; deprecated rule types removed.
• ignoreOmittedElements default changed to true (#3136); ruleCommonSettings wired through with allowWarnings defaulting to true.
• invalid-attr rule: deprecated attrs option and the { type: X } value wrapper removed. Named rules wrapping invalid-attr (e.g. a11y/no-accesskey) now only run their configured allow/disallow checks and no longer fall back to full HTML-spec validation — extend markuplint:html-standard or set "invalid-attr": true to keep spec validation.
• markuplint:html-standard now enables the base invalid-attr rule; rdfa/meta-property is no longer a named rule (behavior preserved via the unnamed nodeRule) — remove any rules: { "rdfa/meta-property": false } override.
• pretenders entries whose selector matches a standard HTML element are now ignored (e.g. <marquee as="div"> no longer suppresses violations on the real element).

ARIA / accessibility

• Default ARIA specification version changes from 1.2 to 1.3, which can change lint results for ARIA-version-dependent rules.
• wai-aria-disallowed-props: autonomous custom elements with an ARIA-implied naming attribute but no explicit role (e.g. <my-widget aria-label="x">) now report an error — add an explicit role or drop the naming attribute. Customized built-in elements (<button is="x-y">) are unaffected.
• landmark-roles no longer requires complementary landmarks to be top-level, matching axe-core's deprecation of that check.

Tooling & packaging

• @markuplint/spec-generator removed — its functionality is now internal to @markuplint/html-spec.
• ESLint and Prettier are no longer used anywhere in the repo/toolchain — use oxlint and oxfmt.
• VS Code extension is now published under the markuplint publisher (markuplint.vscode-markuplint); the legacy yusukehirao.vscode-markuplint listing is deprecated from v5.0.0-rc.3 onward and receives no further updates.

... (truncated)

Changelog

Sourced from @​markuplint/react-spec's changelog.

5.0.0 (2026-09-11)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.7 (2026-08-31)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.6 (2026-08-30)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.5 (2026-08-28)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.4 (2026-04-19)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.3 (2026-04-19)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.2 (2026-04-15)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.1 (2026-03-27)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-rc.0 (2026-03-12)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-alpha.3 (2026-02-26)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-alpha.2 (2026-02-23)

Note: Version bump only for package @​markuplint/react-spec

5.0.0-alpha.1 (2026-02-22)

Features

• react-spec: use acceptedAttrNames and add contenteditable override (62656e5)

... (truncated)

Commits

• c99706f chore(release): publish
• 8d7a3b8 chore(release): publish
• c02c3a0 chore(release): publish
• 8d87463 chore(release): publish
• aa8b7ca chore: raise minimum Node.js version to 24 (#3978)
• 613e224 docs: shrink operational docs and establish JSDoc-first policy
• 83cc0d2 docs: keep only rationale in code comments
• 5952d49 docs: remove explanatory markdown files
• 97a6339 chore(release): publish
• 9c87076 chore(release): publish
• Additional commits viewable in compare view

Updates markuplint from 4.18.3 to 5.0.0

Changelog

Sourced from markuplint's changelog.

5.0.0 (2026-09-11)

Note: Version bump only for package markuplint

5.0.0-rc.7 (2026-08-31)

Features

• markuplint: surface appliedOverrides in --show-config=details (10ed615)

5.0.0-rc.6 (2026-08-30)

Bug Fixes

• add no-aria-hidden-on-hidden-until-found rule (closes #3999) (#4017) (3dfb300)
• resolveConfig(false) crashes with inline config (not a file path) (#4018) (7e38b64), closes #4015 #4015

Features

• split rule-deprecation notices out of config-error (#4013) (812e6f3)

Performance Improvements

• share ConfigProvider across a run's files, fix latent overrides caching bug (#4016) (fcc1875), closes #3997 #3997

BREAKING CHANGES

• ConfigProvider#resolve(targetFile, names, false) no longer clears the provider's store/cache/plugin-resolution caches by itself. Callers that relied on cache: false alone to force a fresh re-read must now call the new ConfigProvider#invalidate() first.

• violations for deprecated rule names now have ruleId: 'rule-deprecation' instead of ruleId: 'config-error'. Any consumer filtering MLCore.verify() output (or the markuplint CLI/API) by ruleId === 'config-error' to catch deprecation messages must also check for rule-deprecation.

• feat(markuplint): add --severity-deprecation CLI flag

Wires the new severity.deprecation config option (@​markuplint/ml-config) and the rule-deprecation ruleId (@​markuplint/ml-core) through the CLI:

• --severity-deprecation flag, mirroring --severity-parse-error
• --show-config details now also surfaces ruleDeprecations
• per-run dedupe and failed-file counting generalized to cover both config-level ruleIds (config-error and rule-deprecation), not just config-error

• docs(website): document severity.deprecation (EN + JA)

... (truncated)

Commits

• c99706f chore(release): publish
• 8d7a3b8 chore(release): publish
• 10ed615 feat(markuplint): surface appliedOverrides in --show-config=details
• 6ac2f81 test(markuplint): add integration tests for issue #4023 fixes
• c02c3a0 chore(release): publish
• 7e38b64 fix: resolveConfig(false) crashes with inline config (not a file path) (#4018)
• 3dfb300 fix: add no-aria-hidden-on-hidden-until-found rule (closes #3999) (#4017)
• fcc1875 perf: share ConfigProvider across a run's files, fix latent overrides caching...
• 812e6f3 feat: split rule-deprecation notices out of config-error (#4013)
• 218c2ec chore(release): merge v5-rc back after rc.5 (#4010)
• Additional commits viewable in compare view