deps-dev: bump the dev-dependencies group with 8 updates

Merged
DE
3d ago
+1493-1013

Bumps the dev-dependencies group with 8 updates:

PackageFromTo
@codspeed/tinybench-plugin6.0.16.1.0
chromatic18.13.318.13.6
fallow3.35.03.37.0
lighthouse13.5.013.6.0
postcss8.5.318.5.32
sass1.106.11.107.0
style-dictionary5.7.05.7.1
typescript-eslint8.72.08.72.1

Updates @codspeed/tinybench-plugin from 6.0.1 to 6.1.0

Release notes

Sourced from @​codspeed/tinybench-plugin's releases.

v6.1.0

[!IMPORTANT] CPU Simulation results change for Vitest 5 benchmarks. This release fixes a bug in @codspeed/vitest-plugin where Vitest 5 export getter tracking ran inside the measured code, inflating the measured cost of benchmarks that read module exports. The plugin now sets benchmark.suppressExportGetterWarnings to true by default, unless you set it explicitly. Even though this is a minor release, expect CPU Simulation results for Vitest 5 benchmarks to differ from those measured with 6.0.0 and 6.0.1. Benchmarks on Vitest 3 and 4 are unaffected.

What's Changed

Full Changelog: https://github.com/CodSpeedHQ/codspeed-node/compare/v6.0.1...v6.1.0

Commits
  • d15b97d v6.1.0
  • b943512 fix(vitest-plugin)!: disable vitest 5 export getter tracking under codspeed
  • c2a065e test(core): parse optimization status regardless of forced color
  • See full diff in compare view

Updates chromatic from 18.13.3 to 18.13.6

Release notes

Sourced from chromatic's releases.

v18.13.6

🐛 Bug Fix

  • Tell the Index whether TurboSnap was requested when uploading hashes #1596 (@​codykaup)

Authors: 1

v18.13.5

🐛 Bug Fix

  • Resolve the Storybook version for Storybook 6 and report a wrong config dir first #1600 (@​codykaup)
  • Bump uuid, https-proxy-agent, and semver #1601 (@​jmhobbs)

Authors: 2

v18.13.4

🐛 Bug Fix

Authors: 3

Changelog

Sourced from chromatic's changelog.

v18.13.6 (Thu Oct 29 2026)

🐛 Bug Fix

  • Tell the Index whether TurboSnap was requested when uploading hashes #1596 (@​codykaup)

Authors: 1

v18.13.5 (Thu Oct 29 2026)

🐛 Bug Fix

  • Resolve the Storybook version for Storybook 6 and report a wrong config dir first #1600 (@​codykaup)
  • Bump uuid, https-proxy-agent, and semver #1601 (@​jmhobbs)

Authors: 2

v18.13.4 (Wed Oct 28 2026)

🐛 Bug Fix

Authors: 3

... (truncated)

Commits
  • 5f7174e Bump version to: 18.13.6 [skip ci]
  • 29085a4 Update CHANGELOG.md [skip ci]
  • 51a4160 Merge pull request #1596 from chromaui/codykaup/cap-5426
  • 462664a Drop the redundant onlyChanged field comment
  • d762570 Bump version to: 18.13.5 [skip ci]
  • c6a0242 Update CHANGELOG.md [skip ci]
  • 6dcdbe9 Merge pull request #1600 from chromaui/cody/cap-5388
  • 388c0c5 Only trust @​storybook/core-common for Storybook 6
  • 659c988 Merge pull request #1601 from chromaui/jmhobbs/dependabot-bumps-1572-1574
  • 2943897 Bump semver and @​types/semver
  • Additional commits viewable in compare view

Updates fallow from 3.35.0 to 3.37.0

Release notes

Sourced from fallow's releases.

v3.37.0: resumable mutation runs, CSS classes from template files, and signed Windows binaries

Features

  • fallow health --css reads server-side template files as class references. Fallow now reads .liquid, .njk, .hbs, .handlebars, .twig and .blade.php files, and each class-like word in them counts as used. A class that only a Shopify Liquid section applies is no longer an unreferenced-css-class. A class prefix before a {{ echo, as in grid--{{ columns }}, also counts. The {{ rule also applies to .vue, .html, .md and .astro sources with dynamic class syntax, so these sources can report fewer classes. Use the new top-level markupExtensions key to add other template extensions, for example ["tpl", "erb"]. These files do not join source discovery, so they never become unused files. Thanks @​james2doyle for the report. (#3917)

  • The npm package now ships rule-pack-schema.json. Point the $schema of a rule pack at ./node_modules/fallow/rule-pack-schema.json to get a schema that matches the installed version. The package also exports the file as fallow/rule-pack-schema.json. Thanks @​hckhanh for the report and @​tahodev for the change. (#3851)

  • An interrupted fallow mutation run keeps its finished results, and --resume continues it. Each run writes each killed and retry-confirmed survived mutant to .fallow/mutation/journal.jsonl when its result is final, also with --no-cache. fallow mutation --resume reuses these results and runs only the other mutants. When the journal comes from other inputs, the run exits 2 with FALLOW_MUTATION_RESUME_MISMATCH and names each input that differs. A resumed mutant has resumed: true, and the report has a resume object. A complete run removes the journal, and a partial run keeps it. (#3783)

Changed

  • A bare machine run that exits 0 on a failing gate now says so on stderr. Bare fallow in a machine format exits 0 on findings, but fallow dead-code --format json exits 1 on the same findings. Before, nothing showed why. Now the run prints one stderr line, also under --quiet, that names each failing findings gate and the flag that enforces it. The exit code and stdout do not change. Thanks @​Smrtnyk for the report. (#3826)

  • The exit-code contract no longer says that exit 0 means a clean run. fallow schema (exit_codes), the fallow skill and the npm README now say that 0 means no enforced gate failed. Exit 1 means findings, not a tool failure. A bare machine run gates on findings only with --fail-on-issues. To see a failing gate that did not set the exit code, read gate_outcomes.

  • fallow mutation gives no mutant for a pure condition whose only effect is a logging call. An if statement such as if (count > 0) { console.info("Items", count); } no longer gives mutants. The condition must be pure, and each branch must hold only console.* or debug(...) calls with pure arguments. In a file that declares or imports console or debug, the conditions that call that name keep their mutants. (#3719)

Bug fixes

  • thin-wrapper and duplicate-prop-shape set to error now fail the gates. At error, these rules count in issue totals, the dead-code and audit gates, and CI reports. A rule at warn does not fail a gate, also with --fail-on-issues. Thanks @​luciocabrera for the report. (#3867)

  • A CommonJS postcss.config.cjs no longer reports its module.exports keys as unused exports. When a plugin credits only default for a CommonJS module, Fallow now credits every key of module.exports. The fix applies to the CommonJS config files of all plugins that read the default export. Thanks @​waldoluisribeiro for the report. (#3876)

  • fallow security resolves a string enum member in the same module. Fallow no longer reports a template literal such as `<meta name="${MetaName.BUILD_NUMBER}">` that goes to an HTML sink as non-literal HTML. Enums and constants that you import from another module stay unresolved. The first run after the update parses all files again. Thanks @​Smrtnyk for the report. (#3854)

  • Component export queries no longer stop type-aware refinement for the whole run. Fallow now gives Vue, Astro, Svelte and MDX query files an unsupported-syntax abstention. Supported TypeScript and JavaScript queries in the same batch continue to resolve. (#3763)

  • fallow dead-code follows child_process.fork targets built from the module directory. A file that fork(path.join(path.dirname(fileURLToPath(import.meta.url)), "child.ts")) starts is no longer an unused file. path.resolve, __dirname, import.meta.dirname and a constant that holds the module directory also work. Thanks @​VariableVince for the report. (#3919)

  • Fallow now reads config values from a same-file constant. A config can keep part of its value in a top-level constant, for example projects: [UNIT]. Fallow now uses the value of the constant, so the setup files of such a Vitest project are no longer unused files. The fix applies to all plugins that read config files. Thanks @​Smrtnyk for the report. (#3852)

  • fallow dead-code no longer reports a class member as unused when an array pattern or a getter on a held object is its only read. An array pattern around an object pattern, such as const [{ m }] = [service], now credits the member. Fallow also credits the member for a src.k.m read through a getter on an object literal that a variable holds. Both forms now credit the member without --type-aware. (#3799)

  • Package scripts and CI steps that run a local shell helper now credit the commands of that helper. For bash scripts/build.sh or ./scripts/release.sh, Fallow reads the helper without running it. A binary that the helper runs makes its package used, and a file that the helper runs with tsx or node becomes an entry. Fallow follows nested helpers and literal cd steps. Thanks @​VariableVince for the report in #3918. (#3886)

  • fallow dead-code now credits a store member that a helper reads through a store alias declared in a function body. An alias such as type X = ReturnType<typeof useXStore> in a function body or block now credits the store member. An inner type of the same name still shadows the alias. (#3550)

  • Deeply nested defaults in an object pattern no longer make extraction hang. In a declaration such as const { k: { k: { m } = s } = s } = s, the work doubled at each level of nesting. A step budget now bounds the walk of one declaration.

  • fallow dead-code now credits Expo config plugins that come from a local array binding. An app config can hold its plugins list in a top-level const or let. Fallow now reads that list, its spreads, and push, unshift or splice calls on it. An expo object with a type assertion, such as satisfies ExpoConfig, now also counts. (#3883)

  • --production --type-aware no longer credits an export that only a test file uses. A type-aware reference from a file outside the analysis scope no longer removes a dead-code finding. Thanks @​Smrtnyk for the report. (#3869)

  • Audit cleanup preserves unrelated Git worktree registrations. When Fallow removes old snapshots, it keeps each user worktree registered while its directory is temporarily unavailable. (#3884)

  • Extraction is no longer slow on malformed input. Incomplete script and style tags in Astro and incomplete template tags in Vue and Angular no longer cause repeated scans. An unfinished multiline import or export in MDX no longer makes the parser run again for each line. CODEOWNERS lookups with long patterns no longer use too much memory or time. Results and source offsets do not change.

  • Type-aware refinement on the tsrs backend no longer fails on public APIs with many non-generic interfaces. The semantic sidecar now asks for type arguments only on type references. tsrs now gives the same result as typescript-go. Thanks @​Smrtnyk for the report and the reproduction. (#3872)

  • Programmatic and MCP audits no longer show their base snapshot in git worktree list. The API, the MCP audit tool and the pull-request decision output now remove the Git registration of the base snapshot, as fallow audit does. They also remove snapshots that a stopped process left behind. (#3885)

... (truncated)

Commits
  • 85fa327 chore: release v3.37.0
  • b3da1dd test(engine): make the cancelled parse test independent of runner speed (#3957)
  • b1a42d8 chore: release v3.37.0
  • b7593ea chore(deps-dev): bump oxfmt from 0.73.0 to 0.74.0 (#3952)
  • ba23ad5 chore(deps): bump knip from 6.42.0 to 6.42.1 in /benchmarks (#3954)
  • 0299785 fix(resolve): escape the tsconfig directory in include globs (#3951)
  • 03cc923 chore(ship): skip a needless rebase and merge with pinned auto-merge (#3949)
  • c141906 fix(resolve): match tsconfig include patterns that start with ./ (#3947)
  • ef1617d chore(ship): compare a failed commit run with the commits before it (#3948)
  • 0210115 fix(extract): credit members on the declared return type of a method (#3927)
  • Additional commits viewable in compare view

Updates lighthouse from 13.5.0 to 13.6.0

Release notes

Sourced from lighthouse's releases.

v13.6.0

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)

... (truncated)

Changelog

Sourced from lighthouse's changelog.

13.6.0 (2026-10-27)

Full Changelog

We expect this release to ship in the DevTools of Chrome 159, and to PageSpeed Insights within a week.

New contributors

Thanks to our new contributors 👽🐷🐰🐯🐻!

Notable Changes

  • CLI bulk URL auditing: The CLI now supports auditing multiple URLs sequentially in a single command—either by passing multiple URL arguments or via --url-file (with --fail-fast to abort on the first failure) (#17404). Default report filenames now include the URL pathname (<hostname>-<pathname>_<date>) to avoid collisions across pages on the same host (#17405, #17423).
  • Lantern simulation improvements: Upgraded trace_engine (0.0.66 and 0.0.67) and updated request/graph modeling to improve simulation accuracy (#17307, #17379):
    • Network & protocol modeling: Treated HTTP/3 connections as multiplexed, credited consumed H2 overflow bytes across simulation steps, excluded connectionless requests from active connection counts, and improved origin RTT/throughput estimation and redirect handling (#17415).
    • Dependency graph & metrics: Added v8.compileModule and v8.evaluateModule trace event attribution, used protocol renderBlocking status for render-blocking priority (#16869), used FCP graphs when text LCP occurs in the same frame as FCP, and fixed simulated LCP breakdown calculations (#17269) and trace-mode navigation/URL handling (#17431, #17433).
  • Agentic Resource Discovery (ARD) v0.91: Updated the ard-schema audit and gatherer to the ARD v0.91 specification (ard.json replacing ai-catalog.json), supporting discovery via Link HTTP headers, <link rel="ard">, and /.well-known/ard.json, warning on legacy ai-catalog locations, and displaying the ARD spec version in the report footer (#17258, #17259, #17260, #17448, #17452).
  • Performance insight numericValue: Performance insight audits now populate numericValue and numericUnit from estimated time or byte savings (#17346), and select the correct navigation when traces contain multiple navigations (#17174).
  • Memory and gathering optimizations: Reduced peak memory usage during runs by streaming traces (ReturnAsStream), reusing script sources from trace events, evicting decoded frame buffers in speedline, and releasing intermediate gatherer and trace engine state (#17286, #17289, #17290, #17407).

Core

  • fix cycle tracking and built-in type checks in deep-equals (#17422)
  • release retained gatherer and trace engine intermediate state (#17290)
  • populate numericValue on performance insight audits (#17346)
  • do not throw when robots.txt or llms.txt content is null (#17294)
  • fail robots-txt and llms-txt on HTTP 429 (#17295)
  • fix insight audits picking the wrong navigation's data (#17174)
  • ard: include ARD spec version in LHR credits and report footer (#17452)
  • ard: sync port with upstream f073b1e (#17448)
  • ard: make upstream sync check content-based (#17261)
  • ard: report legacy and unreachable discovery sources (#17260)
  • ard: discover manifests per spec §5.1 (#17259)
  • ard: port conformance test to ARD v0.91 (#17258)
  • baseline: link to developer.chrome.com docs (#17177)
  • baseline: show baseline_low_date for Widely Available features (#17337)
  • baseline: fix getLowDate for high features, move web-features to devDeps (#17283)
  • cdt: convert core/lib/cdt to ESM (#17340)
  • config: throw when module is missing from bundledModules in bundled env (#17398)
  • driver: skip clearDataForOrigin when origin is null (#17347)
  • full-page-screenshot: preserve emulated width during resize (#17330)
  • image-elements: skip source rules when HTML dimensions are explicit (#17287)
  • lantern-metric: use last main-frame navigation in trace mode (#17433)
  • lcp-network-record: rename artifact, include Media requests (#17324)

... (truncated)

Commits

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Changelog

Sourced from postcss's changelog.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Commits

Updates sass from 1.106.1 to 1.107.0

Release notes

Sourced from sass's releases.

Dart Sass 1.107.0

To install Sass 1.107.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Command-Line Interface

  • The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

  • The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

  • Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

  • Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

  • Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

  • Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

  • Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

  • Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.107.0

Command-Line Interface

  • The --fatal-deprecation flag can now exclude deprecations that would otherwise be included by passing a version number. To exclude a deprecation, add - before its name. For example, --fatal-deprecation=1.107.0,-import includes all deprecations that were present in Dart Sass 1.107.0 except for the @import deprecation.

  • The --fatal-deprecation flag now takes the special value dart-sass-2, which treats as fatal all deprecations that will become fatal in Dart Sass 2.0.0.

JavaScript API

  • Options.fatalDeprecations can now take a DeprecationSelectorDifference object of the form {include: ..., except: ...}, where the include field lists deprecations to mark fatal (which can be version numbers) and the except field lists deprecations not to mark fatal. The except field takes precedence over include.

  • Add a (non-enumerable) sass.deprecations.dartSass2 property which can be passed to Options.fatalDeprecations to mark as fatal exactly the deprecations that will become fatal in Dart Sass 2.0.0. This can be combined with other deprecations or used in a DeprecationSelectorDifference to modify exactly which deprecations it covers.

  • Passing a version number beyond the current Dart Sass version to Options.fatalDeprecations is now deprecated. See the Sass website for details.

Dart API

  • Add a Deprecation.dartSass2 property which returns exactly the set of deprecations that will become fatal in Dart Sass 2.0.0.

  • Passing a version number beyond the current Dart Sass version to Deprecation.forVersion is now deprecated.

Embedded Protocol

  • Add a CompileRequest.fatal_deprecation_except field which excludes deprecations from being considered fatal if they would have been enabled by CompileRequest.fatal_deprecation.
Commits

Updates style-dictionary from 5.7.0 to 5.7.1

Release notes

Sourced from style-dictionary's releases.

v5.7.1

Patch Changes

  • c3c37e1: Protect convertTokenData to output 'object' from another prototype pollution vulnerability (GHSA-m4pr-rgwp). In this case, the attack vector was by placing 2 tokens and letting the 2nd descend into the 1st one, and then polluting the object prototype in that descension.
Changelog

Sourced from style-dictionary's changelog.

5.7.1

Patch Changes

  • c3c37e1: Protect convertTokenData to output 'object' from another prototype pollution vulnerability (GHSA-m4pr-rgwp). In this case, the attack vector was by placing 2 tokens and letting the 2nd descend into the 1st one, and then polluting the object prototype in that descension.
Commits

Updates typescript-eslint from 8.72.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

  • eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
  • eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
  • typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits
  • 4ad6b75 chore(release): publish 8.72.1
  • 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
  • See full diff in ...

    Description has been truncated

    Summary by cubic

    Updates 8 dev dependencies: @codspeed/tinybench-plugin, chromatic, fallow, lighthouse, postcss, sass, style-dictionary, and typescript-eslint.

    Notable changes

    • style-dictionary 5.7.1 patches a prototype pollution vulnerability (GHSA-m4pr-rgwp).
    • @codspeed/tinybench-plugin 6.1.0 changes Vitest 5 benchmark CPU simulation results due to an export getter tracking fix.
    • lighthouse 13.6.0 adds CLI bulk URL auditing and reduces peak memory usage.