chore(dev-deps)(deps-dev): bump the development-deps group across 1 directory with 5 updates

[dependabot]

Bumps the development-deps group with 5 updates in the / directory:

Package	From	To
@biomejs/biome	2.4.15	2.4.16
@changesets/cli	2.31.0	2.31.1
@types/node	25.6.0	25.6.2
@vitest/coverage-v8	3.2.4	3.2.7
turbo	2.9.14	2.9.18

Updates @biomejs/biome from 2.4.15 to 2.4.16

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.16

Patch Changes

• #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

• #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

  Input:

  <span
    ><!-- 1
  --><span>a</span
    ><!-- 2
  --><span>b</span
    ><!-- 3
  --></span>

  Output:

    <span
  	  ><!-- 1
  - --> <span>a</span<!-- 2
  - --> ><span>b</span><!-- 3
  + --><span>a</span><!-- 2
  + --><span>b</span><!-- 3
    --></span
    >

• #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

• #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

• #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

• #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

• #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

• #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

• #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

• #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Commits

• 5f4ea56 ci: release (#10326)
• de2a33c fix(core): regression in emitted types (#10478)
• d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
• 4f1aaf2 fix: incorrect build when using build or test (#10426)
• dc73b6b refactor: make plugins opt-in via feature gate (#10418)
• e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
• 9b1577f fix(config): support trailingCommas in overrides (#10318)
• See full diff in compare view

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• 9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
• 97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
• 13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
• 8f6acd6 Update dependabot group to exclude major (#2067)
• c70c675 Setup backport workflow and sync next setup (#2057)
• 9672019 Remove SECURITY.md to defer to .github (#2055)
• 18e1661 Use internal bot for versioning (#2039)
• Additional commits viewable in compare view

Updates @types/node from 25.6.0 to 25.6.2

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 3.2.4 to 3.2.7

Release notes

Sourced from @​vitest/coverage-v8's releases.

v3.2.7

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10679 (b795e)

    View changes on GitHub

v3.2.6

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

Commits

• c0c203d chore: release v3.2.7 (#10719)
• b6d56f8 chore: release v3.2.6
• 16f120d fix: pin last supported vite-node version
• 2cbad0a chore: release v3.2.5
• 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​vitest/coverage-v8 since your current version.

Updates turbo from 2.9.14 to 2.9.18

Release notes

Sourced from turbo's releases.

Turborepo v2.9.18

What's Changed

Changelog

• release(turborepo): 2.9.17 by @​github-actions[bot] in vercel/turborepo#13047
• ci: Fetch version.txt via API in docs alias failure notification by @​anthonyshew in vercel/turborepo#13050
• fix: Harden cache archive symlink restore by @​anthonyshew in vercel/turborepo#13051
• chore: Remove web UI mode by @​anthonyshew in vercel/turborepo#13052
• fix: Harden query server file access by @​anthonyshew in vercel/turborepo#13053
• fix: Confine prune patch paths by @​anthonyshew in vercel/turborepo#13054
• fix: Prevent git argument injection in SCM refs by @​anthonyshew in vercel/turborepo#13055
• fix: Strip special mode bits from cache restore by @​anthonyshew in vercel/turborepo#13056
• fix: Contain incremental cache outputs by @​anthonyshew in vercel/turborepo#13057
• fix(turborepo): Normalize Windows daemon path hash by @​Balance8 in vercel/turborepo#13020
• fix: Preserve vt100 cell byte counts by @​anthonyshew in vercel/turborepo#13058
• fix: Separate artifact signature fields by @​anthonyshew in vercel/turborepo#13059
• fix: Validate OidHash hex buffers by @​anthonyshew in vercel/turborepo#13060
• fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @​anthonyshew in vercel/turborepo#13061

New Contributors

• @​Balance8 made their first contribution in vercel/turborepo#13020

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

Turborepo v2.9.17

What's Changed

Changelog

• fix: Keep non-PTY stdin alive for persistent tasks by @​anthonyshew in vercel/turborepo#12972
• release(turborepo): 2.9.16 by @​github-actions[bot] in vercel/turborepo#12970
• release(turborepo): 2.9.17-canary.1 by @​github-actions[bot] in vercel/turborepo#12973
• fix: Add auth HTTP timeouts by @​anthonyshew in vercel/turborepo#12976
• fix: Detect affected root tasks in query by @​anthonyshew in vercel/turborepo#12977
• fix: Wait for Windows graceful shutdown by @​anthonyshew in vercel/turborepo#12979
• release(turborepo): 2.9.17-canary.2 by @​github-actions[bot] in vercel/turborepo#12980
• test: Skip installs for JSON output fixtures by @​anthonyshew in vercel/turborepo#12981
• feat: Add Rsbuild examples by @​Nsttt in vercel/turborepo#12942
• test: Skip installs for single package dry runs by @​anthonyshew in vercel/turborepo#12982
• test: Skip Corepack setup without installs by @​anthonyshew in vercel/turborepo#12983
• test: Skip installs for metadata-only Rust tests by @​anthonyshew in vercel/turborepo#12985
• test: Skip remaining unnecessary fixture installs by @​anthonyshew in vercel/turborepo#12986
• test: Add final hash contract snapshots by @​anthonyshew in vercel/turborepo#12984
• test: Trim run logging integration matrix by @​anthonyshew in vercel/turborepo#12987
• test: Trim affected query integration matrix by @​anthonyshew in vercel/turborepo#12988
• test: Narrow Windows integration test group by @​anthonyshew in vercel/turborepo#12989
• test: Trim task dependency integration coverage by @​anthonyshew in vercel/turborepo#12990
• test: Trim affected integration coverage by @​anthonyshew in vercel/turborepo#12991
• test: Collapse integration test matrices by @​anthonyshew in vercel/turborepo#12992

... (truncated)

Commits

• 3bdce32 publish 2.9.18 to registry
• 2a76556 fix: Block self-hosted login URLs from attempting to use Vercel's SSO (#13061)
• da8e348 fix: Validate OidHash hex buffers (#13060)
• 3018717 fix: Separate artifact signature fields (#13059)
• 34514e2 fix: Preserve vt100 cell byte counts (#13058)
• 24e2d34 fix(turborepo): Normalize Windows daemon path hash (#13020)
• 16dc881 fix: Contain incremental cache outputs (#13057)
• 92e1f8e fix: Strip special mode bits from cache restore (#13056)
• f46f896 fix: Prevent git argument injection in SCM refs (#13055)
• 7f353ca fix: Confine prune patch paths (#13054)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependabot, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[reaatech]

🔒 Closed — pre-existing transitive vulnerabilities, outside scope of this PR

group development-deps: the only failing CI check(s) are All Checks Passed, Security Audit, which flag vulnerable transitive dependencies that this dep-bump cannot reach. No PR-level action (this bump or any rewrite of it) can fix the audit findings — they require either an upstream parent-package release or a root-level dependency update unrelated to this PR.

Closing to keep the dependabot queue actionable. Run pnpm audit locally to see the affected paths.

If you believe this PR's bump does actually introduce a fixable audit finding (rare), reopen it and add the label repobot:keep-open.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml