fix(deps): update npm non-major dependencies#4607
Merged
Conversation
🦋 Changeset detectedLatest commit: b52557f The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Preview deployments for this pull request: storybook - themebuilder - www - |
Contributor
Author
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Collaborator
|
Seems fine |
Barsnes
approved these changes
Mar 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.4.4→2.4.6^2.29.8→^2.30.0^1.7.5→^1.7.6^29.0.0→^29.0.2^10.2.13→^10.2.1610.2.17^10.2.13→^10.2.1610.2.17^10.2.13→^10.2.1610.2.17^10.2.13→^10.2.1610.2.17^10.2.13→^10.2.1610.2.17^3.13.19→^3.13.21^24.11.0→^24.12.0^7.1.2→^7.1.3^25.8.13→^25.8.1425.8.18(+3)>=20→>=20.20.110.30.3+sha512.c961d1e0a2d8e354ecaa5166b822516668b7f44cb5bd95122d590dd81922f606f5473b6d23ec4a5be05e7fcd18e8488d47d978bbe981872f1145d06e9a740017→10.31.010.32.1(+1)10.30.3→10.31.010.32.1(+1)^8.5.6→^8.5.8^8.5.6→^8.5.8^16.5.4→^16.5.616.5.8(+1)^10.2.13→^10.2.1610.2.17^10.2.13→^10.2.1610.2.17^5.3.2→^5.3.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
biomejs/biome (@biomejs/biome)
v2.4.6Compare Source
Patch Changes
#9305
40869b5Thanks @ematipico! - Fixed #4946:noUnreachableno longer reports code insidefinallyblocks as unreachable when there is abreak,continue, orreturnin the correspondingtrybody.#9303
464910cThanks @ematipico! - Fixed #2786: The formatter no longer produces different output on subsequent runs when acaseclause has a trailing line comment followed by a single block statement.#9324
6294aa2Thanks @arendjr! - Fixed#7730:useAnchorContentnow recognises SolidJS'sinnerHTMLthe same way as React'sdangerouslySetInnerHTML.#9298
1003229Thanks @Netail! - Fixed#9296, so comments are moved along with the attributes in the useSortedAttributes assist rule code fix.#9329
855b451Thanks @dyc3! - Improved performance ofnoEmptyBlockStatements. The rule is now smarter about short-circuiting its logic.#9326
85dfe9bThanks @dyc3! - Improved performance fornoImportCyclesby explicitly excluding node_modules from the cycle detection. The performance improvement is directly proportional to how big your dependency tree is.#9323
d5ee469Thanks @ematipico! - Fixed #9217 and biomejs/biome-vscode#959, where the Biome language server didn't correctly resolve the editor settingconfigurationPathwhen the provided value is a relative path.#9302
86fbc70Thanks @sepagian! - Fixed #9300: Lowercase component member expressions like<form.Field>in Svelte and Astro files are now correctly formatted.v2.4.5Compare Source
Patch Changes
#9185
e43e730Thanks @dyc3! - Added the nursery ruleuseVueScopedStylesfor Vue SFCs. This rule enforces that<style>blocks have thescopedattribute (ormodulefor CSS Modules), preventing style leakage and conflicts between components.#9184
49c8fdeThanks @chocky335! - Improved plugin performance by batching all plugins into a single syntax visitor with a kind-to-plugin lookup map, reducing per-node dispatch overhead from O(N) to O(1) where N is the number of plugins.#9283
071c700Thanks @dyc3! - FixednoUndeclaredVariableserroneously flagging functions and variables defined in the<script setup>section of Vue SFCs.#9221
4612133Thanks @ematipico! - Fixed an issue where the JSON reporter didn't contain the duration of the command.#9294
1805c8fThanks @Netail! - Extra rule source reference.biome migrate eslintshould do a bit better detecting rules in your eslint configurations.#9178
101b3bbThanks @Bertie690! - Fixed #9172 and #9168:Biome now considers more constructs as valid test assertions.
Previously,
assert,expectTypeOfandassertTypewere not recognized as valid assertions by Biome's linting rules, producing false positives in
lint/nursery/useExpectand other similar rules.Now, these rules will no longer produce errors in test cases that used these constructs instead of
expect:#9173
32dad2dThanks @dyc3! - Added parsing support for Svelte's new comments-in-tags feature.The HTML parser will now accept JS style comments in tags in Svelte files.
#8952
1d2ca15Thanks @pkallos! - Added the nursery ruleuseNullishCoalescing. This rule suggests using the nullish coalescing operator (??) instead of logical OR (||) when the left operand may be nullish. This prevents bugs where falsy values like0,'', orfalseare incorrectly treated as missing. Addresses #8043#9243
1992a85Thanks @Netail! - Fixed #7813: improved the diagnostic of the ruleuseExhaustiveDependencies. The diagnostic now shows the name of the variable to add to the dependency array.#9063
3d0648fThanks @taga3s! - Added the nursery rulenoVueRefAsOperand. This rule disallows cases where a ref is used as an operand.The following code is now flagged:
#9273
f239e20Thanks @denbezrukov! - Fixed #9253: parsing of@container scroll-state(...)queries.#9259
96939c0Thanks @ematipico! - Fixed CSS formatter incorrectly collapsing selectors when a BOM (Byte Order Mark) character is present at the start of the file. The formatter now correctly preserves line breaks between comments and selectors in BOM-prefixed CSS files, matching Prettier's behavior.#9251
59e33fbThanks @ematipico! - Fixed #9249: The CSS formatter no longer incorrectly breaks ratio values (like1 / -1) across lines when followed by comments.#9284
ec3a17fThanks @denbezrukov! - Fixed #9253: removed false-positive diagnostics for valid@container/@supportsgeneral-enclosed queries.#9215
b2619a1Thanks @FrederickStempfle! - Fixed #9189:biome ciin GitHub Actions now correctly disables colors so that::error/::warningworkflow commands are not wrapped in ANSI escape codes.#9256
65ae4c1Thanks @ematipico! - Fixed JSON reporter escaping of special characters in diagnostic messages. The JSON reporter now properly escapes double quotes, backslashes, and control characters in error messages and advice text, preventing invalid JSON output when diagnostics contain these characters.#9223
5b9da81Thanks @ematipico! - Fixed an issue where the JSON reporter didn't write output to a file when--reporter-filewas specified. The output is now correctly written to the specified file instead of always going to stdout.#9154
c487e54Thanks @abossenbroek! - Fixed #9115: ThenoPlaywrightMissingAwaitrule no longer produces false positives on jest-dom matchers liketoBeVisible,toBeChecked,toHaveAttribute, etc. For matchers shared between Playwright and jest-dom, the rule now checks whetherexpect()'s argument is a Playwright locator or page object before flagging. Added semantic variable resolution so that extracted Playwright locators (e.g.const loc = page.locator('.item'); expect(loc).toBeVisible()) are still correctly flagged.#9269
33e5cdfThanks @dyc3! - Fixed a false positive wherenoUndeclaredVariablesreported bindings from Vue<script setup>as undeclared when used in<template>.This change ensures embedded bindings collected from script snippets (like imports and
defineModelresults) are respected by the rule.#9267
2c2e060Thanks @ematipico! - Fixed #9143 and #8849: ThenoUnresolvedImportsrule no longer reports false positives for several common patterns:node:fs,node:path,node:url, and other Node.js built-in modules with thenode:prefix are now accepted."typings"(instead of"types") inpackage.jsonnow resolve correctly.export { x as y } from "...") are now resolved correctly through the alias.export * as Ns from "...") are now recognized as own exports of the barrel module.#9254
f7bf12bThanks @ematipico! - Fixed #8842: The CSS formatter now correctly formats@container scroll-state()without adding an unwanted space between the function name and opening parenthesis.#9211
2d0b8e6Thanks @ematipico! - Fixed #7905. Improved the accuracy of type-aware lint rules when analyzing re-exported functions and values.Previously, when a binding was imported from another module, its type was not correctly inferred during the type analysis phase. This caused type-aware lint rules to fail to detect issues when working with re-exported imports.
The following rules now correctly handle re-exported imports:
useAwaitThenablenoFloatingPromisesnoMisusedPromisesuseArraySortCompareExample of now-working detection:
#8934
b49707cThanks @tim-we! - Fixed #8265: Biome now correctly detects test framework calls that use three arguments (label, options, callback) (e.g.,describe("foo", { retry: 2 }, () => {})). This fixes both formatting and thenoDuplicateTestHookslint rule for test frameworks like Vitest.#9191
688fd34Thanks @dyc3! - Fixed #9180: fixed a panic caused by an interaction betweennoRedundantUseStrictand the formatter#9048
9bbdf4dThanks @ff1451! - Added the nursery ruleuseNamedCaptureGroup.The rule enforces using named capture groups in regular expressions instead of numbered ones. It supports both regex literals and
RegExpconstructor calls.#9255
9b6685bThanks @ematipico! - Fixed#9234, where some nursery rules panicked when they were configured with the optionlevelwithout the correspondingoptions.#8968
a2b4494Thanks @LouisLau-art! - Fixed #8812:lint/suspicious/noArrayIndexKeywill now report index usage anywhere in JSXkeytemplate or binary expressions, not only in the last visited identifier.#9266
84935a4Thanks @dyc3! - Fixed #9250:noVueDuplicateKeyswill no longer flag keys underwatch, preventing false positives.#9056
1f2fe2eThanks @ruidosujeira! - Added the nursery ruleuseArraySometo prefer.some()over verbose existence checks likefilter(...).length > 0andfindIndex(...) !== -1, with suggestions forfind/findLastexistence checks. This also applies to ES2025 iterator helpers such asIterator.prototype.find.#9163
f87acf6Thanks @JUSTIVE! - Addedgraphqlto valid embedded graphql template tags inside JavaScript files, when the featurejavascript.experimentalEmbeddedSnippetsEnabledis enabled. This allows proper support for graphql tags used in RelayJS.Now, code snippets like the following are correctly formatted and limited:
#8773
6b01778Thanks @xcb3d! - Added the new nursery ruleuseUnicodeRegex.The rule enforces the use of the
uorvflag for regular expressions. This ensures proper handling of Unicode characters like emoji.changesets/changesets (@changesets/cli)
v2.30.0Compare Source
floating-ui/floating-ui (@floating-ui/dom)
v1.7.6Patch Changes
Platformtype containsdetectOverflowtype@floating-ui/utils@0.2.11,@floating-ui/core@1.7.5rollup/plugins (@rollup/plugin-commonjs)
v29.0.22026-03-06
Bugfixes
v29.0.12026-03-05
Bugfixes
storybookjs/storybook (@storybook/addon-a11y)
v10.2.16Compare Source
definePreview({...}).type<T>()export default - #33885, thanks @copilot-swe-agent!v10.2.15Compare Source
TanStack/virtual (@tanstack/react-virtual)
v3.13.21Compare Source
Patch Changes
be89e29]:v3.13.20Compare Source
Patch Changes
ff83e94]:cssnano/cssnano (cssnano)
v7.1.3: v7.1.3Compare Source
What's Changed
Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@7.1.2...cssnano@7.1.3
i18next/i18next (i18next)
v25.8.14Compare Source
nodejs/node (node)
v20.20.1: 2026-03-05, Version 20.20.1 'Iron' (LTS), @marco-ippolitoCompare Source
Notable Changes
91a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #6141980feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741Commits
6f580d5399] - assert: fix deepEqual always return true on URL (Xuguang Mei) #5085391a66e671c] - build: test on Python 3.14 (Christian Clauss) #59983cc4f7af6f3] - build: skip sscache action on non-main branches (Joyee Cheung) #61790f66056054b] - crypto: update root certificates to NSS 3.119 (Node.js GitHub Bot) #6141980feacaddb] - crypto: update root certificates to NSS 3.117 (Node.js GitHub Bot) #60741fa88cc07e2] - crypto: ensure documented RSA-PSS saltLength default is used (Filip Skokan) #6066288b2eec88a] - deps: update minimatch to 10.2.2 (Node.js GitHub Bot) #618305c053264f1] - deps: V8: backport6a0a25a(Vivian Wang) #616874a398699d0] - deps: update googletest to5a9c3f9(Node.js GitHub Bot) #617314fa43adf15] - deps: update googletest to56efe39(Node.js GitHub Bot) #616051a855d490c] - deps: update googletest to8508785(Node.js GitHub Bot) #61417d8a9359826] - deps: update icu to 78.2 (Node.js GitHub Bot) #60523e79cd3a0bb] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #619280707ade464] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925dc5a3cddef] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #6182746043b94c7] - deps: update zlib to 1.3.1-e00f703 (Node.js GitHub Bot) #611356be15a596e] - deps: update cjs-module-lexer to 2.2.0 (Node.js GitHub Bot) #6127110881404cd] - deps: update timezone to 2025c (Node.js GitHub Bot) #611381594a78c85] - deps: update googletest to065127f(Node.js GitHub Bot) #610557fa2ee1933] - deps: update zlib to 1.3.1-63d7e16 (Node.js GitHub Bot) #6089809259532ef] - deps: update googletest to1b96fa1(Node.js GitHub Bot) #60739aa8bdb6886] - deps: update cjs-module-lexer to 2.1.1 (Node.js GitHub Bot) #60646cc849fde27] - deps: update googletest to279f847(Node.js GitHub Bot) #60219a99ba553a2] - deps: update googletest to50b8600(Node.js GitHub Bot) #599556349a79f5f] - deps: update googletest to7e17b15(Node.js GitHub Bot) #591318ba759f1a0] - deps: update googletest to35b75a2(Node.js GitHub Bot) #58710927d906850] - deps: update googletest toe9092b1(Node.js GitHub Bot) #58565bf8919f5c2] - deps: update googletest to0bdccf4(Node.js GitHub Bot) #57380ae6231dac0] - deps: update googletest toe235eb3(Node.js GitHub Bot) #568730561c62e85] - deps: update minimatch to 10.1.2 (Node.js GitHub Bot) #61732f0ef221b0d] - deps: update minimatch to 10.1.1 (Node.js GitHub Bot) #6054315bd0da404] - deps: update archs files for openssl (Antoine du Hamel) #6191204d439323f] - deps: upgrade openssl sources to openssl-3.0.19 (Antoine du Hamel) #619122ea16d3bd6] - deps: update corepack to 0.34.6 (Node.js GitHub Bot) #61510622f973d1c] - deps: update corepack to 0.34.5 (Node.js GitHub Bot) #608422cd265d8b9] - deps: update corepack to 0.34.4 (Node.js GitHub Bot) #6064365e839687b] - deps: update corepack to 0.34.2 (Node.js GitHub Bot) #605502dc99d2771] - dns: fix Windows SRV ECONNREFUSED by adjusting c-ares fallback detection (notvivek12) #614532c7b84b1d8] - doc: fix typo in http.md (Michael Solomon) #59354a84b42667c] - doc: fix grammar in global dispatcher usage (Eng Zer Jun) #59344ffd0ada45f] - doc: fix typo intest/common/README.md(Yoo) #59180b4d9d006e7] - doc: fix broken sentence inURL.parse(Superchupu) #5916445e9971d9c] - doc: fix typo in writing-test.md (SeokHun) #59123e9fd10b5d6] - doc: fixfetchsubsections inglobals.md(Antoine du Hamel) #589333715dd1c2b] - doc: fix wrong RFC number in http2 (Deokjin Kim) #58753098c017eac] - doc: punctuation fix for Node-API versioning clarification (Jiacai Liu) #58599545bf434e1] - doc: fix typo of filehttp.md,outgoingMessage.setTimeoutsection (yusheng chen) #58188b3d6683e7b] - doc: support toolchain with Visual Studio 2019 & 2022 only (Mike McCready) #614508fdde5d110] - doc: fix v20 changelog after security release (Marco Ippolito) #6137131d04599be] - http: fix keep-alive not timing out after post-request empty line (Shima Ryuhei) #581785ec7d1eba0] - http2: validate initialWindowSize per HTTP/2 spec (Matteo Collina) #614025c091d5a96] - meta: persist sccache daemon until end of build workflows (René) #61639183353aba0] - path,win: fix bug in resolve and normalize (Hüseyin Açacak) #55623dbe9e5091b] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #619484106bfc775] - test: mark stringbytes-external-max flaky on AIX (Stewart X Addison) #60995de51937306] - test: mark stringbytes-external-exceed-max tests as flaky on AIX (Joyee Cheung) #60565368b221be3] - test: fix flaky test-performance-eventloopdelay (Matteo Collina) #61629e134912a33] - test: fix flaky test-worker-message-port-transfer-filehandle test (Alex Yang) #591585630170d3e] - test: account for truthy signal in flaky async_hooks tests (Darshan Sen) #584781e5363bb63] - test: marktest-http2-debugas flaky on LinuxONE (Richard Lau) #58494662998787a] - test: settest-fs-cpas flaky (Stefan Stojanovic) #567990807127339] - test: marktest-esm-loader-hooks-inspect-waitflaky (Richard Lau) #568036320cd0721] - test: skip strace test with shared openssl (Richard Lau) #6198783b9f8ee02] - tools: make nodedownload module compatible with Python 3.14 (Lumír 'Frenzy' Balhar) #587526cf9b5786e] - tools: enforce removal oflts-watch-*labels on release proposals (Antoine du Hamel) #61672cd4161499c] - tools: use ubuntu-slim runner in meta GitHub Actions (Tierney Cyren) #616636dc2a99a0d] - tools: validate release commit diff as part oflint-release-proposal(Antoine du Hamel) #614405014f22332] - tools: add read permission to workflows that read contents (Antoine du Hamel) #582556c3ad2a5a3] - tools: switch to ARM runners on GHA jobs (Antoine du Hamel) #619031abada9c34] - tools: avoid building twice in coverage jobs (Antoine du Hamel) #61899f260e40127] - tools: use ubuntu-slim runner in GHA (Antoine du Hamel) #6175964beca5e01](https://redirect.github.com/nodejs/node/Configuration
📅 Schedule: Branch creation - "before 07:00 on Thursday" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.