chore(deps): update dependency shiki to v3.20.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
shiki (source)	3.15.0 -> 3.20.0

---

Release Notes

shikijs/shiki (shiki)

v3.20.0

Compare Source

   🚀 Features

• cli: Add --format option for html output  -  by @​Divyapahuja31 in #​1211 (28dd0)

   🐞 Bug Fixes

• rehype: Handle promise rejections in lazy language loading  -  by @​ambujvashistha in #​1221 (99654)
• vitepress-twoslash: Fix popper positions being recomputed too early within vitepress code groups  -  by @​Dschungelabenteuer, charles.gruenais and @​antfu in #​1116 (19ea5)

   🏎 Performance

• core: Eliminate redundant tokenization call in tokenizeWithTheme  -  by @​ShivanshBhargava and @​NssGourav in #​1216 (c78b1)

    View changes on GitHub

v3.19.0

Compare Source

   🚀 Features

• Support rootStyle: false option  -  by @​khushthecoder and @​antfu in #​1184 (baf9a)
• transformers:
  • Add classActiveCode option to notation transformers  -  by @​GreenHacker420 in #​1171 (a6a44)
  • Add transformerRemoveComments  -  by @​Bitshifter-9, Copilot, @​crazylogic03 and @​antfu in #​1144 (f2ee3)
• twoslash:
  • Add context parameter to filter option  -  by @​siddu-09 in #​1173 (ac7f5)

   🐞 Bug Fixes

• Add typesVersions for legacy resolution support  -  by @​khushthecoder in #​1179 (100b7)
• core: Check embeddedLanguages in registry dependency check  -  by @​vamsi2246 in #​1178 (6ad16)
• monaco: Correctly handle sparse color map updates  -  by @​wcr-karan in #​1169 (38c7f)

    View changes on GitHub

v3.18.0

Compare Source

   🚀 Features

• transformers: Support zeroIndexed option to transformerMetaHighlight  -  by @​manak-sharma20 in #​1149 (c39ff)

   🐞 Bug Fixes

• core:
  • Correct offset calculation in mergeWhitespaceTokens  -  by @​Karthikeya1500 in #​1162 (15e73)
  • Allow langAlias to special languages, close #​1164  -  by @​antfu in #​1164 (45ab1)

    View changes on GitHub

v3.17.1

Compare Source

   🚀 Features

• core: Enhance string utils with robust edge case handling  -  by @​shekhar-narayan-mishra in #​1154 (a2b68)

   🐞 Bug Fixes

• core: Correctly parse 4-digit hex colors in dimColor  -  by @​shalini-saloni in #​1151 (fcdd3)
• monaco: Ensure correct color map update when switching themes  -  by @​shivank-1011 in #​1155 (d2e94)

    View changes on GitHub

v3.17.0

Compare Source

   🚀 Features

• cli: Support passing remote file url  -  by @​o-az in #​1139 (fb05a)
• core: Support embeddedLanguages alias for backwards compatibility  -  by @​Ipshita29 in #​1044 and #​1145 (3a367)
• monaco: Normalize theme tokenScopes and tighten monaco type import  -  by @​Simon-He95 in #​1140 (dc792)

   🐞 Bug Fixes

• monaco: Preserve Markdown font styles  -  by @​prempyla and @​antfu in #​1107 (e4dec)
• shiki: Rename createdBundledHighlighter to createBundledHighlighter  -  by @​tushar73-jet, Tushar and @​antfu in #​1135 (e6d21)
• transformers: Handle multi-token comments in rose-pine theme  -  by @​ish1416 and @​antfu in #​1118 (3e1bd)
• twoslash: Fix typo in twoslash-query-persisted, close #​1130, close #​981  -  by @​antfu in #​1130 and #​981 (55a17)
• types: Add 'plain' to PlainTextLanguage type  -  by @​kevinkucharczyk in #​1133 (156c5)

    View changes on GitHub

v3.16.0

Compare Source

   🚀 Features

• Update grammars  -  by @​antfu (02dab)

   🐞 Bug Fixes

• Enable decorations for structure: inline  -  by @​Aashish-Jha-11 and Aashish_Jha_1107 in #​1103 (8806b)
• Resolve vitest alias for wasm-inlined  -  by @​sahilsharda (2d7b3)
• transformers: Support comment-prefixed [code . highlight] markers in v3 notation matcher  -  by @​Hariksh in #​1102 (5068b)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Code Review: Update dependency shiki to v3.17.0

Summary

This is an automated dependency update from Renovate upgrading shiki from v3.15.0 to v3.17.0. The update includes two minor version bumps (v3.16.0 and v3.17.0) with bug fixes and new features.

---

✅ Code Quality & Best Practices

PASS - This is a clean dependency update with no code changes required.

• Package-lock.json properly updated with new versions
• All shiki-related packages upgraded consistently (@shikijs/core, @shikijs/engine-javascript, @shikijs/engine-oniguruma, @shikijs/langs, @shikijs/themes, @shikijs/types)
• Proper dependency tree structure maintained

---

✅ Potential Bugs or Issues

PASS - No concerns identified.

• VitePress uses shiki internally for syntax highlighting in markdown code blocks
• The project's VitePress config (docs/.vitepress/config.ts) specifies themes: github-light and github-dark
• Release notes indicate bug fixes for:
  • Monaco editor markdown font styles preservation
  • Typo fix in createdBundledHighlighter → createBundledHighlighter
  • Multi-token comments in rose-pine theme
  • Type system improvements

Note: Shiki is not directly imported in the TypeScript codebase - it's used by VitePress as a transitive dependency for code syntax highlighting.

---

✅ Performance Considerations

PASS - Performance improvements noted in v3.16.0.

• v3.16.0 includes grammar updates that may improve parsing performance
• New oniguruma-to-es update (v4.3.3 → v4.3.4) in engine-javascript may have performance optimizations
• No breaking changes or performance regressions mentioned in release notes

---

✅ Security Concerns

PASS - CI Security Audit completed successfully.

• CI pipeline shows: Security Audit: COMPLETED - SUCCESS
• No security vulnerabilities reported in the update
• All dependency resolutions appear clean in package-lock.json

---

✅ Test Coverage

PASS - All relevant tests passing.

CI Status:

• ✅ Lint Code: COMPLETED - SUCCESS
• ✅ Test: COMPLETED - SUCCESS
• ✅ Build: COMPLETED - SUCCESS
• ✅ Security Audit: COMPLETED - SUCCESS
• 🔄 Integration Tests: IN_PROGRESS (ubuntu, windows, macos)

Validation:
Since shiki is used by VitePress for documentation, manual verification recommended:

npm run docs:dev
# Verify syntax highlighting works in code blocks
npm run docs:build
# Verify production build completes successfully

---

📋 Release Notes Summary

v3.17.0 Changes:

• 🚀 CLI now supports remote file URLs
• 🚀 Backwards compatibility for embeddedLanguages alias
• 🚀 Monaco theme tokenScopes normalization
• 🐞 Multiple bug fixes (markdown fonts, typo fixes, type improvements)

v3.16.0 Changes:

• 🚀 Grammar updates
• 🐞 Inline decorations support
• 🐞 Comment-prefixed highlight markers support

---

✅ Recommendation

APPROVE - Safe to merge once integration tests complete.

This is a routine dependency update with:

• No breaking changes
• Bug fixes and minor feature additions
• All critical CI checks passing
• Consistent version updates across all @shikijs packages

Post-merge verification:
After merging, verify the GitHub Pages documentation site renders correctly with syntax highlighting working as expected: https://rshade.github.io/mcp-devtools-server/

---

📚 References

• shiki v3.17.0 Release Notes
• shiki v3.16.0 Release Notes
• VitePress Shiki Integration

[claude]

PR Review: Update shiki to v3.19.0

Summary

This PR updates the shiki syntax highlighter from v3.15.0 to v3.19.0, bringing 4 minor version updates with new features and bug fixes. Shiki is used by VitePress for code syntax highlighting in the documentation.

---

✅ Code Quality & Best Practices

PASS - This is a dependency update PR with:

• Clean, focused changes (only package-lock.json)
• Automated by Renovate with proper conventional commit format
• Follows semantic versioning (patch releases: 3.15.0 → 3.19.0)

---

🔍 Changes Analysis

Package Updates

The PR updates several shiki packages:

• shiki: 3.15.0 → 3.19.0
• @shikijs/core: 3.15.0 → 3.19.0
• @shikijs/engine-javascript: 3.15.0 → 3.19.0
• @shikijs/engine-oniguruma: 3.15.0 → 3.19.0
• @shikijs/langs: 3.15.0 → 3.19.0
• @shikijs/themes: 3.15.0 → 3.19.0
• @shikijs/types: 3.15.0 → 3.19.0

Notable Features (v3.16.0 - v3.19.0)

• v3.19.0: Support for rootStyle: false option, classActiveCode option, new transformerRemoveComments
• v3.18.0: zeroIndexed option for transformerMetaHighlight
• v3.17.0: CLI support for remote file URLs, improved embeddedLanguages alias support
• v3.16.0: Grammar updates, better inline decorations support

Bug Fixes

• Correct offset calculation in mergeWhitespaceTokens
• Fix 4-digit hex color parsing
• Better Monaco color map handling
• Improved type definitions

---

🐛 Potential Issues

LOW RISK - Minor version updates in a syntax highlighting library

Compatibility Check Needed:

• VitePress configuration uses markdown.theme with github-light and github-dark themes (config.ts:127-130)
• These themes should be unaffected by the update, but visual regression testing recommended

Package Lock Structure:

• The diff shows proper npm package-lock.json v3 structure with nested node_modules for type resolution
• Adds "dev": true flag to some dependencies, which is correct for devDependencies

---

🔒 Security Concerns

PASS - No security vulnerabilities identified

• This is NOT marked as a security update (unlike PR chore(deps): update dependency @modelcontextprotocol/sdk to v1.24.0 [security] #287 for MCP SDK)
• Shiki is a pure syntax highlighting library with no network access or shell execution
• Updates include community contributions from multiple developers
• All changes are from the official shikijs/shiki repository

---

⚡ Performance Considerations

NEUTRAL - Performance impact expected to be minimal

• Shiki is only used at documentation build time (VitePress)
• Not used in runtime server code
• Updates include optimizations:
  • Better color map handling (v3.19.0, v3.17.1)
  • Improved string utils with edge case handling (v3.17.1)

Build Performance:

• Should not affect npm run docs:build performance significantly
• May improve highlighting accuracy for edge cases

---

🧪 Test Coverage

VERIFICATION NEEDED - No direct code changes, but validation recommended

Recommended Testing:

1. Documentation Build:

   npm run docs:build
   npm run docs:preview

   Verify syntax highlighting works correctly for code blocks in docs

2. Visual Regression:

   • Check Go code examples in /docs/guides/go-development.md
   • Check TypeScript examples across documentation
   • Verify both light/dark themes render correctly

3. CI/CD:

   • GitHub Actions should automatically test docs deployment
   • Check workflow: .github/workflows/docs-deploy.yml

---

📋 Recommendations

✅ Safe to Merge IF:

1. CI/CD checks pass (build, lint, test)
2. Documentation preview looks correct (npm run docs:preview)
3. No visual regressions in syntax highlighting

📝 Optional Enhancements:

1. Add release notes to CHANGELOG.md mentioning improved syntax highlighting
2. Test new features like transformerRemoveComments if relevant for docs
3. Update VitePress itself in a future PR (currently v2.0.0-alpha.14, shiki updates may unlock features)

🎯 Action Items:

• Run npm run docs:build locally to verify build success
• Preview documentation to check syntax highlighting
• Verify CI/CD passes all checks
• Consider enabling new shiki features in VitePress config if useful

---

🎓 CLAUDE.md Compliance

Following repository guidelines:

• ✅ Dependency updates follow semantic versioning
• ✅ Conventional commit format: chore(deps): update dependency shiki to v3.19.0
• ✅ Automated by Renovate (bot user)
• ✅ Single focused change (package-lock.json only)

Note: Per CLAUDE.md, always run make lint-md for markdown changes, but this PR only touches package-lock.json, so markdown linting is not required.

---

🎉 Conclusion

RECOMMEND: APPROVE & MERGE pending successful CI/CD checks

This is a low-risk dependency update that brings incremental improvements to syntax highlighting. The shiki library is well-maintained with active community contributions and follows semantic versioning properly.

Risk Level: 🟢 LOW
Confidence: 🟢 HIGH
Merge Priority: Medium (non-blocking, quality-of-life improvement)

[claude]

Code Review: Shiki v3.15.0 → v3.20.0 Dependency Update

Summary

This is a Renovate-generated PR updating the shiki syntax highlighting library from v3.15.0 to v3.20.0. The update includes 5 minor version increments with bug fixes, performance improvements, and new features.

---

✅ Positive Observations

1. Clean Dependency Structure

• The diff shows proper dependency resolution with scoped versions for all @shikijs/* packages
• All related packages updated consistently to v3.20.0 (engine-javascript, engine-oniguruma, langs, themes, types)

2. VitePress Compatibility

• Shiki is used by VitePress for code syntax highlighting in the documentation site (docs/.vitepress/config.ts:126-131)
• The update aligns with VitePress's requirements and should improve rendering performance

3. Backward Compatible Changes

• All version increments are minor versions (3.15 → 3.20), indicating no breaking changes
• Release notes show mostly bug fixes and performance improvements

4. Notable Improvements from Release Notes

• Performance: Eliminated redundant tokenization in tokenizeWithTheme (v3.20.0)
• Bug Fixes: Promise rejection handling in lazy language loading (v3.20.0)
• Features: New transformerRemoveComments and other transformer enhancements

---

⚠️ Considerations & Testing Recommendations

1. Documentation Site Testing Required
Since this affects the VitePress docs, recommend testing:

# Build and preview docs locally
npm run docs:build
npm run docs:preview

Key areas to verify:

• Code blocks render correctly with syntax highlighting
• Both light theme (github-light) and dark theme (github-dark) work properly
• Line numbers display correctly (enabled in config)
• No console errors in browser developer tools

2. Dependency Graph Complexity
The diff shows duplication of @shikijs/types across multiple node_modules paths:

• node_modules/@shikijs/types (v3.15.0, marked dev: true)
• node_modules/@shikijs/engine-javascript/node_modules/@shikijs/types (v3.20.0)
• node_modules/@shikijs/engine-oniguruma/node_modules/@shikijs/types (v3.20.0)
• And 3 more instances...

This is expected with npm's dependency resolution but worth noting:

• Total package size increases from the duplication
• Could indicate peer dependency mismatches between main package and dev dependencies
• Consider running npm dedupe after merge to optimize

3. Build Verification
Run quality gates before merge:

make lint       # TypeScript/JavaScript linting
make test       # Full test suite  
make build      # Verify build passes
npm run docs:build  # Ensure docs build successfully

4. Bundle Size Impact

• Change adds +90 lines, removes -26 lines in package-lock.json
• Multiple new nested dependencies could increase bundle size
• For a docs-only dependency, this is acceptable, but worth monitoring

---

🔍 Security Considerations

1. Dependency Chain

• All updates are from official @shikijs/* packages published by trusted maintainer
• Renovate shows "confidence" badges in PR description, suggesting automated security scanning passed

2. Verification Steps

# Check for known vulnerabilities
npm audit

# Verify package integrity
npm ls shiki

---

📋 Recommendations

Before Merge:

1. ✅ Run npm install to verify lockfile resolves cleanly
2. ✅ Execute make all (install, check, build) to ensure CI pipeline passes
3. ✅ Test docs locally: npm run docs:build && npm run docs:preview
4. ✅ Visually verify code highlighting on docs site (both themes)
5. ⚠️ Check bundle size with npm ls shiki --depth=0 before/after

After Merge:

1. Monitor GitHub Pages deployment for any rendering issues
2. Consider running npm dedupe if bundle size is a concern
3. Verify production docs site at https://rshade.github.io/mcp-devtools-server/

---

🎯 Final Verdict

APPROVE with Testing ✅

This is a low-risk, high-value update that brings:

• Performance improvements (redundant tokenization eliminated)
• Bug fixes (promise rejection handling)
• Enhanced transformer capabilities

Risk Level: Low

• Minor version updates only (no breaking changes)
• Well-maintained library with active development
• Used only for documentation (not runtime code)

Recommendation: Merge after local docs testing confirms no rendering regressions.

---

📚 Related Files to Review

• docs/.vitepress/config.ts:126-131 - Shiki theme configuration
• package.json:59 - Shiki dependency declaration (needs manual update to ^3.20.0 after merge)

---

Reviewed by: Claude Sonnet 4.5 (Code Review Agent)
Review Date: 2025-12-12
PR: #275 - chore(deps): update dependency shiki to v3.20.0