chore(release): prepare v0.5.2

.github/dependabot.yml

@@ -24,6 +24,11 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"
     commit-message:
       prefix: "ci"
       include: "scope"

.github/workflows/benchmark.yml

@@ -39,8 +39,6 @@ jobs:
       WEBPACK_COMMIT: e9e02fb312a904c04e151ebd08aaa03364a31513
       MADGE_VERSION: 8.0.0
       DPDM_VERSION: 4.3.0
-      NODE_VERSION: 24.x
-      BUN_VERSION: 1.4.2
       HYPERFINE_VERSION: 1.19.0
       RUNNER_LABEL: ubuntu-latest
     steps:
@@ -49,26 +47,20 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: voidzero-dev/setup-vp@6eb3ef76e48ad5aca2d217e4ee277786b3865699
         with:
-          node-version: ${{ env.NODE_VERSION }}
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: ${{ env.BUN_VERSION }}
+          cache: true
 
       - name: Install hyperfine
         uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: hyperfine@${{ env.HYPERFINE_VERSION }}
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: vp install --frozen-lockfile
 
       - name: Build current oxdg
-        run: bun run build
+        run: vp run build
 
       - name: Configure benchmark mode
         shell: bash

.github/workflows/ci.yml

@@ -23,36 +23,30 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24.x
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: voidzero-dev/setup-vp@6eb3ef76e48ad5aca2d217e4ee277786b3865699
         with:
-          bun-version: 1.4.2
+          cache: true
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: vp install --frozen-lockfile
 
       - name: Type check
-        run: bun run check
+        run: vp run check
 
       - name: Lint
-        run: bun run lint
+        run: vp run lint
 
       - name: Check formatting
-        run: bun run format:check
+        run: vp run format:check
 
       - name: Test
-        run: bun run test
+        run: vp run test
 
       - name: Build
-        run: bun run build
+        run: vp run build
 
       - name: Check package and report footprint
-        run: bun run release:check -- --report package-footprint.json --summary "$GITHUB_STEP_SUMMARY"
+        run: vp run release:check -- --report package-footprint.json --summary "$GITHUB_STEP_SUMMARY"
 
       - name: Benchmark explain query overhead
         run: node scripts/benchmark-explain.mjs --runs 15
@@ -77,16 +71,15 @@ jobs:
         with:
           node-version: ${{ matrix.node }}
 
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: voidzero-dev/setup-vp@6eb3ef76e48ad5aca2d217e4ee277786b3865699
         with:
-          bun-version: 1.4.2
+          cache: true
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: vp install --frozen-lockfile
 
       - name: Build
-        run: bun run build
+        run: vp run build
 
       - name: Smoke test CLI with Node.js
         run: node dist/cli/main.js src/index.ts --json

.github/workflows/pr-metrics.yml

@@ -58,15 +58,9 @@ jobs:
           path: corpus-webpack
           persist-credentials: false
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: voidzero-dev/setup-vp@6eb3ef76e48ad5aca2d217e4ee277786b3865699
         with:
-          node-version: 24.x
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-        with:
-          bun-version: 1.4.2
+          cache: true
 
       - name: Install hyperfine
         uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
@@ -77,8 +71,8 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          (cd base && bun install --frozen-lockfile)
-          (cd current && bun install --frozen-lockfile)
+          (cd base && vp install --frozen-lockfile)
+          (cd current && vp install --frozen-lockfile)
 
       - name: Measure build time
         shell: bash
@@ -92,8 +86,8 @@ jobs:
             --shell bash \
             --prepare 'rm -rf "$BASE/dist" "$CURRENT/dist"' \
             --export-json "$RUNNER_TEMP/build.json" \
-            'cd "$BASE" && bun run build' \
-            'cd "$CURRENT" && bun run build'
+            'cd "$BASE" && vp run build' \
+            'cd "$CURRENT" && vp run build'
 
       - name: Measure package footprint
         shell: bash

.github/workflows/release.yml

@@ -21,15 +21,9 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version: 24.x
-
-      - name: Set up Bun
-        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - uses: voidzero-dev/setup-vp@6eb3ef76e48ad5aca2d217e4ee277786b3865699
         with:
-          bun-version: 1.4.2
+          cache: true
 
       - name: Verify tag format and main ancestry
         shell: bash
@@ -47,25 +41,25 @@ jobs:
           fi
 
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: vp install --frozen-lockfile
 
       - name: Type check
-        run: bun run check
+        run: vp run check
 
       - name: Lint
-        run: bun run lint
+        run: vp run lint
 
       - name: Check formatting
-        run: bun run format:check
+        run: vp run format:check
 
       - name: Test
-        run: bun run test
+        run: vp run test
 
       - name: Build
-        run: bun run build
+        run: vp run build
 
       - name: Check package and report footprint
-        run: bun run release:check -- --output release-package --report package-footprint.json --summary "$GITHUB_STEP_SUMMARY"
+        run: vp run release:check -- --output release-package --report package-footprint.json --summary "$GITHUB_STEP_SUMMARY"
 
       - name: Verify package version matches tag
         shell: bash

AGENTS.md

@@ -3,7 +3,7 @@
 ## Project
 
 - `oxdg` is a modern CLI tool for analyzing JavaScript and TypeScript module dependencies, inspired by madge.
-- The project is an ESM TypeScript package. Use Node.js 22 or newer for the published CLI and Bun 1.4.2 for development commands.
+- The project is an ESM TypeScript package. Use Node.js 22 or newer for the published CLI and the current Bun release for development commands.
 - Keep relative TypeScript imports explicit with their `.ts` extension, matching the existing `NodeNext` configuration.
 
 ## Repository layout

CHANGELOG.md

@@ -4,11 +4,13 @@ All notable user-facing and maintenance changes to oxdg are documented here.
 
 The project follows [Semantic Versioning](https://semver.org/).
 
-## [Unreleased]
+## [0.5.2] - 2026-10-25
 
 ### Maintenance
 
-- Prepared the v0.5.1 release and updated changelog links.
+- Grouped minor and patch GitHub Actions updates in Dependabot pull requests.
+- The minimum required Node.js version is v22.23.4. See [Node.js — Wednesday, October 21, 2026 Security Releases](https://nodejs.org/ja/blog/vulnerability/october-2026-security-releases).
+- Use Vite Plus across workflows and follow its current Bun release instead of pinning Bun in CI or development requirements.
 
 ## [0.5.1] - 2026-10-10
 

CONTRIBUTING.md

@@ -15,7 +15,7 @@ Security vulnerabilities should follow [SECURITY.md](SECURITY.md), not the publi
 Requirements:
 
 - Node.js 22 or newer
-- Bun 1.4.2
+- The current Bun release
 
 Install dependencies: