build(deps-dev): bump the development-dependencies group across 1 directory with 49 updates

[dependabot]

Bumps the development-dependencies group with 49 updates in the / directory:

Package	From	To
@ai-sdk/gateway	3.0.132	4.0.67
@ai-sdk/provider	3.0.8	4.0.8
@ai-sdk/provider-utils	4.0.23	5.0.32
@ai-sdk/react	3.0.208	4.0.86
@axe-core/playwright	4.12.1	4.13.0
@base-ui/react	1.5.0	1.7.0
@biomejs/biome	2.4.13	2.5.11
@opentelemetry/api	1.9.0	1.9.1
@pierre/trees	1.0.0-beta.3	1.0.0-beta.6
@playwright/test	1.61.1	1.62.1
@radix-ui/react-dialog	1.1.15	1.1.23
@radix-ui/react-dropdown-menu	2.1.16	2.1.24
@radix-ui/react-toggle-group	1.1.15	1.1.19
@radix-ui/react-tooltip	1.2.8	1.2.16
@storybook/addon-a11y	10.5.0	10.5.10
@storybook/addon-vitest	10.5.0	10.5.10
@storybook/react-vite	10.5.0	10.5.10
@tailwindcss/postcss	4.3.1	4.3.3
@tanstack/react-table	8.21.3	9.2.3
@tanstack/react-virtual	3.14.5	3.14.10
@testing-library/jest-dom	6.9.1	7.0.1
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.6
@types/node	25.9.3	26.4.0
@vercel/oidc	3.2.0	3.8.5
@vitejs/plugin-react	6.0.2	6.1.1
@xyflow/react	12.11.2	12.11.5
axe-core	4.12.1	4.13.0
electron	41.7.2	44.0.0
jsdom	29.1.1	30.0.1
lucide-react	1.18.0	1.35.0
material-icon-theme	5.36.1	5.38.1
motion	12.40.0	13.1.1
nanoid	5.1.11	6.0.1
react	19.2.5	19.2.8
@types/react	19.2.17	19.2.18
react-dom	19.2.5	19.2.8
@types/react-dom	19.2.3	19.2.5
react-resizable-panels	4.12.1	4.12.3
shadcn	4.11.0	4.19.0
shiki	4.2.0	4.4.3
storybook	10.5.0	10.5.10
streamdown	2.5.0	2.6.0
tailwindcss	4.3.1	4.3.3
tsx	4.22.4	4.23.12
typescript	6.0.3	7.0.2
vite	8.0.16	8.2.2
vitest	4.1.10	4.1.11
zustand	5.0.14	5.0.15

Updates @ai-sdk/gateway from 3.0.132 to 4.0.67

Release notes

Sourced from @​ai-sdk/gateway's releases.

@​ai-sdk/gateway@​3.0.185

Patch Changes

• cc23556: Mark transient network errors that occur while reading successful response bodies as retryable.
• 823cc03: Backport: chore(provider/gateway): update gateway model settings files
• 3f96cf8: Backport: chore(provider/gateway): update gateway model settings files
• Updated dependencies [cc23556]
  • @​ai-sdk/provider-utils@​4.0.50

Changelog

Sourced from @​ai-sdk/gateway's changelog.

4.0.67

Patch Changes

• 0e7994c: chore(provider/gateway): update gateway model settings files
• Updated dependencies [3e125ba]
  • @​ai-sdk/provider-utils@​5.0.32

4.0.66

Patch Changes

• 81bebaf: Add GLM-5.3-Flash model support to the Z.AI provider and AI Gateway.

4.0.65

Patch Changes

• 80227cf: chore(provider/gateway): update gateway model settings files
• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• 5533946: Remove the internal-only relevance_score and citation_number fields from published Tako Search response types and schemas. Code that reads either field must be updated; Gateway responses still pass the values through at runtime, but they are no longer typed. Also document data surcharge controls.
• Updated dependencies [a9782e1]
• Updated dependencies [35841f5]
• Updated dependencies [d2f3353]
  • @​ai-sdk/provider-utils@​5.0.31

4.0.64

Patch Changes

• 591d25b: feat: add batch completion webhooks. experimental_startTextBatch accepts a webhookUrl, and the gateway provider registers it through the batch callbackUrl contract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.
• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8
  • @​ai-sdk/provider-utils@​5.0.30

4.0.63

Patch Changes

• e12e068: chore(provider/gateway): update gateway model settings files

4.0.62

Patch Changes

• a371615: feat (provider/gateway): add Tako Search tool support
• Updated dependencies [b74971f]

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• 34c4710 Version Packages (#19716)
• 81bebaf feat(provider/zai,gateway): add GLM-5.3-Flash model support (#19701)
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• 80227cf chore(provider/gateway): update gateway model settings files (#19507)
• a9782e1 fix(batch): align result parsing, request counts, and behavior across provide...
• 5533946 address gateway tako search tool feedback (#19466)
• 3d3afac Version Packages (#19362)
• 591d25b feat: batch completion webhooks via startTextBatch webhookUrl (#19305)
• Additional commits viewable in compare view

Updates @ai-sdk/provider from 3.0.8 to 4.0.8

Changelog

Sourced from @​ai-sdk/provider's changelog.

4.0.8

Patch Changes

• 591d25b: feat: add batch completion webhooks. experimental_startTextBatch accepts a webhookUrl, and the gateway provider registers it through the batch callbackUrl contract and exports typed async-job metadata. Direct Anthropic and OpenAI batch providers return an unsupported warning when the option is provided.

4.0.7

Patch Changes

• ad6a650: feat(video): allow aspectRatio: 'adaptive' on generateVideo

  Some video models derive the output ratio from the input and reject explicit {width}:{height} values — BytePlus Seedance 2.5 does this for first-frame, first-and-last-frame, editing, and extension tasks. aspectRatio on VideoModelV3CallOptions, VideoModelV4CallOptions, and experimental_generateVideo is now `${number}:${number}` | 'adaptive', so those calls no longer need a type assertion. Support is provider-specific.

4.0.6

Patch Changes

• 3469d0c: feat: add batch APIs

4.0.5

Patch Changes

• 79e133c: async APIs for generateVideo (poll, webhook)

  Adds an asynchronous start/status flow to the experimental video model interface (VideoModelV4): models may now implement doStart, doStatus, and handleWebhookOption instead of (or in addition to) doGenerate, and experimental_generateVideo accepts poll and webhook options to orchestrate completion via polling or webhooks. Polling configuration can use a custom delay implementation for durable workflow compatibility.

4.0.4

Patch Changes

• 1e2f324: feat: add experimental speech translation model specification (Experimental_SpeechTranslationModelV4) and experimental_streamTranslate for streaming speech-to-speech translation

4.0.3

Patch Changes

• 0f93c57: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation

... (truncated)

Commits

• 3d3afac Version Packages (#19362)
• 591d25b feat: batch completion webhooks via startTextBatch webhookUrl (#19305)
• 63db193 Version Packages (#18587)
• ad6a650 feat(video): allow aspectRatio: 'adaptive' on generateVideo (#18586)
• bb31e6b Version Packages (#18508)
• 3469d0c feat: batch (#18346)
• 9df82a8 Version Packages (#18368)
• 79e133c feat(video): externalize polling control and webhook support for generateVide...
• 8fd84f0 Version Packages (#17983)
• 1e2f324 feat(provider,ai): translation model spec + experimental_streamTranslate (#17...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/provider since your current version.

Updates @ai-sdk/provider-utils from 4.0.23 to 5.0.32

Release notes

Sourced from @​ai-sdk/provider-utils's releases.

@​ai-sdk/provider-utils@​4.0.50

Patch Changes

• cc23556: Mark transient network errors that occur while reading successful response bodies as retryable.

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.32

Patch Changes

• 3e125ba: Allow manual tool approval statuses to include a reason and preserve it across core, model, and UI approval requests. OPA requires-approval decisions now surface their reason to human approvers. UI request chunks serialize the optional reason, while UI messages retain it as approval.requestReason separately from an approver's response reason.

5.0.31

Patch Changes

• a9782e1: fix: align batch result parsing, request counts, and lifecycle behavior across providers
• 35841f5: feat: normalize mid-stream provider error events across supported providers into public StreamProviderError instances and preserve provider-owned type, code, status, retry, and raw payload metadata
• d2f3353: Split OpenAI and Azure OpenAI embedding requests by a conservative UTF-8 byte budget derived from their aggregate token limit, in addition to input count limits.

5.0.30

Patch Changes

• Updated dependencies [591d25b]
  • @​ai-sdk/provider@​4.0.8

5.0.29

Patch Changes

• b74971f: Preserve schema-valued additional properties when converting Zod 4 schemas.

5.0.28

Patch Changes

• e6087c9: fix: handle empty string tool call IDs

5.0.27

Patch Changes

• 7fbfc6d: Preserve streamed download size-limit errors when response cancellation fails.

5.0.26

Patch Changes

• 401a4ba: fix(provider-utils): allow imports in runtimes without a global fetch function

5.0.25

... (truncated)

Commits

• c93fa8d Version Packages (#19748)
• 3e125ba fix: human tool approval requests omit policy reasons (#19658)
• a01c481 Version Packages (#19478)
• 35841f5 feat: normalize mid-stream provider error events into public typed errors wit...
• d2f3353 fix: split large embedding batches that exceed provider aggregate token limit...
• a9782e1 fix(batch): align result parsing, request counts, and behavior across provide...
• 3d3afac Version Packages (#19362)
• ed857f5 Version Packages (#19296)
• b74971f fix: Zod 4 record and catchall value schemas being erased during JSON Schema ...
• 97a9489 Version Packages (#19085)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ai-sdk/provider-utils since your current version.

Updates @ai-sdk/react from 3.0.208 to 4.0.86

Release notes

Sourced from @​ai-sdk/react's releases.

@​ai-sdk/react@​3.0.275

Patch Changes

• Updated dependencies [e822a1d]
• Updated dependencies [8c51a25]
• Updated dependencies [cc23556]
  • ai@6.0.272
  • @​ai-sdk/provider-utils@​4.0.50

Changelog

Sourced from @​ai-sdk/react's changelog.

4.0.86

Patch Changes

• Updated dependencies [8dd86a9]
• Updated dependencies [fda13b3]
• Updated dependencies [957146c]
• Updated dependencies [ce6849a]
  • ai@7.0.83

4.0.85

Patch Changes

• Updated dependencies [3e125ba]
  • ai@7.0.82
  • @​ai-sdk/provider-utils@​5.0.32
  • @​ai-sdk/mcp@​2.0.39

4.0.84

Patch Changes

• ai@7.0.81

4.0.83

Patch Changes

• Updated dependencies [a9782e1]
• Updated dependencies [bf591f0]
• Updated dependencies [35841f5]
• Updated dependencies [fe69342]
• Updated dependencies [d2f3353]
• Updated dependencies [eed7950]
  • @​ai-sdk/provider-utils@​5.0.31
  • @​ai-sdk/mcp@​2.0.38
  • ai@7.0.80

4.0.82

Patch Changes

• Updated dependencies [b251584]
• Updated dependencies [1175434]
• Updated dependencies [591d25b]
• Updated dependencies [9de0baf]
  • ai@7.0.79
  • @​ai-sdk/mcp@​2.0.37
  • @​ai-sdk/provider@​4.0.8

... (truncated)

Commits

• 0379422 Version Packages (#19778)
• c93fa8d Version Packages (#19748)
• 34c4710 Version Packages (#19716)
• a01c481 Version Packages (#19478)
• 3d3afac Version Packages (#19362)
• 5b64c39 Version Packages (#19341)
• ed857f5 Version Packages (#19296)
• ab58156 Version Packages (#19266)
• 7c5162f Version Packages (#19262)
• c0fa76a Version Packages (#19235)
• Additional commits viewable in compare view

Updates @axe-core/playwright from 4.12.1 to 4.13.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.13.0

What's Changed

• ci: use pat instead of github token by @​Garbee in dequelabs/axe-core-npm#1334
• chore: bump nyc from 17.1.0 to 18.0.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1311
• chore: increase timeout for axe-core update by @​Garbee in dequelabs/axe-core-npm#1354
• chore: pin node by @​Garbee in dequelabs/axe-core-npm#1355
• test: fix webdriverio esmTest.mjs by @​straker in dequelabs/axe-core-npm#1356
• chore: disable dependabot rebase strategy by @​Garbee in dequelabs/axe-core-npm#1344
• chore: bump actions/checkout from 6 to 6.0.2 in the gha-low-risk group by @​dependabot[bot] in dequelabs/axe-core-npm#1357
• ci: increase timeout for axe-core update by @​Garbee in dequelabs/axe-core-npm#1360
• chore: exclude test/release from npm workspaces by @​Garbee in dequelabs/axe-core-npm#1361
• chore: bump axios from 1.14.0 to 1.17.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1358
• chore: merge master into develop by @​michael-siek in dequelabs/axe-core-npm#1362
• chore: declare @​eslint/js and group eslint deps for dependabot by @​Garbee in dequelabs/axe-core-npm#1348
• chore: bump actions/checkout from 6.0.2 to 6.0.3 in the gha-low-risk group by @​dependabot[bot] in dequelabs/axe-core-npm#1363
• chore: group browser-driver and jest deps for dependabot by @​Garbee in dequelabs/axe-core-npm#1365
• chore: bump flatted from 3.3.1 to 3.4.2 by @​dependabot[bot] in dequelabs/axe-core-npm#1301
• chore: bump handlebars from 4.7.8 to 4.7.9 by @​dependabot[bot] in dequelabs/axe-core-npm#1305
• chore: bump fast-xml-parser from 5.5.1 to 5.8.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1325
• chore: bump lodash from 4.17.21 to 4.18.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1337
• chore: bump ip-address and socks by @​dependabot[bot] in dequelabs/axe-core-npm#1339
• chore: bump fast-xml-builder from 1.1.0 to 1.2.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1342
• chore: bump basic-ftp from 5.2.0 to 5.3.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1341
• chore: bump qs from 6.14.0 to 6.15.2 by @​dependabot[bot] in dequelabs/axe-core-npm#1349
• chore: bump tmp from 0.2.5 to 0.2.7 by @​dependabot[bot] in dequelabs/axe-core-npm#1350
• chore: bump @​babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.7 by @​dependabot[bot] in dequelabs/axe-core-npm#1343
• chore: bump undici from 6.23.0 to 6.26.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1366
• chore: bump the selenium group with 2 updates by @​dependabot[bot] in dequelabs/axe-core-npm#1369
• chore: bump lint-staged from 16.3.2 to 17.0.7 by @​dependabot[bot] in dequelabs/axe-core-npm#1375
• chore: bump sinon from 21.0.1 to 22.0.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1374
• chore: bump @​playwright/test from 1.58.2 to 1.60.0 in the playwright group by @​dependabot[bot] in dequelabs/axe-core-npm#1371
• feat: Update axe-core to v4.12.1 by @​attest-team-ci in dequelabs/axe-core-npm#1378
• chore: RC v4.12.0 by @​attest-team-ci in dequelabs/axe-core-npm#1381
• chore: RC v4.12.1 by @​attest-team-ci in dequelabs/axe-core-npm#1391
• chore: release v4.12.1 by @​axe-core in dequelabs/axe-core-npm#1393
• chore: merge master into develop by @​attest-team-ci in dequelabs/axe-core-npm#1394
• chore: bump @​sigstore/core from 3.1.0 to 3.2.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1395
• chore: bump axios from 1.17.0 to 1.18.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1400
• chore: bump rollup from 4.46.2 to 4.62.2 by @​dependabot[bot] in dequelabs/axe-core-npm#1402
• chore: bump undici from 6.26.0 to 6.28.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1409
• chore: bump ip-address from 10.2.0 to 10.4.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1408
• ci: remove scheduled trigger from update-axe-core workflow by @​Garbee in dequelabs/axe-core-npm#1411
• feat: update axe-core to v4.13.0 by @​axe-core in dequelabs/axe-core-npm#1413
• chore: RC v4.13.0 by @​attest-team-ci in dequelabs/axe-core-npm#1414
• chore: release v4.13.0 by @​axe-core in dequelabs/axe-core-npm#1416

Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.13.0 (2026-08-10)

Features

• Update axe-core to v4.12.1 (#1378) (4263054)
• update axe-core to v4.13.0 (#1413) (399c5d7), closes #1412

Commits

• See full diff in compare view

Updates @base-ui/react from 1.5.0 to 1.7.0

Release notes

Sourced from @​base-ui/react's releases.

v1.7.0

General changes

• Restore visible focus after keyboard close in Safari and Firefox (#5093) by @​lyzno1
• Type render callback props based on the rendered element (#5104) by @​atomiks
• Reduce popup bundle size (#5233) by @​atomiks
• Reduce store bundle size (#5250) by @​atomiks
• Keep unpositioned popups at the viewport origin (#5299) by @​flaviendelangle
• Correct layout and passive effect timing (#5337) by @​atomiks
• Remove redundant lifecycle synchronization (#5341) by @​atomiks
• Prevent stale cleanup from clearing registered part IDs (#5340) by @​atomiks
• Complete popup unmounting after a canceled exit transition (#5401) by @​atomiks
• Fix rendered trigger ID ownership (#5110) by @​atomiks
• Prevent unwanted flip with capped scrollable content (#5120) by @​atomiks
• Fix collisionPadding off-by-one on the biased side (#5143) by @​atomiks
• Reduce shared popup bundle size (#5192) by @​atomiks
• Mount popup subtrees synchronously when opening in React 17 (#5309) by @​atomiks
• Fix auto-resize origin for left-anchored popups (#5370) by @​sai6855
• Avoid redundant re-renders during lazy flipping (#5372) by @​mdm317
• Strip implementation-only types from published .d.ts files (#5165) by @​michaldudak
• Fix usePreviousValue equality comparison (#5264) by @​lyzno1

Accordion

• Remove the implicit dir attribute from <Accordion.Root> (#5117) by @​chuganzy

Alert Dialog

• Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

• Respect locale when filtering (#5195) by @​atomiks
• Add input-press to change event details (#5356) by @​chuganzy
• Add cancel-open to change event details (#5376) by @​chuganzy
• Reset list scroll position on filter (#5231) by @​atomiks
• Remove dead code and deduplicate handlers (#5194) by @​atomiks
• Fix listbox separator semantics (#5399) by @​sarthakmalik0810

Avatar

• Show <Avatar.Fallback> immediately when delay={0} (#5147) by @​chuganzy

Button

• Fix keyboard click handling for custom elements (#4838) by @​atomiks

Checkbox

• Remove redundant validation input ref (#5188) by @​nami8824

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.7.0

Aug 4, 2026

General changes

• Restore visible focus after keyboard close in Safari and Firefox (#5093) by @​lyzno1
• Type render callback props based on the rendered element (#5104) by @​atomiks
• Reduce popup bundle size (#5233) by @​atomiks
• Reduce store bundle size (#5250) by @​atomiks
• Keep unpositioned popups at the viewport origin (#5299) by @​flaviendelangle
• Correct layout and passive effect timing (#5337) by @​atomiks
• Remove redundant lifecycle synchronization (#5341) by @​atomiks
• Prevent stale cleanup from clearing registered part IDs (#5340) by @​atomiks
• Complete popup unmounting after a canceled exit transition (#5401) by @​atomiks
• Fix rendered trigger ID ownership (#5110) by @​atomiks
• Prevent unwanted flip with capped scrollable content (#5120) by @​atomiks
• Fix collisionPadding off-by-one on the biased side (#5143) by @​atomiks
• Reduce shared popup bundle size (#5192) by @​atomiks
• Mount popup subtrees synchronously when opening in React 17 (#5309) by @​atomiks
• Fix auto-resize origin for left-anchored popups (#5370) by @​sai6855
• Avoid redundant re-renders during lazy flipping (#5372) by @​mdm317
• Strip implementation-only types from published .d.ts files (#5165) by @​michaldudak
• Fix usePreviousValue equality comparison (#5264) by @​lyzno1

Accordion

• Remove the implicit dir attribute from <Accordion.Root> (#5117) by @​chuganzy

Alert Dialog

• Prevent <AlertDialog.Root> from reopening after remounting with a reused handle (#5109) by @​michaldudak

Autocomplete

• Respect locale when filtering (#5195) by @​atomiks
• Add input-press to change event details (#5356) by @​chuganzy
• Add cancel-open to change event details (#5376) by @​chuganzy
• Reset list scroll position on filter (#5231) by @​atomiks
• Remove dead code and deduplicate handlers (#5194) by @​atomiks
• Fix listbox separator semantics (#5399) by @​sarthakmalik0810

Avatar

• Show <Avatar.Fallback> immediately when delay={0} (#5147) by @​chuganzy

Button

• Fix keyboard click handling for custom elements (#4838) by @​atomiks

... (truncated)

Commits

• 254f474 [release] v1.7.0 (#5404)
• 9222cda [meter] Format clamped values (#5409)
• becc19a [combobox][autocomplete][select] Fix listbox separator semantics (#5399)
• 7cc0eef [drawer] Fix click-only outside dismissal after swipe (#5392)
• 1a2ca3c [all components] Fix canceled exit unmount (#5401)
• 166e8ac [popups] Fix quadratic dev-mode trigger registration check (#5400)
• 071e892 [all components] Avoid unused popup handle attachments (#5394)
• cbc87d1 [select] Stabilize scroll arrow cleanup test (#5402)
• 3b5715c [all components] Fix popup handle lifecycle regressions (#5387)
• 54cfcc1 [typescript] Preserve published internals types (#5386)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.4.13 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properti...

  Description has been truncated