chore(deps): update devdependencies (major) - #428
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 10, 2025 16:47
baf6177 to
c6f4687
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
July 25, 2025 23:10
0d472cc to
b7a264c
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
from
July 29, 2025 20:31
b7a264c to
2a5f91e
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 12, 2025 02:51
875e206 to
ce3769a
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
August 19, 2025 10:35
781b29f to
0979286
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
5 times, most recently
from
August 27, 2025 15:56
b48cc3a to
ed834e7
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 6, 2025 22:54
c9fd260 to
b984190
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 10, 2025 13:29
ce4fc79 to
0fc5e29
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
3 times, most recently
from
September 22, 2025 06:11
617f9d5 to
d5af895
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
September 29, 2025 01:32
389dee2 to
b942834
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
8 times, most recently
from
October 29, 2025 07:58
7f47b7e to
0b27ccf
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
7 times, most recently
from
November 5, 2025 17:53
39ed51f to
6f72944
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
6 times, most recently
from
November 12, 2025 02:52
689c0a7 to
6ea173d
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
4 times, most recently
from
November 20, 2025 09:14
ab8d7f2 to
2a07453
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
November 27, 2025 15:38
dc2ac94 to
98d1fa6
Compare
renovate
Bot
force-pushed
the
renovate/major-devdependencies
branch
2 times, most recently
from
December 2, 2025 20:49
ee8f02a to
179ddd6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.2→^6.0.0^1.11.1→^3.0.0^1.1.1→^3.0.02.2.3→4.0.1^1.1.3→^3.0.0^2.0.2→^4.0.0^7.26.9→^8.0.0^7.27.1→^8.0.0^1.9.4→^2.0.0^25.0.0→^28.0.0^13.0.0→^15.0.0^16.0.0→^18.0.0^14.0.0→^17.0.0^1000.0.7→^1100.0.0^29.5.14→^30.0.0^22.13.8→^26.0.0^1.0.1→^2.0.07.0.3→10.1.0^9.0.0→^10.0.0^1.22.1→^2.0.0^29.7.0→^30.0.0^19.3.1→^23.0.0^8.0.4→^9.0.0^6.1.4→^7.0.0^5.8.2→^7.0.0^7.3.1→^8.0.0Release Notes
actions/toolkit (@actions/cache)
v6.2.0cache read denied:prefix on cache download failures (both the v2 twirp path and the v1_apis/artifactcachepath) and surface it as acore.warning(without failing the run).ACTIONS_CACHE_MODEenvironment variable: skip restore when the effective cache-mode does not permit reads (none,write-only) and skip save when it does not permit writes (none,read), logging a single non-fatalcore.infoline. WhenACTIONS_CACHE_MODEis unset or unrecognized, behavior is unchanged.v6.1.0cache write denied:prefix on cache reservation failures and surface it as acore.warning(without failing the run).v6.0.1@actions/coreto^3.0.1@actions/http-clientto^4.0.1@actions/ioto^3.0.2@azure/core-rest-pipelineto^1.23.0@azure/storage-blobto^12.31.0semverto^7.7.4v6.0.0import()instead ofrequire()v5.0.5@actions/globto0.5.1v5.0.4@actions/http-clientto3.0.2v5.0.3Prevent retries for rate limited cache operations 2243.
v5.0.1@azure/storage-blobfrom^12.13.0to^12.29.1#2213@azure/core-rest-pipelineinstead of deprecated@azure/core-http, which eliminates the transitive dependency onnode-fetch@2→whatwg-url@5→tr46@0.0.3that used the deprecated punycode modulev5.0.0@azure/ms-rest-jsdependency #2197TransferProgressEventtype is now imported from@azure/core-rest-pipelineinstead of@azure/ms-rest-js@actions/corefrom^1.11.1to^2.0.0#2198@actions/execfrom^1.0.1to^2.0.0#2198@actions/globfrom^0.1.0to^0.5.0#2198@actions/http-clientfrom^2.1.1to^3.0.0#2198@actions/iofrom^1.0.1to^2.0.0#2198node-fetchoverride to resolve audit vulnerabilities #2110actions/toolkit (@actions/core)
v3.0.1undicifrom6.23.0to6.24.1#2348v3.0.0import()instead ofrequire()v2.0.3@actions/http-clientto3.0.2v2.0.1v2.0.0actions/toolkit (@actions/exec)
v3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/http-client)
v4.0.1undicifrom6.23.0to6.24.0#2347v4.0.0import()instead ofrequire()v3.0.2undicifrom5.28.5to6.23.0v3.0.1v3.0.0actions/toolkit (@actions/io)
v3.0.2v3.0.1@actions/io/lib/io-utilv3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/tool-cache)
v4.0.0import()instead ofrequire()3.0.1
@actions/http-clientto3.0.23.0.0
@actions/core@actions/exec@actions/http-client@actions/io2.0.2
@actions/coreto v1.11.1 #1872uuidpackage #1824, #18422.0.1
@actions/http-client#10872.0.0
@actions/http-clientheadersparameter in the exported functiondownloadToolhas been narrowed from{ [header: string]: any }to{ [header: string]: number | string | string[] | undefined; }(that is,http.OutgoingHttpHeaders).This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
lockfileVersiontov2inpackage-lock.json#10251.7.1
1.7.0
isExplicitVersionandevaluateVersionsfunctions1.6.1
1.6.0
1.3.5
1.3.4
Here is the security issue that was fixed in the http-client 1.0.8 release
1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
extractTaron Windows1.1.2
extractTar1.0.0
v3.0.1@actions/http-clientto3.0.2v3.0.0@actions/core@actions/exec@actions/http-client@actions/iobabel/babel (@babel/core)
v8.0.1Compare Source
💥 Breaking Change
babel-core,babel-plugin-transform-object-rest-spread,babel-plugin-transform-runtime,babel-preset-env,babel-standalonepreset-env'suseBuiltIns(@nicolo-ribaudo)v8.0.0Compare Source
👓 Spec Compliance
babel-core💥 Breaking Change
babel-cli,babel-node,babel-plugin-proposal-decorators,babel-plugin-transform-classes,babel-plugin-transform-function-name,babel-plugin-transform-modules-commonjs,babel-plugin-transform-object-rest-spread,babel-plugin-transform-parameters,babel-plugin-transform-react-constant-elements,babel-plugin-transform-regenerator,babel-preset-env,babel-registermodules: auto(@nicolo-ribaudo)babel-plugin-transform-runtime,babel-runtime-corejs3,babel-runtime@babe/runtime-corejs3(@liuxingbaoyu)babel-parserlocations: "packed"(@liuxingbaoyu)🐛 Bug Fix
babel-generatorbabel-plugin-transform-modules-systemjs📝 Documentation
🏠 Internal
🏃♀️ Performance
babel-corebiomejs/biome (@biomejs/biome)
v2.5.10Compare Source
Patch Changes
#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.#11403
8f7786fThanks @Princesseuh! - Fixed a bare<in Astro text being treated as the start of a tag, such as<p>5 < 6 and 7 > 6</p>. As in HTML, a<that cannot open a tag is text and needs no escaping.#11438
3133ffaThanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.#11403
8f7786fThanks @Princesseuh! - Fixed #9165: an empty Astro expression such as<div>{}</div>no longer fails to parse. Astro renders{}as nothing.#11403
8f7786fThanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.#11403
8f7786fThanks @Princesseuh! - Added support for Astro's fragment shorthand.#11403
8f7786fThanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.#11403
8f7786fThanks @Princesseuh! - Fixed---being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its---lines are content.<!-- c --> --- this is text, not frontmatter ---#11403
8f7786fThanks @Princesseuh! - Fixed an Astro frontmatter block ending early on a line that merely starts with a dash.#11403
8f7786fThanks @Princesseuh! - Fixed the children of an Astro element carryingis:rawbeing parsed as markup instead of raw text. This now also covers<script>and<style>, whose contents Astro emits verbatim rather than processing, so they are no longer linted as JavaScript or CSS.#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting attribute names that start with a colon, such as:href.#11403
8f7786fThanks @Princesseuh! - Fixed the Astro parser failing to recover from a malformed closing tag such as<div></{<//, so that a later mistake is reported where it happens rather than cascading.#11403
8f7786fThanks @Princesseuh! - Fixed{inside an Astro<math>element opening an expression. MathML is foreign content where Astro parses no expressions, so LaTeX such asR^{2x}now survives as text.<svg>is unaffected.#11403
8f7786fThanks @Princesseuh! - Fixed{{at the start of an Astro expression being read as an interpolation. Astro has no{{ }}syntax, so{{ a: 1 }}and<Comp a={{ b: 1 }} />are object literals.#11403
8f7786fThanks @Princesseuh! - Fixed expressions inside an Astro<pre>or<textarea>being read as raw text. Astro parses both as ordinary elements, so their markup and interpolations are now parsed, and a variable used only inside one is no longer reported as unused.#11403
8f7786fThanks @Princesseuh! - Added support for template literal attribute values in Astro, such as<div class=`a ${b} c`>.#11403
8f7786fThanks @Princesseuh! - Fixed Astro rejecting HTML5 unquoted attribute values that contain`,=,'or", such as<a href=a=b>and<a href=a'b>.#11393
dec5a8fThanks @1678092075! - Fixed #11207:useStrictModeno longer reports Vue event handlers such as@click="count++".#11431
c065f99Thanks @levrik! - Fixed #11429: Variables and imports used by Vue same-name bindings such as:disabledorv-bind:disabledare no longer reported as unused.#11409
405dedbThanks @ematipico! - Fixed a memory leak in the LSP server where memory usage kept growing over long editor sessions.#11422
a51eff7Thanks @dyc3! - Fixed #11416: Biome no longer crashes when parsing incomplete{let}or{const}declarations in Svelte files.#11378
34b715cThanks @Netail! - Added extra rule sources from@eslint/css.biome migrate eslintdetects rules in your eslint configurations more reliably.#11403
8f7786fThanks @Princesseuh! - Fixed{#,{/,{:and{@being read as Svelte block openings in every HTML-like file. They are now Svelte-only, so in HTML, Vue and Angular files a sequence such as{#if x}is ordinary text instead of a parse error.#11443
8d45229Thanks @ematipico! - Fixed #11390:noFloatingPromisesno longer performs unnecessary type inference on call arguments when checking methods of non-generic class instances created withnew.#11425
9c2667bThanks @dyc3! - Fixed #6426: GritQL plugins now match and rewrite metavariables embedded in quoted strings.#11441
00317c3Thanks @dyc3! - Improved performance ofuseNamedCaptureGroup,noMisplacedAssertion,noSkippedTests,noExportsInTest,noDuplicateTestHooks,noIdenticalTestTitle,useTestHooksInOrder, anduseTestHooksOnTop.v2.5.9Compare Source
Patch Changes
#11321
41386f3Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.#11248
57b197eThanks @yanthomasdev! - Expanded the environment variable metadata used bybiome rageto includeBIOME_BINARY,BIOME_LOG_FILE, andRUST_BACKTRACEas well as reworded explanations for better readability.#11377
a8798eaThanks @Netail! - Added a new nursery ruleuseNamedLayerwhich disallows anonymous cascade layers.#11327
6771cf5Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.<div> <!-- first group --> + <!-- second group --> </div>#10312
ba8aa18Thanks @dyc3! - Added the nursery ruleuseTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacingw-4 h-4withsize-4.#11333
715e0cdThanks @kkkhs! - Fixed #11328:lint/nursery/useExpectnow recognizes Vitest Browser Modeexpect.element()calls as assertions.#11343
9b98211Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in@variant, such as@xland@max-xl. These previously produced a parse error and anoUnknownAtRulesdiagnostic.#11220
3e8c488Thanks @santichausis! - Fixed #9541:noUndeclaredVariables,noUnusedImports, andnoUnusedVariablesnow correctly recognise exported variables and functions declared in one embedded<script>block as usable from a sibling<script>block, in Svelte's<script module>/<script>pair and Vue's non-setup<script>blocks.For example, Biome no longer reports
greetas undeclared in the following Svelte component:#11300
36430ebThanks @dyc3! - Fixed the HTML formatter's whitespace handling formarquee,noscript,video,audio, andobjectelements.#11299
6559e6cThanks @jp-knj! - Added the nursery ruleuseAstroClientOnlyDirectiveValue, which reports Astroclient:onlydirectives without an initializer.For example,
<Component client:only />triggers the rule.#11365
7529811Thanks @MHJahanbakhsh! - Fixed #11229: TheuseGenericFontNamesrule now treatsmathas a valid generic font family.#11346
674f5f4Thanks @Jayllyz! - Fixed #11335:noComponentHookFactoriesnow reports ause-prefixed variable only when a function is assigned to it directly.#11334
c87c46aThanks @zkasuran! - Fixed #11317:noSvgWithoutTitleno longer reports ansvgthat uses the boolean shorthandaria-hidden(equivalent toaria-hidden={true}in React).#11364
13853b1Thanks @ematipico! - Fixed a bug whereuseJsxKeyInIterableincorrectly flagged Astro files.#11321
41386f3Thanks @dyc3! - Fixed #11315: Invalid CSS declarations in HTMLstyleattributes now produce parser diagnostics instead of causing a panic.#11325
67c3bf0Thanks @dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.#11367
fe5b5d4Thanks @ematipico! - Fixed TypeScriptcompilerOptions.pathsresolution when mapping targets omit./. Biome now resolves these targets relative to their configured path base.#11316
17e48d6Thanks @wanxiankai! - Fixed #11289: the safe fix fornoExtraBooleanCastnow preserves parentheses around nested conditional expressions.#11254
d25d113Thanks @dyc3! - Fixed #11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.#11221
85aac73Thanks @freeatnet! - Added the nursery rulenoUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.#11314
7ffb677Thanks @ematipico! - Fixed #11310: Restored the performance ofnoMisusedPromisesandnoFloatingPromiseswhen analyzed expressions share deep imported type paths.#11356
6cd3263Thanks @johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar,shadow/50).#11318
76059e9Thanks @johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:,@max-lg:,@min-[400px]:) and child and descendant variants (*:,**:).#11357
faa2074Thanks @johncarmack1984! - The Tailwind parser now accepts the legacy leading!important marker (!flex,hover:!p-4).#11344
f34e15cThanks @johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:,has-[+p]:), modifiers on variants (group-hover/menu:,@sm/main:), and arbitrary container-query sizes (@[400px]:).#11324
2f5d452Thanks @dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.#11312
e65f07eThanks @xosnos! - Added a new nursery ruleuseControlLabelfor both HTML and JSX, which reports interactive control elements (button,menuitem) without an accessible label.#11364
13853b1Thanks @ematipico! - Fixed SVG parsing for files with an XML declaration followed by aPUBLICdoctype, such as<?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.#11301
610ee28Thanks @dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such assource,track, orparam.v2.5.8Compare Source
Patch Changes
#10710
0a0fbc1Thanks @dyc3! - Added a new nursery ruleuseReactCompiler, which reports diagnostics from React Compiler lint mode.#11251
ea9dd8aThanks @dyc3! - Improved performance ofnoImportCycles.#11247
52b44d6Thanks @dyc3! - Added the nursery rulenoSvelteLegacyConst, which disallows legacy Svelte{@const}tags and recommends declaration tags with$derived().Invalid:
{#each boxes as box} {@const area = box.width * box.height} <p>{area}</p> {/each}Valid:
{#each boxes as box} {const area = $derived(box.width * box.height)} <p>{area}</p> {/each}#11252
d5f5704Thanks @Turtle-Hwan! - Fixed #11250:useAwaitno longer reports async functions that contain anawait usingdeclaration.#11143
6be7be1Thanks @vznh! - Fixed #11017:noUselessUndefinedno longer reportsreturn undefinedwhen the enclosing function has a return type annotation other thanundefinedorvoid.#11234
caefe39Thanks @subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.:root { --font-stack: -/* comment */ + /* comment */ system-ui; }#11285
bca1f73Thanks @denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.#11080 [
af16a0b](https://redirect.github.comConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.