chore(deps): update devdependencies (major) - #428
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 10, 2025 16:47
baf6177 to
c6f4687
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 25, 2025 23:10
0d472cc to
b7a264c
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
from
July 29, 2025 20:31
b7a264c to
2a5f91e
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 12, 2025 02:51
875e206 to
ce3769a
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
August 19, 2025 10:35
781b29f to
0979286
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 27, 2025 15:56
b48cc3a to
ed834e7
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 6, 2025 22:54
c9fd260 to
b984190
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 10, 2025 13:29
ce4fc79 to
0fc5e29
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
September 22, 2025 06:11
617f9d5 to
d5af895
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 29, 2025 01:32
389dee2 to
b942834
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
8 times, most recently
from
October 29, 2025 07:58
7f47b7e to
0b27ccf
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
7 times, most recently
from
November 5, 2025 17:53
39ed51f to
6f72944
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
6 times, most recently
from
November 12, 2025 02:52
689c0a7 to
6ea173d
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
4 times, most recently
from
November 20, 2025 09:14
ab8d7f2 to
2a07453
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
November 27, 2025 15:38
dc2ac94 to
98d1fa6
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
December 2, 2025 20:49
ee8f02a to
179ddd6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.2→^6.0.0^1.11.1→^3.0.0^1.1.1→^3.0.02.2.3→4.0.1^1.1.3→^3.0.0^2.0.2→^4.0.0^7.26.9→^8.0.0^7.27.1→^8.0.0^1.9.4→^2.0.0^25.0.0→^27.0.0^13.0.0→^14.0.0^16.0.0→^17.0.0^14.0.0→^16.0.0^1000.0.7→^1100.0.0^29.5.14→^30.0.0^22.13.8→^26.0.0^1.0.1→^2.0.07.0.3→10.1.0^9.0.0→^10.0.0^1.22.1→^2.0.0^29.7.0→^30.0.0^19.3.1→^23.0.0^8.0.4→^9.0.0^6.1.4→^7.0.0^5.8.2→^7.0.0^7.3.1→^8.0.0Release Notes
actions/toolkit (@actions/cache)
v6.2.0cache read denied:prefix on cache download failures (both the v2 twirp path and the v1_apis/artifactcachepath) and surface it as acore.warning(without failing the run).ACTIONS_CACHE_MODEenvironment variable: skip restore when the effective cache-mode does not permit reads (none,write-only) and skip save when it does not permit writes (none,read), logging a single non-fatalcore.infoline. WhenACTIONS_CACHE_MODEis unset or unrecognized, behavior is unchanged.v6.1.0cache write denied:prefix on cache reservation failures and surface it as acore.warning(without failing the run).v6.0.1@actions/coreto^3.0.1@actions/http-clientto^4.0.1@actions/ioto^3.0.2@azure/core-rest-pipelineto^1.23.0@azure/storage-blobto^12.31.0semverto^7.7.4v6.0.0import()instead ofrequire()v5.0.5@actions/globto0.5.1v5.0.4@actions/http-clientto3.0.2v5.0.3Prevent retries for rate limited cache operations 2243.
v5.0.1@azure/storage-blobfrom^12.13.0to^12.29.1#2213@azure/core-rest-pipelineinstead of deprecated@azure/core-http, which eliminates the transitive dependency onnode-fetch@2→whatwg-url@5→tr46@​0.0.3that used the deprecated punycode modulev5.0.0@azure/ms-rest-jsdependency #2197TransferProgressEventtype is now imported from@azure/core-rest-pipelineinstead of@azure/ms-rest-js@actions/corefrom^1.11.1to^2.0.0#2198@actions/execfrom^1.0.1to^2.0.0#2198@actions/globfrom^0.1.0to^0.5.0#2198@actions/http-clientfrom^2.1.1to^3.0.0#2198@actions/iofrom^1.0.1to^2.0.0#2198node-fetchoverride to resolve audit vulnerabilities #2110actions/toolkit (@actions/core)
v3.0.1undicifrom6.23.0to6.24.1#2348v3.0.0import()instead ofrequire()v2.0.3@actions/http-clientto3.0.2v2.0.1v2.0.0actions/toolkit (@actions/exec)
v3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/http-client)
v4.0.1undicifrom6.23.0to6.24.0#2347v4.0.0import()instead ofrequire()v3.0.2undicifrom5.28.5to6.23.0v3.0.1v3.0.0actions/toolkit (@actions/io)
v3.0.2v3.0.1@actions/io/lib/io-utilv3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/tool-cache)
v4.0.0import()instead ofrequire()3.0.1
@actions/http-clientto3.0.23.0.0
@actions/core@actions/exec@actions/http-client@actions/io2.0.2
@actions/coreto v1.11.1 #1872uuidpackage #1824, #18422.0.1
@actions/http-client#10872.0.0
@actions/http-clientheadersparameter in the exported functiondownloadToolhas been narrowed from{ [header: string]: any }to{ [header: string]: number | string | string[] | undefined; }(that is,http.OutgoingHttpHeaders).This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
lockfileVersiontov2inpackage-lock.json#10251.7.1
1.7.0
isExplicitVersionandevaluateVersionsfunctions1.6.1
1.6.0
1.3.5
1.3.4
Here is the security issue that was fixed in the http-client 1.0.8 release
1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
extractTaron Windows1.1.2
extractTar1.0.0
v3.0.1@actions/http-clientto3.0.2v3.0.0@actions/core@actions/exec@actions/http-client@actions/iobabel/babel (@babel/core)
v8.0.1Compare Source
💥 Breaking Change
babel-core,babel-plugin-transform-object-rest-spread,babel-plugin-transform-runtime,babel-preset-env,babel-standalonepreset-env'suseBuiltIns(@nicolo-ribaudo)v8.0.0Compare Source
👓 Spec Compliance
babel-core💥 Breaking Change
babel-cli,babel-node,babel-plugin-proposal-decorators,babel-plugin-transform-classes,babel-plugin-transform-function-name,babel-plugin-transform-modules-commonjs,babel-plugin-transform-object-rest-spread,babel-plugin-transform-parameters,babel-plugin-transform-react-constant-elements,babel-plugin-transform-regenerator,babel-preset-env,babel-registermodules: auto(@nicolo-ribaudo)babel-plugin-transform-runtime,babel-runtime-corejs3,babel-runtime@babe/runtime-corejs3(@liuxingbaoyu)babel-parserlocations: "packed"(@liuxingbaoyu)🐛 Bug Fix
babel-generatorbabel-plugin-transform-modules-systemjs📝 Documentation
🏠 Internal
🏃♀️ Performance
babel-corebiomejs/biome (@biomejs/biome)
v2.5.6Compare Source
Patch Changes
#11035
0e4b03bThanks @ematipico! - Fixed a performance regression innoMisusedPromisesthat caused type inference to run repeatedly while linting a file.#11043
22ec076Thanks @denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:.example { value: outer( 1, /* comment */ nested( - first, - second - ) + first, + second + ) ); }#11007
c9acb25Thanks @BTF-Kabir-2020! - Fixed #9195:useHookAtTopLevelno longer reports hooks in namedforwardRefcomponents that receive arefparameter.#10152
50a9bd8Thanks @Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g.cond ? (x) => ({ a, b }) => body : alt.#11105
8ffe2b9Thanks @dadavidtseng! - Fixed #11092: ThenoUselessTernaryquick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.#10533
5809875Thanks @Mokto! - Fixed #10515:biome check --writewas not idempotent on Svelte files — multi-line template literals in<script>blocks and block comments in<style>blocks gained an extra indent level on every run.#11040
0abb620Thanks @Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte{@​const ...}or{@​debug ...}block. The duplication compounded on every subsequent--write, causing the file to grow exponentially.#10858
6d18204Thanks @ruidosujeira! - Fixed #10839: Svelte{#each}array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.#11009
2c36626Thanks @ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example,noFloatingPromisesnow detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.The following statements are now reported:
#10973
9cb044cThanks @ematipico! - Fixed false positives innoMisleadingReturnTypewhen generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:#11071
15047a2Thanks @dyc3! - The HTML parser now accepts mixed-casedoctypedeclarations.#11030
cc90e65Thanks @marschattha! - Therdjsonreporter now populates the severity field of each diagnostic (ERROR,WARNING, orINFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.#11009
2c36626Thanks @ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.#11056
903b177Thanks @dyc3! - Added support for Svelte declaration tags usingletandconst. Biome can now parse, format, and lint bindings declared in these tags.#11045
89c27c6Thanks @ematipico! - Improved the performance of Biome formatter up to ~7% across the board.#9806
781d68dThanks @dyc3! - Added the nursery rulenoJsRestrictedProperties, which ports ESLint'sno-restricted-propertiesrule. Biome now flags restricted member access and object destructuring, andbiome migrate eslintpreserves the rule's options.v2.5.5Compare Source
Patch Changes
#10972
ab8c21bThanks @ematipico! - FixeduseExhaustiveSwitchCasesfor unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing2ncase:#10972
ab8c21bThanks @ematipico! - Fixed false positives innoBaseToStringanduseNullishCoalescingwhen member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:#10977
0bf7486Thanks @ematipico! - Fixed #10922: the actionuseSortedAttributesno longer triggers for HTML instructions.#10957
cf263c4Thanks @dyc3! - FixednoThenPropertyfailing to detectObject.fromEntries,Object.defineProperty, andReflect.definePropertycalls with comments between their tokens.#10983
edc0ed7Thanks @ayaangazali! - Fixed #10980:useAriaPropsSupportedByRoleno longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as<a {href} aria-label="...">in Astro and Svelte files.Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the
linkrole instead ofgeneric.#10889
89526e3Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.#10964
794ccd0Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and!important.#10993
b7a9694Thanks @denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.It now also keeps selectors with escaped newlines in attribute values inline when they fit.
#10978
8ebafe1Thanks @ematipico! - Fixed #10870:noUnresolvedImportsno longer reports false positives such asimport type { NextRequest } from "next/server".#10901
68c10e6Thanks @Socialpranker! - Fixed #10622: the HTML/Vue parser no longer panics on the argument-lessv-bindshorthand (:="props").This syntax is valid Vue and equivalent to
v-bind="props", so the parser now accepts it (along with the longhandv-bind:="props") instead of crashing while building a diagnostic for a missing argument.#10936
7df46f5Thanks @ematipico! - Improved generic tuple inference foruseIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.#10941
f787725Thanks @siketyan! - Fixed#10855: Biome now supports parsing and formatting CSS custom media queries declared with@custom-media.#10969
72d309bThanks @ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.e62f6b6Thanks @ematipico! - Fixed #10963: Biome no longer panics when a type-aware rule such asnoFloatingPromiseschecks a call to a function with multiple call signatures imported from another module.#10931
899c60dThanks @ematipico! - Fixedcheck --writecommand. Now the command reports code frame of the formatted code, if the formatter is enabled.#10904
ceee4f4Thanks @qzwxsaedc! - Fixed #10892:noUnnecessaryConditionsno longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:#10962
f0a67f2Thanks @ematipico! - Biome no longer removes embedded styles and scripts in HTML files.#11000
5039a1eThanks @ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.#10957
cf263c4Thanks @dyc3! - Improved the performance of thenoThenPropertylint rule by about 50%.#10992
4bf9b21Thanks @ematipico! - FixednoMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.For example, the following callback is now reported.
#10915
b3b12b3Thanks @Functionhx! - Added the rulenoNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like!foo === bar— due to operator precedence this evaluates as(!foo) === barwhich is almost always a mistake forfoo !== bar.The rule provides an unsafe fix that flips the operator.
#10970
bd1038bThanks @ematipico! - Improved overload selection fornoMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example,noMisusedPromisesnow reports the async callback passed to the synchronous overload:#10933
48a4abbThanks @ematipico! - FixeduseArrayFindto recognize bigint zero indexes.#10931
899c60dThanks @ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.#10969
72d309bThanks @ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.#10972
ab8c21bThanks @ematipico! - Fixed false positives innoMisusedPromisesanduseAwaitThenablewhen Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example,useAwaitThenableno longer reportsawait valuewhen the value's thenability is unknown:v2.5.4Compare Source
Patch Changes
#10665
55ff995Thanks @dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.#10894
f4fb10eThanks @ematipico! - Fixed #6392: On-type formatting no longer moves comments before anifstatement into its body.#10939
f2799dbThanks @Netail! - Fixed #10930:noLabelWithoutControlnow correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.#10945
ae15d98Thanks @Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.#10842
5e1abfeThanks @JamBalaya56562! - Fixed #9196:biome check --write --unsafeno longer hangs forever when applying thenoCommentTextcode fix.The rule's fix now wraps the comment in a real JSX expression container (
{/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.#10891
ecca79eThanks @ematipico! - Fixed#10885: prevented a module-inference regression introduced by a housekeeping change.#10886
60c8043Thanks @dyc3! - Fixed #10727: Biome now breaks the arguments of curriedtest.each,it.each,describe.each, andtest.forcalls when they exceed the configured line width.#10895
01a85f0Thanks @ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.v2.5.3Compare Source
Patch Changes
#10815
86613d5Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules@valuerules or scoped@keyframesnames end at EOF.#10534
da9b403Thanks @Mokto! - FixednoUnusedVariablesfalse positives in Svelte files: Svelte store subscriptions ($storereferences in templates now keep the underlyingstorebinding from being flagged), and$bindable()props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.#10827
098ba41Thanks @Aqu1bp! - Fixed #10698: ThenoUnsafeOptionalChainingrule now reports unsafe optional chains wrapped in TypeScriptas,satisfies, type assertion, and instantiation expressions, such asnew (value?.constructor as Constructor)().#10773
3c6513dThanks @otkrickey! - Fixed #10772:useVueValidVOnno longer reports a missing handler for v-on directives using a verb modifier (.stop/.prevent) without an expression, e.g.<div @​click.stop></div>. The rule also accepts the arg-less object syntax<div v-on="$listeners"></div>instead of reporting a missing event name.#10721
d83c66bThanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolvesError(...),new Error(...), optionalError#stack, and calls through indexed function values such ashandlers[0]()more accurately.#10865
6450276Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.[#10853](https://redire
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.