[halqme]

This pull request prepares the oxdg project for the v0.5.2 release with several maintenance updates. The main changes include grouping minor and patch updates for GitHub Actions in Dependabot, updating several dependencies and dev dependencies, and raising the minimum required Node.js version for improved security.

Maintenance and release updates:

• Updated the version in package.json to 0.5.2 and documented the release in CHANGELOG.md. [1] [2]

Dependency updates:

• Bumped several dependencies and devDependencies (such as @dagrejs/dagre, ignore, oxc-parser, @types/bun, @types/node, vite, and vite-plus) to their latest compatible versions for improved stability and compatibility.

GitHub Actions and automation:

• Configured Dependabot in .github/dependabot.yml to group minor and patch updates for GitHub Actions, reducing pull request noise and simplifying dependency management.

Platform requirements:

• Increased the minimum required Node.js version to v22.23.4 in both package.json and the release notes, addressing recent security advisories. [1] [2]

[github-actions]

PR metrics

A lightweight comparison against the PR base. Lower values are better; timing measurements are informational and may vary on hosted runners.

Package footprint

Metric	main (572f545)	PR (c26a625)	Δ
Packed package	53.9 KiB	53.7 KiB	-0.2%
Unpacked package	184.0 KiB	183.1 KiB	-0.5%
Installed node_modules	9.9 MiB	10.0 MiB	+0.7%

Performance

Metric	main (572f545)	PR (c26a625)	Δ
Build	762.4 ms ± 67.2 ms	621.3 ms ± 34.4 ms	-18.5%
Hono · directory-wide	341.7 ms ± 8.0 ms	343.6 ms ± 5.2 ms	+0.6%
Hono · entrypoint	137.8 ms ± 2.7 ms	138.9 ms ± 3.1 ms	+0.8%
Webpack · directory-wide	744.9 ms ± 10.3 ms	751.5 ms ± 9.6 ms	+0.9%
Webpack · entrypoint	694.8 ms ± 11.5 ms	694.3 ms ± 9.8 ms	-0.1%

Measurement details

• Build: 2 warmups, 5 measured runs per revision.
• Hono (ESM / TypeScript): 098e11912ab244c5c33931de007f04dc8e3c2929; directory-wide and entrypoint workloads each use 5 warmups and 15 measured runs per revision.
• Webpack (CommonJS / JavaScript): e9e02fb312a904c04e151ebd08aaa03364a31513; directory-wide and entrypoint workloads each use 5 warmups and 15 measured runs per revision.
• Timing cells show mean ± standard deviation.
• Package footprint uses the same packed-package validation as release checks.
• These metrics do not gate the PR.