chore(deps): update devdependencies (major)#428
Open
renovate[bot] wants to merge 1 commit intomasterfrom
Open
Conversation
baf6177 to
c6f4687
Compare
0d472cc to
b7a264c
Compare
b7a264c to
2a5f91e
Compare
875e206 to
ce3769a
Compare
781b29f to
0979286
Compare
b48cc3a to
ed834e7
Compare
c9fd260 to
b984190
Compare
ce4fc79 to
0fc5e29
Compare
617f9d5 to
d5af895
Compare
389dee2 to
b942834
Compare
7f47b7e to
0b27ccf
Compare
39ed51f to
6f72944
Compare
689c0a7 to
6ea173d
Compare
ab8d7f2 to
2a07453
Compare
dc2ac94 to
98d1fa6
Compare
ee8f02a to
179ddd6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^4.0.2→^6.0.0^1.11.1→^3.0.0^1.1.1→^3.0.02.2.3→4.0.0^1.1.3→^3.0.0^2.0.2→^4.0.0^1.9.4→^2.0.0^25.0.0→^27.0.0^13.0.0→^14.0.0^16.0.0→^17.0.0^14.0.0→^16.0.0^29.5.14→^30.0.0^22.13.8→^25.0.07.0.3→10.1.0^29.7.0→^30.0.0^6.1.4→^7.0.0Release Notes
actions/toolkit (@actions/cache)
v6.0.0import()instead ofrequire()v5.0.5@actions/globto0.5.1v5.0.4@actions/http-clientto3.0.2v5.0.3Prevent retries for rate limited cache operations 2243.
v5.0.1@azure/storage-blobfrom^12.13.0to^12.29.1#2213@azure/core-rest-pipelineinstead of deprecated@azure/core-http, which eliminates the transitive dependency onnode-fetch@2→whatwg-url@5→tr46@​0.0.3that used the deprecated punycode modulev5.0.0@azure/ms-rest-jsdependency #2197TransferProgressEventtype is now imported from@azure/core-rest-pipelineinstead of@azure/ms-rest-js@actions/corefrom^1.11.1to^2.0.0#2198@actions/execfrom^1.0.1to^2.0.0#2198@actions/globfrom^0.1.0to^0.5.0#2198@actions/http-clientfrom^2.1.1to^3.0.0#2198@actions/iofrom^1.0.1to^2.0.0#2198node-fetchoverride to resolve audit vulnerabilities #2110actions/toolkit (@actions/core)
v3.0.0import()instead ofrequire()v2.0.3@actions/http-clientto3.0.2v2.0.1v2.0.0actions/toolkit (@actions/exec)
v3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/http-client)
v4.0.0import()instead ofrequire()v3.0.2undicifrom5.28.5to6.23.0v3.0.1v3.0.0actions/toolkit (@actions/io)
v3.0.2v3.0.1@actions/io/lib/io-utilv3.0.0import()instead ofrequire()v2.0.0actions/toolkit (@actions/tool-cache)
v4.0.0import()instead ofrequire()3.0.1
@actions/http-clientto3.0.23.0.0
@actions/core@actions/exec@actions/http-client@actions/io2.0.2
@actions/coreto v1.11.1 #1872uuidpackage #1824, #18422.0.1
@actions/http-client#10872.0.0
@actions/http-clientheadersparameter in the exported functiondownloadToolhas been narrowed from{ [header: string]: any }to{ [header: string]: number | string | string[] | undefined; }(that is,http.OutgoingHttpHeaders).This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
lockfileVersiontov2inpackage-lock.json#10251.7.1
1.7.0
isExplicitVersionandevaluateVersionsfunctions1.6.1
1.6.0
1.3.5
1.3.4
Here is the security issue that was fixed in the http-client 1.0.8 release
1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
extractTaron Windows1.1.2
extractTar1.0.0
v3.0.1@actions/http-clientto3.0.2v3.0.0@actions/core@actions/exec@actions/http-client@actions/iobiomejs/biome (@biomejs/biome)
v2.4.5Compare Source
Patch Changes
#9185
e43e730Thanks @dyc3! - Added the nursery ruleuseVueScopedStylesfor Vue SFCs. This rule enforces that<style>blocks have thescopedattribute (ormodulefor CSS Modules), preventing style leakage and conflicts between components.#9184
49c8fdeThanks @chocky335! - Improved plugin performance by batching all plugins into a single syntax visitor with a kind-to-plugin lookup map, reducing per-node dispatch overhead from O(N) to O(1) where N is the number of plugins.#9283
071c700Thanks @dyc3! - FixednoUndeclaredVariableserroneously flagging functions and variables defined in the<script setup>section of Vue SFCs.#9221
4612133Thanks @ematipico! - Fixed an issue where the JSON reporter didn't contain the duration of the command.#9294
1805c8fThanks @Netail! - Extra rule source reference.biome migrate eslintshould do a bit better detecting rules in your eslint configurations.#9178
101b3bbThanks @Bertie690! - Fixed #9172 and #9168:Biome now considers more constructs as valid test assertions.
Previously,
assert,expectTypeOfandassertTypewere not recognized as valid assertions by Biome's linting rules, producing false positives in
lint/nursery/useExpectand other similar rules.Now, these rules will no longer produce errors in test cases that used these constructs instead of
expect:#9173
32dad2dThanks @dyc3! - Added parsing support for Svelte's new comments-in-tags feature.The HTML parser will now accept JS style comments in tags in Svelte files.
#8952
1d2ca15Thanks @pkallos! - Added the nursery ruleuseNullishCoalescing. This rule suggests using the nullish coalescing operator (??) instead of logical OR (||) when the left operand may be nullish. This prevents bugs where falsy values like0,'', orfalseare incorrectly treated as missing. Addresses #8043#9243
1992a85Thanks @Netail! - Fixed #7813: improved the diagnostic of the ruleuseExhaustiveDependencies. The diagnostic now shows the name of the variable to add to the dependency array.#9063
3d0648fThanks @taga3s! - Added the nursery rulenoVueRefAsOperand. This rule disallows cases where a ref is used as an operand.The following code is now flagged:
#9273
f239e20Thanks @denbezrukov! - Fixed #9253: parsing of@container scroll-state(...)queries.#9259
96939c0Thanks @ematipico! - Fixed CSS formatter incorrectly collapsing selectors when a BOM (Byte Order Mark) character is present at the start of the file. The formatter now correctly preserves line breaks between comments and selectors in BOM-prefixed CSS files, matching Prettier's behavior.#9251
59e33fbThanks @ematipico! - Fixed #9249: The CSS formatter no longer incorrectly breaks ratio values (like1 / -1) across lines when followed by comments.#9284
ec3a17fThanks @denbezrukov! - Fixed #9253: removed false-positive diagnostics for valid@container/@supportsgeneral-enclosed queries.#9215
b2619a1Thanks @FrederickStempfle! - Fixed #9189:biome ciin GitHub Actions now correctly disables colors so that::error/::warningworkflow commands are not wrapped in ANSI escape codes.#9256
65ae4c1Thanks @ematipico! - Fixed JSON reporter escaping of special characters in diagnostic messages. The JSON reporter now properly escapes double quotes, backslashes, and control characters in error messages and advice text, preventing invalid JSON output when diagnostics contain these characters.#9223
5b9da81Thanks @ematipico! - Fixed an issue where the JSON reporter didn't write output to a file when--reporter-filewas specified. The output is now correctly written to the specified file instead of always going to stdout.#9154
c487e54Thanks @abossenbroek! - Fixed #9115: ThenoPlaywrightMissingAwaitrule no longer produces false positives on jest-dom matchers liketoBeVisible,toBeChecked,toHaveAttribute, etc. For matchers shared between Playwright and jest-dom, the rule now checks whetherexpect()'s argument is a Playwright locator or page object before flagging. Added semantic variable resolution so that extracted Playwright locators (e.g.const loc = page.locator('.item'); expect(loc).toBeVisible()) are still correctly flagged.#9269
33e5cdfThanks @dyc3! - Fixed a false positive wherenoUndeclaredVariablesreported bindings from Vue<script setup>as undeclared when used in<template>.This change ensures embedded bindings collected from script snippets (like imports and
defineModelresults) are respected by the rule.#9267
2c2e060Thanks @ematipico! - Fixed #9143 and #8849: ThenoUnresolvedImportsrule no longer reports false positives for several common patterns:node:fs,node:path,node:url, and other Node.js built-in modules with thenode:prefix are now accepted."typings"(instead of"types") inpackage.jsonnow resolve correctly.export { x as y } from "...") are now resolved correctly through the alias.export * as Ns from "...") are now recognized as own exports of the barrel module.#9254
f7bf12bThanks @ematipico! - Fixed #8842: The CSS formatter now correctly formats@container scroll-state()without adding an unwanted space between the function name and opening parenthesis.#9211
2d0b8e6Thanks @ematipico! - Fixed #7905. Improved the accuracy of type-aware lint rules when analyzing re-exported functions and values.Previously, when a binding was imported from another module, its type was not correctly inferred during the type analysis phase. This caused type-aware lint rules to fail to detect issues when working with re-exported imports.
The following rules now correctly handle re-exported imports:
useAwaitThenablenoFloatingPromisesnoMisusedPromisesuseArraySortCompareExample of now-working detection:
#8934
b49707cThanks @tim-we! - Fixed #8265: Biome now correctly detects test framework calls that use three arguments (label, options, callback) (e.g.,describe("foo", { retry: 2 }, () => {})). This fixes both formatting and thenoDuplicateTestHookslint rule for test frameworks like Vitest.#9191
688fd34Thanks @dyc3! - Fixed #9180: fixed a panic caused by an interaction betweennoRedundantUseStrictand the formatter#9048
9bbdf4dThanks @ff1451! - Added the nursery ruleuseNamedCaptureGroup.The rule enforces using named capture groups in regular expressions instead of numbered ones. It supports both regex literals and
RegExpconstructor calls.#9255
9b6685bThanks @ematipico! - Fixed#9234, where some nursery rules panicked when they were configured with the optionlevelwithout the correspondingoptions.#8968
a2b4494Thanks @LouisLau-art! - Fixed #8812:lint/suspicious/noArrayIndexKeywill now report index usage anywhere in JSXkeytemplate or binary expressions, not only in the last visited identifier.#9266
84935a4Thanks @dyc3! - Fixed #9250:noVueDuplicateKeyswill no longer flag keys underwatch, preventing false positives.#9056
1f2fe2eThanks @ruidosujeira! - Added the nursery ruleuseArraySometo prefer.some()over verbose existence checks likefilter(...).length > 0andfindIndex(...) !== -1, with suggestions forfind/findLastexistence checks. This also applies to ES2025 iterator helpers such asIterator.prototype.find.#9163
f87acf6Thanks @JUSTIVE! - Addedgraphqlto valid embedded graphql template tags inside JavaScript files, when the featurejavascript.experimentalEmbeddedSnippetsEnabledis enabled. This allows proper support for graphql tags used in RelayJS.Now, code snippets like the following are correctly formatted and limited:
#8773
6b01778Thanks @xcb3d! - Added the new nursery ruleuseUnicodeRegex.The rule enforces the use of the
uorvflag for regular expressions. This ensures proper handling of Unicode characters like emoji.v2.4.4Compare Source
Patch Changes
#9150
6946835Thanks @dyc3! - Fixed #9138: Astro files containing---in HTML content (e.g.,<h1>---Hi</h1>) are now parsed correctly, both when a frontmatter block is present and when there is no frontmatter at all.#9150
aa6f837Thanks @dyc3! - Fixed #9138: The HTML parser incorrectly failing to parse bracket characters ([and]) in text content (e.g.<div>[Foo]</div>).#9151
c0d4b0cThanks @dyc3! - Fixed parsing of Svelte directive keywords (use,style) when used as plain text content in HTML/Svelte files. Previously,<p>use JavaScript</p>or<p>style it</p>would incorrectly produce a bogus element instead of proper text content.#9162
7f1e060Thanks @dyc3! - Fixed #9161: The Vue parser now correctly handles colon attributes likexlink:hrefandxmlns:xlinkby parsing them as single attributes instead of splitting them into separate tokens.#9164
458211bThanks @dyc3! - Fixed #9161: ThenoAssignInExpressionsrule no longer flags assignments in Vue v-on directives (e.g.,@click="counter += 1"). Assignments in event handlers are idiomatic Vue patterns and are now skipped by the rule.v2.4.3Compare Source
Patch Changes
#9120
aa40fc2Thanks @ematipico! - Fixed #9109, where the GitHub reporter wasn't correctly enabled whenbiome ciruns on GitHub Actions.#9128
8ca3f7fThanks @dyc3! - Fixed #9107: The HTML parser can now correctly parse Astro directives (client/set/class/is/server), which fixes the formatting for Astro directives.#9124
f5b0e8dThanks @ematipico! - Fixed #8882 and #9108: The Astro frontmatter lexer now correctly identifies the closing---fence when the frontmatter contains multi-line block comments with quote characters, strings that mix quote types (e.g."it's"), or escaped quote characters (e.g."\").#9142
3ca066bThanks @THernandez03! - Fixed #9141: ThenoUnknownAttributerule no longer reportsclosedbyas an unknown attribute on<dialog>elements.#9126
792013eThanks @ematipico! - Added missing Mocha globals to theTestdomain:context,run,setup,specify,suite,suiteSetup,suiteTeardown,teardown,xcontext,xdescribe,xit, andxspecify. These are injected by Mocha's BDD and TDD interfaces and were previously flagged as undeclared variables in projects using Mocha.#8855
6918c9eThanks @ruidosujeira! - Fixed #8840. Now the Biome CSS parser correctly parsesnot + scroll-stateinside@containerqueries.#9111
4fb55cfThanks @Jayllyz! - Slightly improved performance ofnoIrregularWhitespaceby adding early return optimization and simplifying character detection logic.#8975
086a0c5Thanks @FrankFMY! - Fixed #8478:useDestructuringno longer suggests destructuring when the variable has a type annotation, likeconst foo: string = object.foo.v2.4.2Compare Source
Patch Changes
#9103
fc9850cThanks @dyc3! - Fixed #9098:useImportTypeno longer incorrectly flags imports used in Svelte control flow blocks ({#if},{#each},{#await},{#key}) as type-only imports.#9106
f4b7296Thanks @dyc3! - Updated rule source metadata for rules fromhtml-eslint.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoConditionalExpect. This rule disallows conditionalexpect()calls inside tests, which can lead to tests that silently pass when assertions never run.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightElementHandle. Prefers locators to element handles.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightEval. Disallowspage.$eval()andpage.$$eval()methods.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightForceOption. Disallows theforceoption on user interactions.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightMissingAwait. Enforces awaiting async Playwright APIs.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightNetworkidle. Disallows deprecatednetworkidlewait option.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightPagePause. Disallowspage.pause()debugging calls in committed code.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightUselessAwait. Disallows unnecessaryawaiton synchronous Playwright methods.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightWaitForNavigation. Prefers modern navigation APIs over deprecatedwaitForNavigation().#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightWaitForSelector. Prefers locators over deprecatedwaitForSelector().#8960
4a5ff40Thanks @abossenbroek! - Added the nursery rulenoPlaywrightWaitForTimeout. Disallows hard-coded timeouts withwaitForTimeout().#8960
4a5ff40Thanks @abossenbroek! - EnhancednoSkippedTeststo detect Playwright patterns (.fixme,test.describe,test.step, bracket notation, bare calls). ConsolidatednoPlaywrightSkippedTestinto this rule.#9101
0c0fb6fThanks @siketyan! - Fixed#9080: ThenoUnusedVariablesrule no longer reports a top-levelPropsinterface or type alias as unused in Astro files.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery ruleuseExpect. This rule ensures that test functions contain at least oneexpect()assertion.#8960
4a5ff40Thanks @abossenbroek! - Added the nursery ruleusePlaywrightValidDescribeCallback. Validates that describe callback signatures are not async.v2.4.1Compare Source
Patch Changes
#9092
6edd600Thanks @ematipico! - Fixed #9052. This PR reverts changes introduced by #8519, which caused unwanted changes on how paths are resolved.#9091
3bf674dThanks @ematipico! - Fixed #9090, where SCSS files were incorrectly processed by Biome. This was a regressions caused by the latest developments for supporting SCSS out of the box.#9100
66931a8Thanks @siketyan! - Fixed #9081: ThenoUnknownPseudoElementrule no longer reports false positives for any known pseudo elements in CSS modules. This was a regression introduced in v2.4.0.#9102
d01b903Thanks @ematipico! - Fixed #9095, where Biome didn't print anything in stdin mode. This was a regression caused by a recent, internal refactor.v2.4.0Compare Source
Minor Changes
#8964
0353fa0Thanks @dyc3! - Addedignoreoption to theuseHookAtTopLevelrule.You can now specify function names that should not be treated as hooks, even if they follow the
use*naming convention.Example configuration:
{ "linter": { "rules": { "correctness": { "useHookAtTopLevel": { "options": { "ignore": ["useDebounce", "useCustomUtility"] } } } } } }#8769
d0358b0Thanks @rahuld109! - Added the ruleuseAnchorContentfor HTML to enforce that anchor elements have accessible content for screen readers. The rule flags empty anchors, anchors with only whitespace, and anchors where all content is hidden witharia-hidden. Anchors witharia-labelortitleattributes providing a non-empty accessible name are considered valid.#8742
6340ce6Thanks @rahuld109! - Added the ruleuseMediaCaptionto the HTML language. Enforces thataudioandvideoelements have atrackelement withkind="captions"for accessibility. Muted videos are allowed without captions.#8621
d11130bThanks @Netail! - Added support for multiple reporters, and the ability to save reporters on arbitrary files.Combine two reporters in CI
If you run Biome on GitHub, take advantage of the reporter and still see the errors in console, you can now use both reporters:
Save reporter output to a file
With the new
--reporter-fileCLI option, it's now possible to save the output of all reporters to a file. The file is a path,so you can pass a relative or an absolute path: