chore(deps): update devdependencies (major) - #428
Closed
renovate[bot] wants to merge 1 commit into
Closed
Conversation
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 10, 2025 16:47
baf6177 to
c6f4687
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 25, 2025 23:10
0d472cc to
b7a264c
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
from
July 29, 2025 20:31
b7a264c to
2a5f91e
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 12, 2025 02:51
875e206 to
ce3769a
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
August 19, 2025 10:35
781b29f to
0979286
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 27, 2025 15:56
b48cc3a to
ed834e7
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 6, 2025 22:54
c9fd260 to
b984190
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 10, 2025 13:29
ce4fc79 to
0fc5e29
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
September 22, 2025 06:11
617f9d5 to
d5af895
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 29, 2025 01:32
389dee2 to
b942834
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
8 times, most recently
from
October 29, 2025 07:58
7f47b7e to
0b27ccf
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
7 times, most recently
from
November 5, 2025 17:53
39ed51f to
6f72944
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
6 times, most recently
from
November 12, 2025 02:52
689c0a7 to
6ea173d
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
4 times, most recently
from
November 20, 2025 09:14
ab8d7f2 to
2a07453
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
November 27, 2025 15:38
dc2ac94 to
98d1fa6
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
December 2, 2025 20:49
ee8f02a to
179ddd6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.2→^6.0.0^1.11.1→^3.0.0^1.1.1→^3.0.02.2.3→4.0.1^1.1.3→^3.0.0^2.0.2→^4.0.0^7.26.9→^8.0.0^7.27.1→^8.0.0^1.9.4→^2.0.0^25.0.0→^29.0.0^13.0.0→^15.0.0^16.0.0→^18.0.0^14.0.0→^18.0.0^1000.0.7→^1100.0.0^29.5.14→^30.0.0^22.13.8→^26.0.0^1.0.1→^2.0.07.0.3→10.1.0^9.0.0→^10.0.0^1.22.1→^2.0.0^29.7.0→^30.0.0^19.3.1→^23.0.0^8.0.4→^9.0.0^6.1.4→^7.0.0^5.8.2→^7.0.0^7.3.1→^8.0.0Release Notes
actions/toolkit (@actions/cache)
v6.2.0cache read denied:prefix on cache download failures (both the v2 twirp path and the v1_apis/artifactcachepath) and surface it as acore.warning(without failing the run).ACTIONS_CACHE_MODEenvironment variable: skip restore when the effective cache-mode does not permit reads (none,write-only) and skip save when it does not permit writes (none,read), logging a single non-fatalcore.infoline. WhenACTIONS_CACHE_MODEis unset or unrecognized, behavior is unchanged.v6.1.0cache write denied:prefix on cache reservation failures and surface it as acore.warning(without failing the run).v6.0.1@actions/coreto^3.0.1@actions/http-clientto^4.0.1@actions/ioto^3.0.2@azure/core-rest-pipelineto^1.23.0@azure/storage-blobto^12.31.0semverto^7.7.4v6.0.0import()instead ofrequire()v5.0.5@actions/globto0.5.1v5.0.4@actions/http-clientto3.0.2v5.0.3Prevent retries for rate limited cache operations 2243.
v5.0.1@azure/storage-blobfrom^12.13.0to^12.29.1#2213@azure/core-rest-pipelineinstead of deprecated@azure/core-http, which eliminates the transitive dependency onnode-fetch@2→whatwg-url@5→tr46@0.0.3that used the deprecated punycode modulev5.0.0@azure/ms-rest-jsdependency #2197TransferProgressEventtype is now imported from@azure/core-rest-pipelineinstead of@azure/ms-rest-js@actions/corefrom^1.11.1to^2.0.0#2198@actions/execfrom^1.0.1to^2.0.0#2198@actions/globfrom^0.1.0to^0.5.0#2198@actions/http-clientfrom^2.1.1to^3.0.0#2198@actions/iofrom^1.0.1to^2.0.0#2198node-fetchoverride to resolve audit vulnerabilities #2110actions/toolkit (@actions/core)
v3.0.1undicifrom6.23.0to6.24.1#2348v3.0.0import()instead ofrequire()v2.0.3@actions/http-clientto3.0.2v2.0.1v2.0.0actions/toolkit (@actions/exec)
v3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/http-client)
v4.0.1undicifrom6.23.0to6.24.0#2347v4.0.0import()instead ofrequire()v3.0.2undicifrom5.28.5to6.23.0v3.0.1v3.0.0actions/toolkit (@actions/io)
v3.0.2v3.0.1@actions/io/lib/io-utilv3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/tool-cache)
v4.0.0import()instead ofrequire()3.0.1
@actions/http-clientto3.0.23.0.0
@actions/core@actions/exec@actions/http-client@actions/io2.0.2
@actions/coreto v1.11.1 #1872uuidpackage #1824, #18422.0.1
@actions/http-client#10872.0.0
@actions/http-clientheadersparameter in the exported functiondownloadToolhas been narrowed from{ [header: string]: any }to{ [header: string]: number | string | string[] | undefined; }(that is,http.OutgoingHttpHeaders).This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
lockfileVersiontov2inpackage-lock.json#10251.7.1
1.7.0
isExplicitVersionandevaluateVersionsfunctions1.6.1
1.6.0
1.3.5
1.3.4
Here is the security issue that was fixed in the http-client 1.0.8 release
1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
extractTaron Windows1.1.2
extractTar1.0.0
v3.0.1@actions/http-clientto3.0.2v3.0.0@actions/core@actions/exec@actions/http-client@actions/iobabel/babel (@babel/core)
v8.0.1Compare Source
💥 Breaking Change
babel-core,babel-plugin-transform-object-rest-spread,babel-plugin-transform-runtime,babel-preset-env,babel-standalonepreset-env'suseBuiltIns(@nicolo-ribaudo)v8.0.0Compare Source
👓 Spec Compliance
babel-core💥 Breaking Change
babel-cli,babel-node,babel-plugin-proposal-decorators,babel-plugin-transform-classes,babel-plugin-transform-function-name,babel-plugin-transform-modules-commonjs,babel-plugin-transform-object-rest-spread,babel-plugin-transform-parameters,babel-plugin-transform-react-constant-elements,babel-plugin-transform-regenerator,babel-preset-env,babel-registermodules: auto(@nicolo-ribaudo)babel-plugin-transform-runtime,babel-runtime-corejs3,babel-runtime@babe/runtime-corejs3(@liuxingbaoyu)babel-parserlocations: "packed"(@liuxingbaoyu)🐛 Bug Fix
babel-generatorbabel-plugin-transform-modules-systemjs📝 Documentation
🏠 Internal
🏃♀️ Performance
babel-corebiomejs/biome (@biomejs/biome)
v2.5.12Compare Source
Patch Changes
#11440
b88f1eaThanks @Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.#11440
b88f1eaThanks @Princesseuh! - Fixed Astro attribute names being split on:and.inside an expression, such as{x && <button x-on:keyup.enter={go} client:load.foo />}.#11440
b88f1eaThanks @Princesseuh! - Fixed a bare>in the children of an Astro expression being treated as markup, such as{x && <div>a > b</div>}.#11440
b88f1eaThanks @Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.#11440
b88f1eaThanks @Princesseuh! - Fixedis:rawchildren inside an Astro expression being read as JSX, such as{x && <div is:raw>{not js} < & text</div>}.#11440
b88f1eaThanks @Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as{items.map((i) => <li>it's {i}</li>)}.#11440
b88f1eaThanks @Princesseuh! - Fixed the children of a<script>or<style>inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.#11440
b88f1eaThanks @Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as{x && <C data-x=`t${x}` />}.#11440
b88f1eaThanks @Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as{x && <a class=foo maxlength=255 href=/about>go</a>}.#11440
b88f1eaThanks @Princesseuh! - Fixed a template literal nested inside${}breaking the rest of an Astro file, such asconst href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.#11440
b88f1eaThanks @Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such asconst unsafe = /[/"]/;.#11508
54f3a2eThanks @dyc3! - Added the nursery ruleuseFlatMathMinMax. BecauseMath.min()andMath.max()accept any number of arguments, the rule reports unnecessary nested calls to the same method:The fix flattens this expression to
Math.max(a, b, c).#11585
c5c8315Thanks @Netail! - Fixed #11475:noUnresolvedImportsno longer reports Bun runtime built-in modules (bun,bun:bundle,bun:ffi,bun:jsc,bun:sqlite,bun:test).#11368
52a57b3Thanks @Austin1serb! - Fixed #6830: Biome now reports a diagnostic for excessively deep syntax instead of overflowing the native stack while releasing the parsed tree.#11596
1fc42edThanks @dyc3! - Added the nursery rulenoThisOutsideOfClass. The rule reportsthisoutside class members and TypeScript functions with an explicitthisparameter.#11555
2516335Thanks @dyc3! - Fixed #11529, wherenoFloatingPromisesmissed unhandled Promise chains when the imported function's module belonged to an import cycle. Cyclic modules now preserve types for exports that do not participate in recursive type dependencies.#11518
0fee70cThanks @HarperZ9! - Fixed #11500: the formatter now prints thedeclaremodifier before accessibility modifiers on class properties.private declare readonly name: stringis now formatted asdeclare private readonly name: string, matching Prettier and TypeScript's canonical modifier order.#11580
1277af2Thanks @ematipico! - Fixed #5091: Biome no longer moves comments next to the<of a generic, which causes invalid TypeScript syntax:#11577
42995d2Thanks @ematipico! - Fixed #4592. Biome no longer crashes while parsing malformeddeleteexpressions.#11590
67963b4Thanks @ematipico! - Fixed #6427 so Grit plugins can usefunction = ...as a node argument.#11600
a689cb5Thanks @ematipico! - Fixed #6644:noUnusedVariablesnow recognizes all interface declarations in a TypeScript declaration-merging group when the interface is referenced.The following snippet no longer triggers the rule.
#11591
d4a0716Thanks @ematipico! - Fixed #6615.noDuplicatePropertiesno longer reports declarations nested in block at-rules as duplicates of declarations in their parent block.#11492
f2a07aaThanks @santichausis! - Fixed #11454:noMisplacedAssertionnow recognises@fast-check/vitest'stest.prop(...)(and.concurrent.prop,.skip.prop, etc.) as a test function, the same way it already recognisestest.each. The JS formatter picks up the same recognition, so a curriedtest.prop(...)(...)call is now formatted with the regular breakable argument layout used fortest.each/test.for, instead of the single-line-hugging layout used for plainit/testcalls.For example, Biome no longer reports the assertion below as misplaced:
#11589
65742b3Thanks @ematipico! - Fixed #4928:noUnusedVariablesno longer reports a value declaration as unused when its merged namespace is referenced.#11559
472dbc2Thanks @levrik! - Fixed a false positive innoVueDuplicateKeyswhere a<script setup>variable initialized frompropswas reported as a duplicate of the prop it derives from. Biome now exempts any variable whose initializer referencesprops, instead of only recognizingdefineProps()andtoRefs(props).For example, Biome no longer reports
foobelow as a duplicate key:#11594
6586cebThanks @ematipico! - Fixed #6640. Biome no longer crashes when linting malformedfor...ofstatements.#11571
85b197dThanks @ematipico! - Fixed #10838:useSortedAttributesno longer corrupts JSX attributes when nested JSX elements also require sorting.#11533
97e76c0Thanks @ematipico! - Fixed #11520, where the Biome scanner would start analysing dependencies multiple times, leading to long and unresponsive sessions.#11564
18a0e1fThanks @Netail! - Fixed the diagnostic range ofnoInferrableTypesso it now highlights only the type instead of including the leading:colon, spaces and comments.#11540
124fdaaThanks @ematipico! - Fixed#11537:noShorthandPropertyOverridesnow compares declarations only within the same block. The rule no longer reports@supportsfeature queries and correctly checks nested,@keyframes, and@pageblocks.#11532
7ceb0eeThanks @dyc3! - Fixed #11528:noFloatingPromisesno longer reports statement-levelawaitexpressions that handle Promise values, including overloaded calls returning Promise aliases. Awaited values that resolve to arrays of Promises remain reported because their element Promises are not handled byawait.#11474
3c6412eThanks @dyc3! - Fixed #10241. Biome no longer reports unsupported text expression diagnostics for double-curly text in vanilla HTML, and the formatter preserves adjacent curly-brace text.#11593
6c7fd27Thanks @dyc3! - Added the nursery rulenoVueDeprecatedScopedSlots. It reports deprecated$scopedSlotsreferences in Vue templates and component objects, and offers an unsafe replacement with$slots. For example, Biome now reportsthis.$scopedSlots.defaultinside a Vue component.#11440
b88f1eaThanks @Princesseuh! - Fixed the formatter crashing on an Astro or Svelte expression spanning several lines in a file with CRLF line endings, such as<p>{a +\r\n b}</p>.#11581
f4e5ebbThanks @dyc3! - Added the nursery ruleuseModernMathApis. The rule reports legacy mathematical patterns that have direct modernMathequivalents.#11597
a20f44aThanks @Netail! - Added the nursery rulenoBunModules, which forbids the use of Bun builtin modules (e.g.bun:sqlite,bun:ffi).#11545
7d54688Thanks @dyc3! - Fixed #11542: Biome now reports HTML comments between Svelte tag attributes as parse errors.#11582
b6611ddThanks @ematipico! - Fixed #3862. Biome now parses legacy Internet Explorerfilterand-ms-filtervalues such asprogid:DXImageTransform...andalpha(opacity=40).#11575
65da251Thanks @dyc3! - Improved the Tailwind parser's ability to recover from parsing failures. Whitespace now always allows the parser to recover and start parsing a new class.#11576
0f78499Thanks @ematipico! - Fixed #3515 and #10395, where Biome could corrupt Unicode characters while writing source received through standard input to standard output. Characters such as⚠and✔are now preserved.#11539
0fca643Thanks @ematipico! - Fixed #11512, wherestyle/noDescendingSpecificitymissed lower-specificity selectors after a later higher-specificity selector with the same tail selector.#11544
040f867Thanks @dyc3! - Fixed #11541: formatting a Svelte render tag followed by an HTML comment no longer duplicates the comment.<div> {@render children?.()} <!-- comment --> - <!-- comment --> </div>#11565
ee69e0eThanks @ematipico! - Fixed #11525. Now the configuration schema correctly provides auto-completion for linter domains.#11583
b19390cThanks @dyc3! - Fixed #11352:useExplicitLengthCheckno longer reportslength-like properties used as value-producing||fallbacks or optional chains, and it no longer offers fixes for value-producing&&checks or unsafe negations.#11562
753e955Thanks @ematipico! - Fixed an issue where the Biome Language Server would start with logging level set to debug. This would cause logs to grow exponentially in long sessions.#11217
7d3ee9cThanks @dyc3! - Fixed handling ofbiome-ignore formatsuppression comments on TypeScript declared class properties with string literal names.#11497
f5d7896Thanks @dyc3! - Added thenoInvalidFileInputAcceptnursery rule. The rule reports invalid literalacceptvalues on file inputs in JSX and HTML, and normalizes common mistakes.#11345
ac58958Thanks @jakeleventhal! - Improved type inference performance by avoiding resolution of unused members in object arguments.#11554
2d55931Thanks @Netail! - Added the new nursery ruleuseReactNamingConvention, which enforces naming conventions for React values assigned fromcreateContext,useId, anduseRef. A value fromcreateContextmust be a PascalCase component name ending withContext, a value fromuseIdmust be namedidor end withId, and a value fromuseRefmust be namedrefor end withRef.#11491
1d6210bThanks @dyc3! - Added the nursery rulenoUnmodifiedLoopCondition, which reports variables in loop conditions that are never modified in the loop.v2.5.11Compare Source
Patch Changes
#11499
9743d0cThanks @scs0209! - Fixed #11496:useValidAnchornow treats Astro JSX shorthand attributes like<a {href}>as a validhref.#11437
88f805eThanks @Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.#11437
88f805eThanks @Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as{cond && <br>}.#11507
e2fc036Thanks @dyc3! - Fixed #11157:noUnusedVariablesno longer reports Vue<script setup>bindings used by CSSv-bind()as unused.#11398
afc4615Thanks @dyc3! - Fixed #11389: Files passed through--stdin-file-pathnow use full HTML support for Astro, Svelte, and Vue when it is enabled.#11526
372cd68Thanks @dyc3! - FixednoVueRefAsOperandto track Vue refs through declaration aliases andtoRefs()properties, and to recognizeuseTemplateRef()results. The rule no longer reports false positives such as plain ref transfers, plaintoRefs()property access,defineModel()modifiers, or the supported.effectmember as operands.The refactor enabling these fixes also improves the performance of the rule.
#11458
a7cd286Thanks @dyc3! - Fixed #11436: GritQL snippets such asexport { $specifiers } from $sourcenow match named re-exports with aliases, inlinetypemodifiers, and multiple specifiers.#11515
382b15dThanks @dyc3! - Fixed #11390, wherenoFloatingPromisesperformed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.#11516
6f40e82Thanks @levrik! - FixednoVueRefAsOperandso it no longer reports a callback parameter (e.g. from.find(),.map()) as an unwrapped ref value just because it's nested inside aref(),computed(), or similar call.Previously,
itemhere was incorrectly treated as a ref value because the rule attributed it to the outercomputed()call.#11495
496268dThanks @Netail! - FixeduseGraphqlNamingConventionso it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.#11407 [
6ef52b0](https://redirect.github.com/biomejs/biome/commit/6ef52bConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.