build(deps): update dependency knip to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
knip (source)	^5.88.0 → ^6.0.0

---

Release Notes

webpro-nl/knip (knip)

v6.14.2: Release 6.14.2

Compare Source

• Fix vscode-knip build: pin native oxc bindings to bundled JS version (1b45a41)
• Release vscode-knip@​2.1.5 (328892e)
• Fix Astro plugin to support both possible middleware entry points (#​1749) (33e0cc1) - thanks @​schmalz-dmi!
• Fix LICENSE link (#​1760) (829620f) - thanks @​vortispy!
• Fix GraphQL Codegen script config dependencies (#​1756) (e841c63) - thanks @​jakeleventhal!
• Set pnpm config via env vars, disable verify-deps in ecosystem tests (53c1224)
• Update slonik ecosystem snapshot (f18410b)
• Fix Serverless TypeScript plugin dependencies (#​1757) (ebde7f8) - thanks @​jakeleventhal!
• Fix extended tsconfig type dependency attribution (#​1758) (f600b09) - thanks @​jakeleventhal!
• Fix Bun binary dependency tracking (#​1759) (1b28923) - thanks @​jakeleventhal!
• Detect Babel plugins/presets in Vite plugin options (resolve #​1761) (2753d69)

v6.14.1: Release 6.14.1

Compare Source

• Detect dynamic imports in Svelte compiler (#​1747) (e1c1b17) - thanks @​jinhyuk9714!
• Detect dynamic import attributes; share import matcher with Astro-MDX (9dae641)
• Work the docs (close #​1746) (919cba2)

v6.14.0: Release 6.14.0

Compare Source

• Resolve imports satisfied via transitive peerDeps (d654ec7)
• Don't flag undeclared sibling workspace imports as unlisted (#​1742) (e7122a1)
• Update github-actions reporter snapshots (2308b5a)
• Cache syncGlob() results like defaultGlob() does (6c34287)
• Trim redundant statSync calls in FileEntryCache (eee3b89)
• Cache parsed .gitignore patterns across --cache runs (7ffdc2f)
• Tighten cache module callsites (64e5072)
• Extract shared disk-cache helper used by glob and gitignore caches (0987421)
• Simplify CacheConsultant: replace trampoline with default arrow methods (bebe750)
• Pin pnpm minimumReleaseAge and trustPolicy (77efb32)
• Eliminate rescanFrontier polling in walkAndAnalyze (38d91b6)
• Reduce findWorkspaceByFilePath per-call overhead (9149437)
• Memoize DependencyDeputy.getDependencies (a661a21)
• Tighten module-graph map helpers (drop double-lookup + optional chains) (c11d62f)
• Add --duration flag for zero-overhead duration measurement (d4b59d8)
• Cover analysis pipeline with --performance timerify (694dbf4)
• Align --help text (6f12997)
• Add cli arg shorthands: -p, -s, -w, -D, -f, -F, -u (f21a587)
• Format (8db5346)
• This one's okay (662ceaf)

v6.13.1: Release 6.13.1

Compare Source

• Add jest.config.{cts,mts} (#​1743) (44738d6) - thanks @​joshkel!
• Update ecosystem tests (74420a6)
• Fix export * as re-exported namespace case (5923af4)
• Add .mts and .cts config files to some plugins (69d1e83)
• Docusaurus: ignore @generated/*, handle local plugin paths (ce5f767)
• Nx: expand {projectRoot} / {workspaceRoot} token variables (8715312)

v6.13.0: Release 6.13.0

Compare Source

• Add mercurial (hg) to command constants (#​1737) (abb08b0) - thanks @​unrevised6419!
• Expand wildcards in Jest projects (#​1710) (7cb2d37) - thanks @​joshkel!
• Add knex visitor to scan source files for config (resolve #​1736) (4c96fd2)
• Refactor to a better split of ast helpers (6e726a2)
• Handle package.json exports for outDir="." (resolve #​1738) (42497c2)
• Fix star re-exported namespace case (resolve #​1739) (e566c4b)
• Strip comments in scripts in compilers (resolve #​1740) (a123d5c)
• Update rolldown snapshot (edfee2b)
• Source-map subpath imports + collect pairs from referenced tsconfigs (7c5acc4)
• Tighten source-mapping utilities (0b68b81)
• Update dependencies (8788c1a)
• Remove obsolete internal jsdoc tag (0fed975)
• Add @​serhalp and @​stevennevins to sponsors (thank you!) (999a5e3)
• Fix astro config after bump (f63537a)

v6.12.2: Release 6.12.2

Compare Source

• Fix symbol reporter file paths with --directory (#​1733) (d54074d) - thanks @​cyphercodes!
• fix(webpack): reference TS loaders for .ts/.cts config (close #​1732) (f37c5da)
• fix(serverless-framework): skip functions without handler (close #​1735) (616739d)
• ci(integration): disable minimumReleaseAge for test installs (081dfc8)
• ci(snapshots): query — add CreateQueriesOptions to unused types (5dd0b8a)

v6.12.1: Release 6.12.1

Compare Source

• fix: type-only imports in monorepos (#​1715) (de33a2c) - thanks @​lishaduck!
• Bump jiti to ^2.7.0 (#​1729) (0fe8dc3) - thanks @​re-taro!
• Fix Vercel config detection (#​1726) (370236d) - thanks @​jakeleventhal!
• Fix inferred declaration export references (#​1728) (4dcd756) - thanks @​jakeleventhal!
• Remove stale root watch script (#​1731) (2d555a1) - thanks @​jeffrey-takuma!
• Update sponsorships script/numbers (c3dcc8f)
• Add orgs using knip (78fd581)
• Yolo (7e689bf)

v6.12.0: Release 6.12.0

Compare Source

• Use venz light/dark responsive svg img (2354194)
• Fix types/path references (4afc873)
• Move on to pnpm 11 (b106065)
• Fix up ecosystem tests (c226a72)
• Add shell binaries to global ignore list (#​1716) (ddcf7de) - thanks @​jakeleventhal!
• Fix declaration export regression and document (resolve #​1722) (3a2c22b)
• Update snapshot after 3a2c22b (8300078)
• Detect babel.plugins/presets in @​vitejs/plugin-react via function-form defineConfig (resolve #​1723) (d56ee51)
• Lift defineConfig-arg unwrapper to ast-helpers, route findCallArg through it (7195b0a)
• Fix PostCSS detection for @​tailwindcss/postcss (#​1719) (60f8482) - thanks @​jakeleventhal!
• Allow > inside SFC <script> attribute values (resolve #​1714) (9e5501f)
• Resolve Cypress reporter set per testing type (resolve #​1724) (7cc4fc1)
• Add Vercel config plugin (#​1720) (10f97c1) - thanks @​jakeleventhal!
• Direct config hint title to stderr (53236b5)
• Some light housekeeping (727f842)
• Fix up ecosystem tests (0db3300)
• Fix --no-exit-code condition for isTreatConfigHintsAsErrors (f27c3f4)
• A friendlier message (aab1e83)
• Mark plugin-name fallback binaries as optional in knownBinsOnly mode (c709a5a)

v6.11.0: Release 6.11.0

Compare Source

• Ignore & remove uninteresting lines in snapshots (767ebaf)
• Flag stale @internal tags in production mode (resolve #​1658) (dd1caed)
• Add compiler-extensions in tsc-files mode (resolve #​1708) (ea867ad)

v6.10.0: Release 6.10.0

Compare Source

• Ecosystem patches → snapshots (1803f9f)
• Fix unlisted pkg when only @​types/pkg listed (resolve #​1707) (62082b6)
• Don't report imports matching engines.X as unlisted (23582e0)
• Treat imports in .d.ts files as type-only (84caac5)
• Treat tsconfig compilerOptions.types as type-only (ce18854)
• Resolve hoisted deps from monorepo root in single-package mode (resolve #​1711) (23b756f)

v6.9.0: Release 6.9.0

Compare Source

• Expose types for JSON reporter (961b734)

v6.8.0: Release 6.8.0

Compare Source

• feat: add WXT plugin (#​1703) (9167557) - thanks @​sebastianbreguel!
• Add support for pnpm@​11 new commands (#​1706) (c937697) - thanks @​PatrykWalach!
• Fix case of spread export → other exports used (resolve #​1705) (0f94d2d)
• Add more pnpm commands + tests (f2819b3)
• Bump oxc-parser (5c21d27)

v6.7.0: Release 6.7.0

Compare Source

• Fix markdown reporter column width (resolve #​1700) (4713108)
• Handle Vitest agent and minimal reporters (#​1701) (a71ead1) - thanks @​dskwrite!
• Add e2e tests w/ tsgo defs + lib consumption (98113e6)
• Fix pkg name inconsistencies (544c3e6)
• Add export {} to maintain module shape (27d8a02)
• Strip leading UTF-8 BOM before parsing package.json (47e4029)
• Skip workspace with invalid JSON manifest (bfb4867)
• Preserve out-of-bound writes to stdout/err (95faad8)
• Consistent prefix in logError/logWarning (2c6d8a0)
• Don't exit on config file load error (0914bd3)
• Fix tsgo resolution in e2e tests (a689501)

v6.6.3: Release 6.6.3

Compare Source

• Use venz chart svg directly from CDN (ba7e907)
• Bump that plugin counter (abae75b)
• Fix plugin title (f2b8fcf)
• Work Table util class: fix bugs, tighten API, water-fill widths (2eb4045)
• Questionable.. (970a0db)
• Fmt (14538ec)
• Ensure output is flushed on exit (#​1699) (9533365) - thanks @​joshkel!
• Use currentColor to support light/dark themes (7ea055a)
• Tighten type-chain alignment + gate via ignoreExportsUsedInFile (resolve #​1698) (0910b33)
• Eating our own dog food ↻ (d5aa1f6)

v6.6.2: Release 6.6.2

Compare Source

• Don't track typeof value refs at top of exported type alias (resolve #​1697) (1a99048)
• Treat Props as used when Astro.props is referenced (resolve #​1629) (46cb338)
• Update dependencies (dcf5315)

v6.6.1: Release 6.6.1

Compare Source

• Fix website papercuts (#​1696) (c6d9c43) - thanks @​skoeva!
• fix(rslib): resolve entry points from rslib config (#​1695) (af83d68) - thanks @​rpereira-anchor!
• Update react-email plugin for react-email@​6 (#​1694) (200db55) - thanks @​krystofspiller!
• Introduce Manifest wrapper with scriptNames + getMajor helpers (6fded2f)

v6.6.0: Release 6.6.0

Compare Source

• picocolors → styleText (e7abd6b)
• @​nodelib/fs.walk → fdir (6f781b8)
• Improve performance, but only slightly (c2c0323)
• Fix package-entry hint for bare specifier in main (resolve #​1693) (2e8cf47)
• Extract vite.resolve.alias from Astro config AST (resolve #​1692) (fab5871)
• Add plugin-contributed source-map rules (e11c2b1)
• Add @sveltejs/package plugin (resolve #​1690) (8b2d402)
• Windows ❤️ (91964e4)

v6.5.0: Release 6.5.0

Compare Source

• Drop project-extension-redundant config hint (resolve #​1683) (f860929)
• Add instructions to .agents/PLUGINS.md (e2943ed)
• Add a plugin for react-email (#​1684) (d8ae4d3) - thanks @​xaqrox!
• Replace fast-glob with tinyglobby (#​1462) (9f6b4c8) - thanks @​gameroman!
• Added plugin for Serverless framework (#​1478) (f885f1d) - thanks @​BenCrinion-IW!
• Add args to Prettier plugin to resolve --config CLI flag (#​1685) (f4658c8) - thanks @​xaqrox!
• fix(util): tolerate JSONC and array extends in findRootDirsBase (#​1681) (f7e5464) - thanks @​Hoffs!
• Format (15bd7e7)
• Inherit outDir/rootDir from tsconfig project references (resolve #​1680) (b89b4f7)
• tsc → tsgo (a6e09ca)
• Update dependencies (4cb05c9)
• Housekeep (28c56cb)
• Test test test (7eb4ab3)
• Add pino plugin with transportCall visitor (resolve #​1480) (53a033e)
• Add signal to projects using knip (dbedd66)
• Tune logos (3148f4d)
• Tweak knip-run tool response (4294038)
• Add workspace option to knip-run tool (64c4aae)
• Remove old lingering experimentalTags (e503d10)
• Fix compiler type (resolve #​1689) (e7a69ad)

v6.4.1: Release 6.4.1

Compare Source

• license (2d3d8d8)
• Handle file path arguments in Bun plugin (resolve #​1678) (cdbe298)

v6.4.0: Release 6.4.0

Compare Source

• chore: change license file to have more conventional casing (#​1664) (ed97e6a) - thanks @​Zamiell!
• fix: whitelist spelling error (#​1666) (bcad120) - thanks @​Zamiell!
• Add Panda CSS plugin (#​1671) (7ab0d4d) - thanks @​Faithfinder!
• fix(rspack): detect plugins from swc-loader (#​1675) (1431ff3) - thanks @​TkDodo!
• docs: fix broken anchor link in DEVELOPMENT.md (#​1677) (e78c7f6) - thanks @​vincent067!
• Fix @jest-environment pragma resolution and limit pragma scope (3832364)
• Track Object enumeration to skip enum-member checks in nsTypes mode (a47aff5)
• Cache module resolution by directory + specifier (cefed38)
• Skip read+parse in walkAndAnalyze when the file cache will hit (25a7982)
• Collapse double statSync in FileEntryCache.reconcile (b63fbd9)
• Refactor walkAndAnalyze: dedupe cached/uncached paths (573df54)
• Cache glob results across --cache runs (6ab8de8)
• Mark namespace members used when enumerated via Object.* (dabf8ce)
• Add config hints for redundant/unregistered extensions (close #​1672, close #​1673) (0506895)
• Enable Tailwind CSS compiler for @​tailwindcss integrations (close #​1674) (f3ed14d)
• Resolve scss path aliases (resolve #​1676) (00ae83b)
• Re-gen plugins.md (35d8fab)
• Resolve path.join(__dirname, ...) in Worker/child_process calls (#​1660) (40a917e)
• license (608f0ed)

v6.3.1: Release 6.3.1

Compare Source

• Fix peer dependency resolution (#​1645) (0a6e93d) - thanks @​controversial!
• Support absolute file paths in react-router routes (#​1659) (97bb283) - thanks @​mpalmer685!
• Track namespace imports used as object property values (resolve #​1669) (c4d6b28)
• Split plugins/util smoke globs to fit Windows cmd.exe limit (33ef87d)

v6.3.0: Release 6.3.0

Compare Source

• Re-gen sponsorships chart (83ee489)
• Add testimonial (be16c54)
• Add deferred resolve entries as direct entry paths to avoid ws exclusion (91a1835)
• Add rolldown plugin (resolve #​1661) (44bfd62)
• Housekeep plugins a bit (dc69868)
• Improve module.register handling (b9e36ea)
• Housekeep release script (f81bd0f)

v6.2.0: Release 6.2.0

Compare Source

• Support tilde-prefixed scoped package names (e.g. @​~private/pkg) (#​1656) (947893d) - thanks @​MatissJanis!
• fix(storybook): mark vitest coverage deps as optional when addon-vitest is used (#​1654) (06e88d4) - thanks @​brick-pixel!
• Deduplicate module graph queue to avoid redundant file processing (#​1657) (e34d3b0) - thanks @​MatissJanis!
• Export KnipConfiguration type for dynamic config use cases (resolve #​1634) (4a64e0e)
• Release knip@​6.2.0 (d8c0161)

v6.1.1: Release 6.1.1

Compare Source

• Handle absolute Vitest test roots (#​1650) (898a412) - thanks @​filipw01!
• Fix reference types regex to allow extra attributes (resolve #​1649) (1d5f943)
• Update docs (close #​1614, close #​1615) (f1ac529)
• Release knip@​6.1.1 (fcfdabe)

v6.1.0: Release 6.1.0

Compare Source

• Add knip.nodeRuntimePath setting (resolve #​1643) (65e943c)
• Swap Astro sharp detection to match default behavior (#​1559) (84968bb)
• feat: stencil plugin (#​1644) (d5d20e5) - thanks @​johnjenkins!
• Enable metro plugin when expo is installed (#​1600) (14bc9d7) - thanks @​DaniFoldi!
• Resolve jsPlugins dependencies in oxlint plugin (#​1576) (e11c962) - thanks @​nikolailehbrink!
• Wrap up oxlint jsPlugins support (209a9f7)
• Update dependencies (close #​1646) (869020f)
• Fix config hint filePath edge case (e79c302)
• Rename oxlint config file in fixtures (5630204)

v6.0.6: Release 6.0.6

Compare Source

• Suppress issues initially to not overwhelm agent in mcp server (7793962)
• Auto-format (346247a)
• Fix false positive unused deps when run from workspace dir (resolve #​1642) (95f4431)
• Move from convertPathsToAlias → compilePathMappings (resolve #​1641) (ccc62d6)

v6.0.5: Release 6.0.5

Compare Source

• Fix up ecosystem pipeline, add sanity (a338b21)
• Fix broken links in Writing a Plugin docs (#​1640) (963f206) - thanks @​skoeva!
• Minor alignment edits to MCP texts.js (714089f)
• Merge JSDoc tags across function overload signatures (resolve #​1639) (6269ec3)
• Housekeep tag matching (b15bc7e)
• Housekeep reference type matching (d9c8731)
• fix(nx): fall back to workspace cwd when run-commands target has no cwd (#​1638) (cf2dc7d) - thanks @​liorp!
• Release knip@​6.0.5 (289bd9a)

v6.0.4: Release 6.0.4

Compare Source

• Defer ns member ref resolution to post-walk batch pass (resolve #​1633) (304504f)
• Show namespace member statuses in trace output (47ddf43)
• Add shadow detection for function params, arrow params, and catch bindings (70ebb76)
• Strip trailing slashes from tsconfig outDir and rootDir (resolve #​1635) (1dcdb02)

v6.0.3: Release 6.0.3

Compare Source

• Handle symlinks → real paths from tsconfig files (#​1630) (529810a)
• Filter empty strings from Qwik routesDir values (resolve #​1632) (beb8ae3)

v6.0.2: Release 6.0.2

Compare Source

• Add scope-aware shadow detection to fix false negatives from name-based matching (9ec38b3)
• Fix false negatives from overly broad collectRefsInType (261bd06)
• Add doc re. exports (f82d3ad)
• Bump get-tsconfig to 4.13.7, remove patch (resolve #​1630) (09bbce5)
• Pass on rootDirs to work around oxc-resolver feature gap (resolve #​1628) (4dc16cc)
• Update patches (836c2cf)

v6.0.1: Release 6.0.1

Compare Source

• Update sponsors (0659240)
• Handle computed access in local refs visitor (b998bab)

v6.0.0: Release 6.0.0

Compare Source

Blog post: Announcing Knip v6

See the pre-releases for details:

• https://github.com/webpro-nl/knip/releases/tag/knip%406.0.0-0
• https://github.com/webpro-nl/knip/releases/tag/knip%406.0.0-1
• https://github.com/webpro-nl/knip/releases/tag/knip%406.0.0-2
• https://github.com/webpro-nl/knip/releases/tag/knip%406.0.0-3

Breaking changes:

• Dropped support for Node.js v18 → Knip v6 requires Node.js v20.19.0 or newer
• Dropped issue type classMembers
• Dropped --include-libs → this is now the default and only behavior
• Dropped --isolate-workspaces → this is now the default and only behavior
• Dropped --experimental-tags → use --tags
• In reporter functions, issues.files is consistent with other issue shapes. Removed issues._files.
• In the JSON reporter, issues are consistently arrays for any issue type. Removed root files.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	knip@​5.88.1 ⏵ 6.21.0			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → npm/knip@6.21.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report