Skip to content

chore(deps): update devdependencies (major) - #428

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies
Open

chore(deps): update devdependencies (major)#428
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies

Conversation

@renovate

@renovate renovate Bot commented Jul 6, 2025

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@actions/cache (source) ^4.0.2^6.0.0 age confidence
@actions/core (source) ^1.11.1^3.0.0 age confidence
@actions/exec (source) ^1.1.1^3.0.0 age confidence
@actions/http-client (source) 2.2.34.0.1 age confidence
@actions/io (source) ^1.1.3^3.0.0 age confidence
@actions/tool-cache (source) ^2.0.2^4.0.0 age confidence
@babel/core (source) ^7.26.9^8.0.0 age confidence
@babel/preset-typescript (source) ^7.27.1^8.0.0 age confidence
@biomejs/biome (source) ^1.9.4^2.0.0 age confidence
@octokit/openapi-types (source) ^25.0.0^28.0.0 age confidence
@octokit/plugin-paginate-rest ^13.0.0^15.0.0 age confidence
@octokit/plugin-rest-endpoint-methods ^16.0.0^18.0.0 age confidence
@octokit/types ^14.0.0^17.0.0 age confidence
@pnpm/patching.apply-patch (source) ^1000.0.7^1100.0.0 age confidence
@types/jest (source) ^29.5.14^30.0.0 age confidence
@types/node (source) ^22.13.8^26.0.0 age confidence
admina ^1.0.1^2.0.0 age confidence
cross-env 7.0.310.1.0 age confidence
cspell (source) ^9.0.0^10.0.0 age confidence
eslint-config-atomic ^1.22.1^2.0.0 age confidence
jest (source) ^29.7.0^30.0.0 age confidence
npm-check-updates ^19.3.1^23.0.0 age confidence
npm-run-all2 ^8.0.4^9.0.0 age confidence
p-timeout ^6.1.4^7.0.0 age confidence
typescript (source) ^5.8.2^7.0.0 age confidence
vite (source) ^7.3.1^8.0.0 age confidence

Release Notes

actions/toolkit (@​actions/cache)

v6.2.0

  • Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
  • Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

  • Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

  • Bump dependency versions (#​2393):
    • @actions/core to ^3.0.1
    • @actions/http-client to ^4.0.1
    • @actions/io to ^3.0.2
    • @azure/core-rest-pipeline to ^1.23.0
    • @azure/storage-blob to ^12.31.0
    • semver to ^7.7.4

v6.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v5.0.5

  • Bump @actions/glob to 0.5.1

v5.0.4

  • Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

  • Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
  • Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2whatwg-url@5tr46@0.0.3 that used the deprecated punycode module

v5.0.0

  • Remove @azure/ms-rest-js dependency #​2197
    • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
  • Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
  • Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
  • Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
  • Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
  • Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
  • Add support for Node.js 24 #​2110
  • Add node-fetch override to resolve audit vulnerabilities #​2110
actions/toolkit (@​actions/core)

v3.0.1

  • Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

  • Bump @actions/http-client to 3.0.2

v2.0.1

v2.0.0

actions/toolkit (@​actions/exec)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

actions/toolkit (@​actions/http-client)

v4.0.1

  • Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

  • Bump undici from 5.28.5 to 6.23.0

v3.0.1

  • Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

actions/toolkit (@​actions/io)

v3.0.2

  • Fix: update lock file version

v3.0.1

  • Fix: export @actions/io/lib/io-util

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

  • Add support for Node 24 #​2110
  • Ensures consistent behavior for paths on Node 24 with Windows
actions/toolkit (@​actions/tool-cache)

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()
3.0.1
  • Bump @actions/http-client to 3.0.2
3.0.0
  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
2.0.2
2.0.1
  • Update to v2.0.1 of @actions/http-client #​1087
2.0.0
  • Update to v2.0.0 of @actions/http-client
  • The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
    This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
  • Update lockfileVersion to v2 in package-lock.json #​1025
1.7.1
1.7.0
1.6.1
1.6.0
1.3.5
1.3.4

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
1.1.2
1.0.0
  • Initial release

v3.0.1

  • Bump @actions/http-client to 3.0.2

v3.0.0

  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
babel/babel (@​babel/core)

v8.0.1

Compare Source

💥 Breaking Change
  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

v8.0.0

Compare Source

👓 Spec Compliance
💥 Breaking Change
  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser
🐛 Bug Fix
  • babel-generator
  • babel-plugin-transform-modules-systemjs
📝 Documentation
🏠 Internal
🏃‍♀️ Performance
biomejs/biome (@​biomejs/biome)

v2.5.10

Compare Source

Patch Changes
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
    <Component /* c */ client:load />
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #​11438 3133ffa Thanks @​Princesseuh! - Fixed #​8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
    <div class={/* a note */}>x</div>
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed #​9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
    <div>{/* only a comment */}</div>
  • #​11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
      <p>a</p>
    </>
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
    const a = "</script>";
    // </script> in a comment
    ---
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->
    ---
    this is text, not frontmatter
    ---
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block ending early on a line that merely starts with a dash.

    ---
    --count;
    ---
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed the children of an Astro element carrying is:raw being parsed as markup instead of raw text. This now also covers <script> and <style>, whose contents Astro emits verbatim rather than processing, so they are no longer linted as JavaScript or CSS.

    <article is:raw><% awesome %></article>
    <script is:raw>{{ mustache }}</script>
  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting attribute names that start with a colon, such as :href.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed the Astro parser failing to recover from a malformed closing tag such as <div></{<//, so that a later mistake is reported where it happens rather than cascading.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed { inside an Astro <math> element opening an expression. MathML is foreign content where Astro parses no expressions, so LaTeX such as R^{2x} now survives as text. <svg> is unaffected.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed {{ at the start of an Astro expression being read as an interpolation. Astro has no {{ }} syntax, so {{ a: 1 }} and <Comp a={{ b: 1 }} /> are object literals.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed expressions inside an Astro <pre> or <textarea> being read as raw text. Astro parses both as ordinary elements, so their markup and interpolations are now parsed, and a variable used only inside one is no longer reported as unused.

    <pre>{value}</pre>
    <textarea><div>{value}</div></textarea>
  • #​11403 8f7786f Thanks @​Princesseuh! - Added support for template literal attribute values in Astro, such as <div class=`a ${b} c`>.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting HTML5 unquoted attribute values that contain `, =, ' or ", such as <a href=a=b> and <a href=a'b>.

  • #​11393 dec5a8f Thanks @​1678092075! - Fixed #​11207: useStrictMode no longer reports Vue event handlers such as @click="count++".

  • #​11431 c065f99 Thanks @​levrik! - Fixed #​11429: Variables and imports used by Vue same-name bindings such as :disabled or v-bind:disabled are no longer reported as unused.

  • #​11409 405dedb Thanks @​ematipico! - Fixed a memory leak in the LSP server where memory usage kept growing over long editor sessions.

  • #​11422 a51eff7 Thanks @​dyc3! - Fixed #​11416: Biome no longer crashes when parsing incomplete {let} or {const} declarations in Svelte files.

  • #​11378 34b715c Thanks @​Netail! - Added extra rule sources from @eslint/css. biome migrate eslint detects rules in your eslint configurations more reliably.

  • #​11403 8f7786f Thanks @​Princesseuh! - Fixed {#, {/, {: and {@ being read as Svelte block openings in every HTML-like file. They are now Svelte-only, so in HTML, Vue and Angular files a sequence such as {#if x} is ordinary text instead of a parse error.

  • #​11443 8d45229 Thanks @​ematipico! - Fixed #​11390: noFloatingPromises no longer performs unnecessary type inference on call arguments when checking methods of non-generic class instances created with new.

  • #​11425 9c2667b Thanks @​dyc3! - Fixed #​6426: GritQL plugins now match and rewrite metavariables embedded in quoted strings.

  • #​11441 00317c3 Thanks @​dyc3! - Improved performance of useNamedCaptureGroup, noMisplacedAssertion, noSkippedTests, noExportsInTest, noDuplicateTestHooks, noIdenticalTestTitle, useTestHooksInOrder, and useTestHooksOnTop.

v2.5.9

Compare Source

Patch Changes
  • #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

  • #​11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

  • #​11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

    @layer {
      a {
        color: red;
      }
    }
  • #​11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

     <div>
       <!-- first group -->
    +
       <!-- second group -->
     </div>
  • #​10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

  • #​11333 715e0cd Thanks @​kkkhs! - Fixed #​11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

  • #​11343 9b98211 Thanks @​johncarmack1984! - Fixed #​11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

    @variant @xl {
      div {
        background: red;
      }
    }
  • #​11220 3e8c488 Thanks @​santichausis! - Fixed #​9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

    For example, Biome no longer reports greet as undeclared in the following Svelte component:

    <script module>
      export function greet() {
        console.log("Hello!");
      }
    </script>
    
    <script>
      greet();
    </script>
  • #​11300 36430eb Thanks @​dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

    - <marquee behavior="alternate"> This text will bounce </marquee>
    + <marquee behavior="alternate">This text will bounce</marquee>
  • #​11299 6559e6c Thanks @​jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

    For example, <Component client:only /> triggers the rule.

  • #​11365 7529811 Thanks @​MHJahanbakhsh! - Fixed #​11229: The useGenericFontNames rule now treats math as a valid generic font family.

  • #​11346 674f5f4 Thanks @​Jayllyz! - Fixed #​11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

    function factory() {
      const useColors = true; // no longer reported
      const useStore = createStore({ count: 0 }); // no longer reported
      const useData = () => useState(null); // still reported
      return useColors;
    }
  • #​11334 c87c46a Thanks @​zkasuran! - Fixed #​11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).

  • #​11364 13853b1 Thanks @​ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.

  • #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

  • #​11325 67c3bf0 Thanks @​dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

     <a-long-long-long-element
    -  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
    +  >foo bar foo bar foo bar foo bar foo bar foo
    +  bar</a-long-long-long-element
     >
  • #​11367 fe5b5d4 Thanks @​ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.

  • #​11316 17e48d6 Thanks @​wanxiankai! - Fixed #​11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.

  • #​11254 d25d113 Thanks @​dyc3! - Fixed #​11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.

  • #​11221 85aac73 Thanks @​freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.

    const value = input as SomeType;
  • #​11314 7ffb677 Thanks @​ematipico! - Fixed #​11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.

  • #​11356 6cd3263 Thanks @​johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).

  • #​11318 76059e9 Thanks @​johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).

  • #​11357 faa2074 Thanks @​johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).

  • #​11344 f34e15c Thanks @​johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).

  • #​11324 2f5d452 Thanks @​dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.

      <div>
    -   before<meter value=".5"></meter>
    -   after
    +   before<meter value=".5"></meter
    +   >after
      </div>
  • #​11312 e65f07e Thanks @​xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.

    <button />
  • #​11364 13853b1 Thanks @​ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

  • #​11301 610ee28 Thanks @​dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

    - <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
    + <video src="brave.webm">
    +   <track kind="subtitles" src="brave.en.vtt">
    + </video>

v2.5.8

Compare Source

Patch Changes

Note

PR body was truncated to here.


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Jul 6, 2025
@renovate
renovate Bot enabled auto-merge (squash) July 6, 2025 11:52
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from baf6177 to c6f4687 Compare July 10, 2025 16:47
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from 0d472cc to b7a264c Compare July 25, 2025 23:10
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch from b7a264c to 2a5f91e Compare July 29, 2025 20:31
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 5 times, most recently from 875e206 to ce3769a Compare August 12, 2025 02:51
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from 781b29f to 0979286 Compare August 19, 2025 10:35
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 5 times, most recently from b48cc3a to ed834e7 Compare August 27, 2025 15:56
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from c9fd260 to b984190 Compare September 6, 2025 22:54
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from ce4fc79 to 0fc5e29 Compare September 10, 2025 13:29
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from 617f9d5 to d5af895 Compare September 22, 2025 06:11
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from 389dee2 to b942834 Compare September 29, 2025 01:32
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 8 times, most recently from 7f47b7e to 0b27ccf Compare October 29, 2025 07:58
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 7 times, most recently from 39ed51f to 6f72944 Compare November 5, 2025 17:53
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 6 times, most recently from 689c0a7 to 6ea173d Compare November 12, 2025 02:52
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 4 times, most recently from ab8d7f2 to 2a07453 Compare November 20, 2025 09:14
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from dc2ac94 to 98d1fa6 Compare November 27, 2025 15:38
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from ee8f02a to 179ddd6 Compare December 2, 2025 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants