[dependabot]

Bumps dependency-cruiser from 17.4.3 to 18.7.0.

Release notes

Sourced from dependency-cruiser's releases.

v18.7.0

✨ features

• 6ae13a39 feat(summarize): makes the missing compiler warnings more precise (#1111) This a.o. makes dependency-cruiser stop reporting a missing typescript compiler even when swc was installed (and swc was sufficient for the configured features). Thanks @​duvillierA for raising the issue!

🐛 fixes

• da0efbb4 fix(extract/resolve): disregards peerDependenciesMeta and similar actual non-dependencies keys to prevent false positives (#1110). Thanks @​arvidtorbjoernsen for reporting the issue that led to this fix!
• c580daf6 fix(extract/swc): expands extensions swc can handle to all ts* variants (#1105) Thanks @​duvillierA for raising the issue and for providing the fix that landed in the PR!
• 9d53b95a fix(extract/swc): adds recognition of type-only-ness of exports (#1106). Thanks @​duvillierA for raising the issue and for providing the fix that landed in the PR!

📖 documentation

• 8b4dbdee docs: fix typo in no-duplicate-dep-types comment (#1108) Thanks @​Samathingamajig for the PR!

v18.6.0

✨ features

• 51467e4d feat(extract/transpile): compile svelte components that use top level await (#1103) - thanks @​JonnyBGod for finding the issue and raising the pull request!

👷‍♂️ maintenance

• 14ca8a17 build(npm): updates external dependencies
• 3f4e5feb doc(SECURITY.md): adds direct link to raising an adivisory
• e35bded9 chore: renames copilot-instructions AGENTS.md

v18.5.0

✨ features

• 25ac2f7f feat(extract/tsc): adds support for imports inside module and namespace blocks (#1095) - thanks to @​arpitjain099 for detecting the missing feature AND making the PR
• 918d9193 feat(report/markdown): adds baseline stale table (#1102)

👷 maintenance

• 10860b9a build(npm): updates external dependencies

v18.4.0

✨ features

To improve visibility of the state of the baseline (.dependency-cruiser-known-violations.json)...

• ...the err, err-html and markdown reporters now show the number of stale entries in the baseline. (c617e580/ e9ad4ce6/ be91a27c/ 993ac9df)

... (truncated)

Commits

• 60f8a7e 18.7.0
• 6ae13a3 feat(summarize): makes the missing compiler warnings more precise (#1111)
• 8b4dbde docs: fix typo in no-duplicate-dep-types comment (#1108)
• da0efbb fix(extract/resolve): disregards peerDependenciesMeta and similar actual non-...
• c580daf fix(extract/swc): expands extensions swc can handle to all ts* variants (#1105)
• 9d53b95 fix(extract/swc): adds recognition of type-only-ness of exports (#1106)
• 59606f7 18.6.0
• 14ca8a1 build(npm): updates external dependencies
• 51467e4 fix(extract/transpile): compile svelte components that use top level await (#...
• 3f4e5fe doc(SECURITY.md): adds direct link to raising an adivisory
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[martastn]

Verdict: Safe to merge

Bump: dependency-cruiser 17.4.3 → 18.7.0 (major, direct devDependency)

Changes:

• 18.0.0 BREAKING: drops Node 20 & 25 (engines: ^22||^24||>=26), enforced at runtime by the CLI
• 18.x: baseline/swc/svelte/TS-namespace features, extra summary.environment in JSON output; no CVEs
• Lockfile side bumps: acorn 8.16→8.19, semver 7.8.1→7.8.5, picomatch 4.0.4→4.0.7 (shared with webpack/jest), enhanced-resolve dedupe (webpack stays on 5.26.0)

Usage in repo: only depcruise:high / depcruise:low scripts + dependency-cruiser/*.js configs; not imported in src/, not in CI/Docker

Impact: none

Verified:

• tsc ✅ · unit tests ✅ (28/28) · E2E same as master (9 ✅, flaky ProjectMenu ❌ on both) · build ✅ (bundle Δ 0 B, byte-identical after path normalisation)
• depcruise output (3 configs × archi/dot/err/text/json, SVG) identical to 17.4.3
• Manual UI diff vs master: Login, Examples, About, Editor (DOM/style fingerprints + pixel-identical editor screenshot) — no differences

Notes: v18 drops Node 20/25 — fine for us (CI/Docker on 24); devcontainer still on Node 20 is tracked separately.