Skip to content

chore(deps): update devdependencies (major)#428

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-devdependencies
Open

chore(deps): update devdependencies (major)#428
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/major-devdependencies

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jul 6, 2025

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@actions/cache (source) ^4.0.2^6.0.0 age confidence
@actions/core (source) ^1.11.1^3.0.0 age confidence
@actions/exec (source) ^1.1.1^3.0.0 age confidence
@actions/http-client (source) 2.2.34.0.0 age confidence
@actions/io (source) ^1.1.3^3.0.0 age confidence
@actions/tool-cache (source) ^2.0.2^4.0.0 age confidence
@biomejs/biome (source) ^1.9.4^2.0.0 age confidence
@octokit/openapi-types (source) ^25.0.0^27.0.0 age confidence
@octokit/plugin-paginate-rest ^13.0.0^14.0.0 age confidence
@octokit/plugin-rest-endpoint-methods ^16.0.0^17.0.0 age confidence
@octokit/types ^14.0.0^16.0.0 age confidence
@types/jest (source) ^29.5.14^30.0.0 age confidence
@types/node (source) ^22.13.8^25.0.0 age confidence
cross-env 7.0.310.1.0 age confidence
jest (source) ^29.7.0^30.0.0 age confidence
p-timeout ^6.1.4^7.0.0 age confidence

Release Notes

actions/toolkit (@​actions/cache)

v6.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v5.0.5

  • Bump @actions/glob to 0.5.1

v5.0.4

  • Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

  • Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
  • Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2whatwg-url@5tr46@​0.0.3 that used the deprecated punycode module

v5.0.0

  • Remove @azure/ms-rest-js dependency #​2197
    • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
  • Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
  • Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
  • Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
  • Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
  • Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
  • Add support for Node.js 24 #​2110
  • Add node-fetch override to resolve audit vulnerabilities #​2110
actions/toolkit (@​actions/core)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

  • Bump @actions/http-client to 3.0.2

v2.0.1

v2.0.0

actions/toolkit (@​actions/exec)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

actions/toolkit (@​actions/http-client)

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

  • Bump undici from 5.28.5 to 6.23.0

v3.0.1

  • Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

actions/toolkit (@​actions/io)

v3.0.2

  • Fix: update lock file version

v3.0.1

  • Fix: export @actions/io/lib/io-util

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

  • Add support for Node 24 #​2110
  • Ensures consistent behavior for paths on Node 24 with Windows
actions/toolkit (@​actions/tool-cache)

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()
3.0.1
  • Bump @actions/http-client to 3.0.2
3.0.0
  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
2.0.2
2.0.1
  • Update to v2.0.1 of @actions/http-client #​1087
2.0.0
  • Update to v2.0.0 of @actions/http-client
  • The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
    This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
  • Update lockfileVersion to v2 in package-lock.json #​1025
1.7.1
1.7.0
1.6.1
1.6.0
1.3.5
1.3.4

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
1.1.2
1.0.0
  • Initial release

v3.0.1

  • Bump @actions/http-client to 3.0.2

v3.0.0

  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
biomejs/biome (@​biomejs/biome)

v2.4.5

Compare Source

Patch Changes
  • #​9185 e43e730 Thanks @​dyc3! - Added the nursery rule useVueScopedStyles for Vue SFCs. This rule enforces that <style> blocks have the scoped attribute (or module for CSS Modules), preventing style leakage and conflicts between components.

  • #​9184 49c8fde Thanks @​chocky335! - Improved plugin performance by batching all plugins into a single syntax visitor with a kind-to-plugin lookup map, reducing per-node dispatch overhead from O(N) to O(1) where N is the number of plugins.

  • #​9283 071c700 Thanks @​dyc3! - Fixed noUndeclaredVariables erroneously flagging functions and variables defined in the <script setup> section of Vue SFCs.

  • #​9221 4612133 Thanks @​ematipico! - Fixed an issue where the JSON reporter didn't contain the duration of the command.

  • #​9294 1805c8f Thanks @​Netail! - Extra rule source reference. biome migrate eslint should do a bit better detecting rules in your eslint configurations.

  • #​9178 101b3bb Thanks @​Bertie690! - Fixed #​9172 and #​9168:
    Biome now considers more constructs as valid test assertions.

    Previously, assert, expectTypeOf and assertType
    were not recognized as valid assertions by Biome's linting rules, producing false positives in lint/nursery/useExpect and other similar rules.

    Now, these rules will no longer produce errors in test cases that used these constructs instead of expect:

    import { expectTypeOf, assert, assertType } from "vitest";
    
    const myStr = "Hello from vitest!";
    it("should be a string", () => {
      expectTypeOf(myStr).toBeString();
    });
    test("should still be a string", () => {
      assertType<string>(myStr);
    });
    it.todo("should still still be a string", () => {
      assert(typeof myStr === "string");
    });
  • #​9173 32dad2d Thanks @​dyc3! - Added parsing support for Svelte's new comments-in-tags feature.

    The HTML parser will now accept JS style comments in tags in Svelte files.

    <button
      // single-line comment
      onclick={doTheThing}
    >click me</button>
    
    <div
      /* block comment */
      class="foo"
    >text</div>
  • #​8952 1d2ca15 Thanks @​pkallos! - Added the nursery rule useNullishCoalescing. This rule suggests using the nullish coalescing operator (??) instead of logical OR (||) when the left operand may be nullish. This prevents bugs where falsy values like 0, '', or false are incorrectly treated as missing. Addresses #​8043

    // Invalid
    declare const x: string | null;
    const value = x || "default";
    
    // Valid
    const value = x ?? "default";
  • #​9243 1992a85 Thanks @​Netail! - Fixed #​7813: improved the diagnostic of the rule useExhaustiveDependencies. The diagnostic now shows the name of the variable to add to the dependency array.

  • #​9063 3d0648f Thanks @​taga3s! - Added the nursery rule noVueRefAsOperand. This rule disallows cases where a ref is used as an operand.

    The following code is now flagged:

    import { ref } from "vue";
    
    const count = ref(0);
    count++; // Should be: count.value++
    import { ref } from "vue";
    
    const ok = ref(false);
    if (ok) {
      // Should be: if (ok.value)
      //
    }
  • #​9273 f239e20 Thanks @​denbezrukov! - Fixed #​9253: parsing of @container scroll-state(...) queries.

    @&#8203;container scroll-state(scrolled: bottom) {
    }
    @&#8203;container scroll-state(stuck) {
    }
    @&#8203;container scroll-state(not (stuck)) {
    }
    @&#8203;container scroll-state((stuck) and (scrolled: bottom)) {
    }
    @&#8203;container scroll-state((stuck) or (snapped: x)) {
    }
    @&#8203;container main-layout scroll-state(not ((stuck) and (scrolled: bottom))) {
    }
  • #​9259 96939c0 Thanks @​ematipico! - Fixed CSS formatter incorrectly collapsing selectors when a BOM (Byte Order Mark) character is present at the start of the file. The formatter now correctly preserves line breaks between comments and selectors in BOM-prefixed CSS files, matching Prettier's behavior.

  • #​9251 59e33fb Thanks @​ematipico! - Fixed #​9249: The CSS formatter no longer incorrectly breaks ratio values (like 1 / -1) across lines when followed by comments.

  • #​9284 ec3a17f Thanks @​denbezrukov! - Fixed #​9253: removed false-positive diagnostics for valid @container/@supports general-enclosed queries.

    @&#8203;container scroll-state(scrolled: bottom) {
    }
    @&#8203;supports foo(bar: baz) {
    }
  • #​9215 b2619a1 Thanks @​FrederickStempfle! - Fixed #​9189: biome ci in GitHub Actions now correctly disables colors so that ::error/::warning workflow commands are not wrapped in ANSI escape codes.

  • #​9256 65ae4c1 Thanks @​ematipico! - Fixed JSON reporter escaping of special characters in diagnostic messages. The JSON reporter now properly escapes double quotes, backslashes, and control characters in error messages and advice text, preventing invalid JSON output when diagnostics contain these characters.

  • #​9223 5b9da81 Thanks @​ematipico! - Fixed an issue where the JSON reporter didn't write output to a file when --reporter-file was specified. The output is now correctly written to the specified file instead of always going to stdout.

  • #​9154 c487e54 Thanks @​abossenbroek! - Fixed #​9115: The noPlaywrightMissingAwait rule no longer produces false positives on jest-dom matchers like toBeVisible, toBeChecked, toHaveAttribute, etc. For matchers shared between Playwright and jest-dom, the rule now checks whether expect()'s argument is a Playwright locator or page object before flagging. Added semantic variable resolution so that extracted Playwright locators (e.g. const loc = page.locator('.item'); expect(loc).toBeVisible()) are still correctly flagged.

  • #​9269 33e5cdf Thanks @​dyc3! - Fixed a false positive where noUndeclaredVariables reported bindings from Vue <script setup> as undeclared when used in <template>.

    This change ensures embedded bindings collected from script snippets (like imports and defineModel results) are respected by the rule.

  • #​9267 2c2e060 Thanks @​ematipico! - Fixed #​9143 and #​8849: The noUnresolvedImports rule no longer reports false positives for several common patterns:

    • node:fs, node:path, node:url, and other Node.js built-in modules with the node: prefix are now accepted.
    • Packages that declare their TypeScript entry point via "typings" (instead of "types") in package.json now resolve correctly.
    • Named imports from aliased re-export chains (e.g. export { x as y } from "...") are now resolved correctly through the alias.
    • Namespace re-exports (e.g. export * as Ns from "...") are now recognized as own exports of the barrel module.
  • #​9254 f7bf12b Thanks @​ematipico! - Fixed #​8842: The CSS formatter now correctly formats @container scroll-state() without adding an unwanted space between the function name and opening parenthesis.

  • #​9211 2d0b8e6 Thanks @​ematipico! - Fixed #​7905. Improved the accuracy of type-aware lint rules when analyzing re-exported functions and values.

    Previously, when a binding was imported from another module, its type was not correctly inferred during the type analysis phase. This caused type-aware lint rules to fail to detect issues when working with re-exported imports.

    The following rules now correctly handle re-exported imports:

    Example of now-working detection:

    // getValue.ts
    export async function getValue(): Promise<number> {
      return 42;
    }
    
    // reexport.ts
    export { getValue } from "./getValue";
    
    // index.ts
    import { getValue } from "./reexport";
    
    // Previously: no diagnostic (type was unknown)
    // Now: correctly detects that getValue() returns a Promise
    await getValue(); // Valid - properly awaited
    getValue(); // Diagnostic - floating promise
  • #​8934 b49707c Thanks @​tim-we! - Fixed #​8265: Biome now correctly detects test framework calls that use three arguments (label, options, callback) (e.g., describe("foo", { retry: 2 }, () => {})). This fixes both formatting and the noDuplicateTestHooks lint rule for test frameworks like Vitest.

  • #​9191 688fd34 Thanks @​dyc3! - Fixed #​9180: fixed a panic caused by an interaction between noRedundantUseStrict and the formatter

  • #​9048 9bbdf4d Thanks @​ff1451! - Added the nursery rule useNamedCaptureGroup.
    The rule enforces using named capture groups in regular expressions instead of numbered ones. It supports both regex literals and RegExp constructor calls.

    // Invalid: unnamed capture group
    /(foo)/;
    new RegExp("(foo)");
    
    // Valid: named capture group
    /(?<id>foo)/;
    new RegExp("(?<id>foo)");
  • #​9255 9b6685b Thanks @​ematipico! - Fixed #9234, where some nursery rules panicked when they were configured with the option level without the corresponding options.

  • #​8968 a2b4494 Thanks @​LouisLau-art! - Fixed #​8812: lint/suspicious/noArrayIndexKey will now report index usage anywhere in JSX key template or binary expressions, not only in the last visited identifier.

  • #​9266 84935a4 Thanks @​dyc3! - Fixed #​9250: noVueDuplicateKeys will no longer flag keys under watch, preventing false positives.

  • #​9056 1f2fe2e Thanks @​ruidosujeira! - Added the nursery rule useArraySome to prefer .some() over verbose existence checks like filter(...).length > 0 and findIndex(...) !== -1, with suggestions for find/findLast existence checks. This also applies to ES2025 iterator helpers such as Iterator.prototype.find.

  • #​9163 f87acf6 Thanks @​JUSTIVE! - Added graphql to valid embedded graphql template tags inside JavaScript files, when the feature javascript.experimentalEmbeddedSnippetsEnabled is enabled. This allows proper support for graphql tags used in RelayJS.

    Now, code snippets like the following are correctly formatted and limited:

    import { graphql } from "react-relay";
    
    const query = graphql`
      query {
        user(id: 1) {
          id
          name
        }
      }
    `;
  • #​8773 6b01778 Thanks @​xcb3d! - Added the new nursery rule useUnicodeRegex.

    The rule enforces the use of the u or v flag for regular expressions. This ensures proper handling of Unicode characters like emoji.

    // Invalid
    /foo/;
    new RegExp("foo", "gi");
    
    // Valid
    /foo/u;
    new RegExp("foo", "giu");

v2.4.4

Compare Source

Patch Changes
  • #​9150 6946835 Thanks @​dyc3! - Fixed #​9138: Astro files containing --- in HTML content (e.g., <h1>---Hi</h1>) are now parsed correctly, both when a frontmatter block is present and when there is no frontmatter at all.

  • #​9150 aa6f837 Thanks @​dyc3! - Fixed #​9138: The HTML parser incorrectly failing to parse bracket characters ([ and ]) in text content (e.g. <div>[Foo]</div>).

  • #​9151 c0d4b0c Thanks @​dyc3! - Fixed parsing of Svelte directive keywords (use, style) when used as plain text content in HTML/Svelte files. Previously, <p>use JavaScript</p> or <p>style it</p> would incorrectly produce a bogus element instead of proper text content.

  • #​9162 7f1e060 Thanks @​dyc3! - Fixed #​9161: The Vue parser now correctly handles colon attributes like xlink:href and xmlns:xlink by parsing them as single attributes instead of splitting them into separate tokens.

  • #​9164 458211b Thanks @​dyc3! - Fixed #​9161: The noAssignInExpressions rule no longer flags assignments in Vue v-on directives (e.g., @click="counter += 1"). Assignments in event handlers are idiomatic Vue patterns and are now skipped by the rule.

v2.4.3

Compare Source

Patch Changes
  • #​9120 aa40fc2 Thanks @​ematipico! - Fixed #​9109, where the GitHub reporter wasn't correctly enabled when biome ci runs on GitHub Actions.

  • #​9128 8ca3f7f Thanks @​dyc3! - Fixed #​9107: The HTML parser can now correctly parse Astro directives (client/set/class/is/server), which fixes the formatting for Astro directives.

  • #​9124 f5b0e8d Thanks @​ematipico! - Fixed #​8882 and #​9108: The Astro frontmatter lexer now correctly identifies the closing --- fence when the frontmatter contains multi-line block comments with quote characters, strings that mix quote types (e.g. "it's"), or escaped quote characters (e.g. "\").

  • #​9142 3ca066b Thanks @​THernandez03! - Fixed #​9141: The noUnknownAttribute rule no longer reports closedby as an unknown attribute on <dialog> elements.

  • #​9126 792013e Thanks @​ematipico! - Added missing Mocha globals to the Test domain: context, run, setup, specify, suite, suiteSetup, suiteTeardown, teardown, xcontext, xdescribe, xit, and xspecify. These are injected by Mocha's BDD and TDD interfaces and were previously flagged as undeclared variables in projects using Mocha.

  • #​8855 6918c9e Thanks @​ruidosujeira! - Fixed #​8840. Now the Biome CSS parser correctly parses not + scroll-state inside @container queries.

  • #​9111 4fb55cf Thanks @​Jayllyz! - Slightly improved performance of noIrregularWhitespace by adding early return optimization and simplifying character detection logic.

  • #​8975 086a0c5 Thanks @​FrankFMY! - Fixed #​8478: useDestructuring no longer suggests destructuring when the variable has a type annotation, like const foo: string = object.foo.

v2.4.2

Compare Source

Patch Changes

v2.4.1

Compare Source

Patch Changes

v2.4.0

Compare Source

Minor Changes
  • #​8964 0353fa0 Thanks @​dyc3! - Added ignore option to the useHookAtTopLevel rule.

    You can now specify function names that should not be treated as hooks, even if they follow the use* naming convention.

    Example configuration:

    {
      "linter": {
        "rules": {
          "correctness": {
            "useHookAtTopLevel": {
              "options": {
                "ignore": ["useDebounce", "useCustomUtility"]
              }
            }
          }
        }
      }
    }
  • #​8769 d0358b0 Thanks @​rahuld109! - Added the rule useAnchorContent for HTML to enforce that anchor elements have accessible content for screen readers. The rule flags empty anchors, anchors with only whitespace, and anchors where all content is hidden with aria-hidden. Anchors with aria-label or title attributes providing a non-empty accessible name are considered valid.

  • #​8742 6340ce6 Thanks @​rahuld109! - Added the rule useMediaCaption to the HTML language. Enforces that audio and video elements have a track element with kind="captions" for accessibility. Muted videos are allowed without captions.

  • #​8621 d11130b Thanks @​Netail! - Added support for multiple reporters, and the ability to save reporters on arbitrary files.

Combine two reporters in CI

If you run Biome on GitHub, take advantage of the reporter and still see the errors in console, you can now use both reporters:

biome ci --reporter=default --reporter=github
Save reporter output to a file

With the new --reporter-file CLI option, it's now possible to save the output of all reporters to a file. The file is a path,
so you can pass a relative or an absolute path:

biome ci --reporter=rdjson --reporter-file=/etc/tmp/report.json
biome ci --reporter=summary --reporter-fil

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/aminya/setup-cpp).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNy4yIiwidXBkYXRlZEluVmVyIjoiNDMuNDguMSIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

@renovate renovate bot added the dependencies label Jul 6, 2025
@renovate renovate bot enabled auto-merge (squash) July 6, 2025 11:52
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from baf6177 to c6f4687 Compare July 10, 2025 16:47
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from 0d472cc to b7a264c Compare July 25, 2025 23:10
@renovate renovate bot force-pushed the renovate/major-devdependencies branch from b7a264c to 2a5f91e Compare July 29, 2025 20:31
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 5 times, most recently from 875e206 to ce3769a Compare August 12, 2025 02:51
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from 781b29f to 0979286 Compare August 19, 2025 10:35
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 5 times, most recently from b48cc3a to ed834e7 Compare August 27, 2025 15:56
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from c9fd260 to b984190 Compare September 6, 2025 22:54
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from ce4fc79 to 0fc5e29 Compare September 10, 2025 13:29
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 3 times, most recently from 617f9d5 to d5af895 Compare September 22, 2025 06:11
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from 389dee2 to b942834 Compare September 29, 2025 01:32
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 8 times, most recently from 7f47b7e to 0b27ccf Compare October 29, 2025 07:58
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 7 times, most recently from 39ed51f to 6f72944 Compare November 5, 2025 17:53
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 6 times, most recently from 689c0a7 to 6ea173d Compare November 12, 2025 02:52
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 4 times, most recently from ab8d7f2 to 2a07453 Compare November 20, 2025 09:14
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from dc2ac94 to 98d1fa6 Compare November 27, 2025 15:38
@renovate renovate bot force-pushed the renovate/major-devdependencies branch 2 times, most recently from ee8f02a to 179ddd6 Compare December 2, 2025 20:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants