Skip to content

chore(deps-dev): bump the npm-dev-minor-patch group across 1 directory with 7 updates - #165

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-dev-minor-patch-8c76f0725b
Open

chore(deps-dev): bump the npm-dev-minor-patch group across 1 directory with 7 updates#165
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-dev-minor-patch-8c76f0725b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dev-minor-patch group with 7 updates in the / directory:

Package From To
@biomejs/biome 2.5.4 2.5.11
@vitest/coverage-v8 4.1.10 4.1.11
publint 0.3.21 0.3.24
tsdown 0.22.9 0.22.14
tsx 4.23.1 4.23.12
turbo 2.10.5 2.10.12
vitest 4.1.10 4.1.11

Updates @biomejs/biome from 2.5.4 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates publint from 0.3.21 to 0.3.24

Release notes

Sourced from publint's releases.

publint@0.3.24

Patch Changes

  • #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

publint@0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

publint@0.3.22

Patch Changes

  • #241 7740a62 - Support npm v12 and pnpm v11

  • cad0425 - Relax git url regex for repository validation

  • #244 393ac4d - Recognize more common internal files for the USE_FILES suggestion.

  • #242 4a8dc75 - Refactor supported package manager handling from @publint/pack

Changelog

Sourced from publint's changelog.

0.3.24

Patch Changes

  • #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

0.3.23

Patch Changes

  • #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

  • #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

0.3.22

Patch Changes

  • #241 7740a62 - Support npm v12 and pnpm v11

  • cad0425 - Relax git url regex for repository validation

  • #244 393ac4d - Recognize more common internal files for the USE_FILES suggestion.

  • #242 4a8dc75 - Refactor supported package manager handling from @publint/pack

Commits

Updates tsdown from 0.22.9 to 0.22.14

Release notes

Sourced from tsdown's releases.

v0.22.14

   🚀 Features

  • Add CLI build concurrency option  -  by @​sxzz and Jeroen Zwartepoorte (8a14c)
    View changes on GitHub

v0.22.13

   🚀 Features

  • deps: Support neverBundle: true to externalize all dependencies  -  by @​sxzz (d30a7)

   🐞 Bug Fixes

    View changes on GitHub

v0.22.12

   🚨 Breaking Changes

    View changes on GitHub

v0.22.11

   🚀 Features

    View changes on GitHub

v0.22.10

   🚀 Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • ff3bdbd chore: release v0.22.14
  • 8a14c35 feat: add CLI build concurrency option
  • 0525465 docs: add note about cjsDefault only applying to explicit entry modules
  • a3a3551 refactor: fix lint
  • 3dec506 refactor: use native Promise.withResolvers
  • e0266c1 docs: add tsdown users image
  • a733505 refactor: upgrade verkit, simplify version parse
  • e5fe2ca style: format
  • 3e1fc63 chore: release v0.22.13
  • a6c8734 chore: upgrade deps
  • Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

  • shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

  • preserve async ESM require fallback (55cbece)

This release is also available on:

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

This release is also available on:

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

  • map Node test locations (2f55884)
  • support data URLs in tsImport (b94f46f)

This release is also available on:

v4.23.8

... (truncated)

Commits
  • ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
  • 651f5be test: cover CommonJS TypeScript import.meta paths
  • bd3bc64 test: cover CommonJS loader source fallback
  • 55cbece fix: preserve async ESM require fallback
  • 6c5ba85 docs: document CommonJS default interop
  • ec1bcd5 fix: support nyc coverage discovery (#710)
  • b6e5b48 docs: clarify CommonJS default imports
  • 2f55884 fix: map Node test locations
  • de935d5 docs: document Node source-map stack formatting
  • b94f46f fix: support data URLs in tsImport
  • Additional commits viewable in compare view

Updates turbo from 2.10.5 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the npm-dev-minor-patch group across 1 director…
2ac07ef 
…y with 7 updates

Bumps the npm-dev-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.4` | `2.5.11` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` |
| [publint](https://github.com/publint/publint/tree/HEAD/packages/publint) | `0.3.21` | `0.3.24` |
| [tsdown](https://github.com/rolldown/tsdown) | `0.22.9` | `0.22.14` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.5` | `2.10.12` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` |



Updates `@biomejs/biome` from 2.5.4 to 2.5.11
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.11/packages/@biomejs/biome)

Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8)

Updates `publint` from 0.3.21 to 0.3.24
- [Release notes](https://github.com/publint/publint/releases)
- [Changelog](https://github.com/publint/publint/blob/master/packages/publint/CHANGELOG.md)
- [Commits](https://github.com/publint/publint/commits/publint@0.3.24/packages/publint)

Updates `tsdown` from 0.22.9 to 0.22.14
- [Release notes](https://github.com/rolldown/tsdown/releases)
- [Commits](rolldown/tsdown@v0.22.9...v0.22.14)

Updates `tsx` from 4.23.1 to 4.23.12
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.23.1...v4.23.12)

Updates `turbo` from 2.10.5 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.5...v2.10.12)

Updates `vitest` from 4.1.10 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: publint
  dependency-version: 0.3.24
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: tsdown
  dependency-version: 0.22.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants