Skip to content

build(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates - #247

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-ca21b7abca
Open

build(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates#247
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-ca21b7abca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 7 updates in the / directory:

Package From To
@biomejs/biome 2.4.12 2.5.3
@cloudflare/vitest-pool-workers 0.12.21 0.18.4
@cloudflare/workers-types 4.20260418.1 5.20260714.1
turbo 2.9.6 2.10.5
typescript 6.0.3 7.0.2
@tanstack/devtools-vite 0.6.1 0.8.1
@types/node 25.9.5 26.1.1

Updates @biomejs/biome from 2.4.12 to 2.5.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.3

2.5.3

Patch Changes

  • #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

  • #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

  • #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

  • #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

  • #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

  • #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

  • #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

  • #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

  • #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

  • #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

  • #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

  • #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

What's Changed

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.3

Patch Changes

  • #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

  • #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

  • #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

  • #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

  • #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

  • #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

  • #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

  • #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

  • #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

  • #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

  • #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

  • #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

2.5.2

Patch Changes

  • #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

  • #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

  • #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

    <script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>

  • #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

  • #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

  • #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

... (truncated)

Commits

Updates @cloudflare/vitest-pool-workers from 0.12.21 to 0.18.4

Release notes

Sourced from @​cloudflare/vitest-pool-workers's releases.

@​cloudflare/vitest-pool-workers@​0.18.4

Patch Changes

  • #14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

    A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

    await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);

    The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

  • Updated dependencies [0283a1f, 7b28392, 1b965c5]:

    • wrangler@4.110.0
    • miniflare@4.20260708.1

@​cloudflare/vitest-pool-workers@​0.18.3

Patch Changes

  • #14489 e3f0cd6 Thanks @​edmundhung! - Add listDurableObjectIds() to Miniflare

    Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.

  • Updated dependencies [e3f0cd6, 8511ddf, 9f74a5f, e3f0cd6, c782e2a, 2fedb1f, 17d2fc1]:

    • miniflare@4.20260708.0
    • wrangler@4.109.0

@​cloudflare/vitest-pool-workers@​0.18.2

Patch Changes

@​cloudflare/vitest-pool-workers@​0.18.1

Patch Changes

... (truncated)

Changelog

Sourced from @​cloudflare/vitest-pool-workers's changelog.

0.18.4

Patch Changes

  • #14535 1b965c5 Thanks @​Naapperas! - Support dynamic retry delays for Workflow steps in local dev

    A step's retries.delay can now be a function that computes the delay per failed attempt, in addition to a static duration. The function receives { ctx, error } and returns a delay (a number of milliseconds or a duration string like "30 seconds"), and its result is fed into the configured backoff.

    await step.do(
  "call flaky API",
  {
    retries: {
      limit: 5,
      backoff: "constant",
      delay: ({ ctx }) => ctx.attempt * 1000,
    },
  },
  async () => {
    /* ... */
  }
);

    The function is invoked once per failed attempt with a 5 second timeout. If it throws, times out, or returns an invalid value, the step fails without further retries.

  • Updated dependencies [0283a1f, 7b28392, 1b965c5]:

    • wrangler@4.110.0
    • miniflare@4.20260708.1

0.18.3

Patch Changes

  • #14489 e3f0cd6 Thanks @​edmundhung! - Add listDurableObjectIds() to Miniflare

    Miniflare now exposes listDurableObjectIds() for listing persisted Durable Object instance IDs by binding name. The Vitest pool now uses this shared Miniflare API internally instead of duplicating Miniflare's storage listing logic.

  • Updated dependencies [e3f0cd6, 8511ddf, 9f74a5f, e3f0cd6, c782e2a, 2fedb1f, 17d2fc1]:

    • miniflare@4.20260708.0
    • wrangler@4.109.0

0.18.2

Patch Changes

... (truncated)

Commits

Updates @cloudflare/workers-types from 4.20260418.1 to 5.20260714.1

Commits

Updates turbo from 2.9.6 to 2.10.5

Release notes

Sourced from turbo's releases.

Turborepo v2.10.5

What's Changed

Changelog

... (truncated)

Commits

Updates typescript from 6.0.3 to 7.0.2

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @tanstack/devtools-vite from 0.6.1 to 0.8.1

Release notes

Sourced from @​tanstack/devtools-vite's releases.

@​tanstack/devtools-vite@​0.8.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/devtools-client@​0.0.8

@​tanstack/devtools-vite@​0.8.0

Minor Changes

  • #384 958c683 - feat: deliver devtools events from isolated server runtimes over Vite's native HotChannel

    Server code running in an isolated runtime (Nitro v3 worker thread, Cloudflare workerd, or any separate thread/process) does not share globalThis.__TANSTACK_EVENT_TARGET__ with the Vite dev process, so devtools events emitted on the server never reached the panel.

    The Vite plugin now bridges those events over the framework's existing import.meta.hot HotChannel — the same connection the runtime already uses for HMR. It injects a tiny, dev-only bridge into the event client when it runs in a non-client environment and wires each server environment's hot channel to the in-process ServerEventBus. No new WebSocket, no fetch, no reconnect logic, and no new runtime dependencies; the bridge is fully tree-shaken in production.

@​tanstack/devtools-vite@​0.7.2

Patch Changes

  • #466 73983a7 - Fix the plugin marketplace rendering empty ("No additional plugins available") when it should list installable plugins.

    • The client event bus no longer silently drops events emitted while its WebSocket is still connecting. Such events are now queued and flushed once the socket opens, so the marketplace's mounted request reliably reaches the server bus.
    • The marketplace now re-requests package.json every time it is opened and retries until the data arrives, so re-opening always re-fetches the plugin list.
    • Added TanStack AI Devtools (@tanstack/react-ai-devtools) to the plugin marketplace registry.

  • #449 2a2f9eb - Fix invalid syntax generated when removing parenthesized devtools JSX expressions.

  • Updated dependencies [73983a7]:

    • @​tanstack/devtools-client@​0.0.7
    • @​tanstack/devtools-event-bus@​0.4.2

@​tanstack/devtools-vite@​0.7.1

Patch Changes

  • #450 cf89dcd - fix go to source file whose path contains $ symbol

@​tanstack/devtools-vite@​0.7.0

Minor Changes

  • migrate from Babel to oxc-parser + MagicString (#397)
Changelog

Sourced from @​tanstack/devtools-vite's changelog.

0.8.1

Patch Changes

  • Updated dependencies []:
    • @​tanstack/devtools-client@​0.0.8

0.8.0

Minor Changes

  • #384 958c683 - feat: deliver devtools events from isolated server runtimes over Vite's native HotChannel

    Server code running in an isolated runtime (Nitro v3 worker thread, Cloudflare workerd, or any separate thread/process) does not share globalThis.__TANSTACK_EVENT_TARGET__ with the Vite dev process, so devtools events emitted on the server never reached the panel.

    The Vite plugin now bridges those events over the framework's existing import.meta.hot HotChannel — the same connection the runtime already uses for HMR. It injects a tiny, dev-only bridge into the event client when it runs in a non-client environment and wires each server environment's hot channel to the in-process ServerEventBus. No new WebSocket, no fetch, no reconnect logic, and no new runtime dependencies; the bridge is fully tree-shaken in production.

0.7.2

Patch Changes

  • #466 73983a7 - Fix the plugin marketplace rendering empty ("No additional plugins available") when it should list installable plugins.

    • The client event bus no longer silently drops events emitted while its WebSocket is still connecting. Such events are now queued and flushed once the socket opens, so the marketplace's mounted request reliably reaches the server bus.
    • The marketplace now re-requests package.json every time it is opened and retries until the data arrives, so re-opening always re-fetches the plugin list.
    • Added TanStack AI Devtools (@tanstack/react-ai-devtools) to the plugin marketplace registry.

  • #449 2a2f9eb - Fix invalid syntax generated when removing parenthesized devtools JSX expressions.

  • Updated dependencies [73983a7]:

    • @​tanstack/devtools-client@​0.0.7
    • @​tanstack/devtools-event-bus@​0.4.2

0.7.1

Patch Changes

  • #450 cf89dcd - fix go to source file whose path contains $ symbol

0.7.0

Minor Changes

  • migrate from Babel to oxc-parser + MagicString (#397)
Commits
  • e026667 ci: Version Packages (#475)
  • 7114ecd test: e2e suite (8 apps + server↔client probe) + unit/component coverage (#472)
  • f17d7e8 chore: add bugs.url metadata to all published packages (#470)
  • d9f2b37 ci: Version Packages (#468)
  • 958c683 feat: deliver devtools events from isolated server runtimes via Vite HotChann...
  • ca6e266 ci: Version Packages (#465)
  • 2a2f9eb fix(devtools-vite): preserve valid syntax when removing parenthesized devtool...
  • 45d9b8e ci: Version Packages (#453)
  • cf89dcd fix: fix go to source file whose path contains $ symbol (#450)
  • 5d359f2 ci: Version Packages (#442)
  • Additional commits viewable in compare view

Updates @types/node from 25.9.5 to 26.1.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the dev-dependencies group across 1 directory w…
1ad07ae 
…ith 7 updates

Bumps the dev-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.12` | `2.5.3` |
| [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.12.21` | `0.18.4` |
| [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `4.20260418.1` | `5.20260714.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.9.6` | `2.10.5` |
| [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` |
| [@tanstack/devtools-vite](https://github.com/TanStack/devtools/tree/HEAD/packages/devtools-vite) | `0.6.1` | `0.8.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.5` | `26.1.1` |



Updates `@biomejs/biome` from 2.4.12 to 2.5.3
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.3/packages/@biomejs/biome)

Updates `@cloudflare/vitest-pool-workers` from 0.12.21 to 0.18.4
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.18.4/packages/vitest-pool-workers)

Updates `@cloudflare/workers-types` from 4.20260418.1 to 5.20260714.1
- [Release notes](https://github.com/cloudflare/workerd/releases)
- [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md)
- [Commits](https://github.com/cloudflare/workerd/commits)

Updates `turbo` from 2.9.6 to 2.10.5
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.9.6...v2.10.5)

Updates `typescript` from 6.0.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@tanstack/devtools-vite` from 0.6.1 to 0.8.1
- [Release notes](https://github.com/TanStack/devtools/releases)
- [Changelog](https://github.com/TanStack/devtools/blob/main/packages/devtools-vite/CHANGELOG.md)
- [Commits](https://github.com/TanStack/devtools/commits/@tanstack/devtools-vite@0.8.1/packages/devtools-vite)

Updates `@types/node` from 25.9.5 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/vitest-pool-workers"
  dependency-version: 0.18.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@cloudflare/workers-types"
  dependency-version: 5.20260714.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.10.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
- dependency-name: "@tanstack/devtools-vite"
  dependency-version: 0.8.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants