Skip to content

chore(deps-dev): bump the root-tooling group across 1 directory with 6 updates - #80

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/root-tooling-2d54cd6989
Open

chore(deps-dev): bump the root-tooling group across 1 directory with 6 updates#80
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/root-tooling-2d54cd6989

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the root-tooling group with 6 updates in the / directory:

Package From To
@biomejs/biome 2.5.1 2.5.3
@commitlint/cli 21.1.0 21.2.1
@commitlint/config-conventional 21.1.0 21.2.0
knip 6.18.0 6.26.0
lefthook 2.1.9 2.1.10
turbo 2.9.18 2.10.4

Updates @biomejs/biome from 2.5.1 to 2.5.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.3

2.5.3

Patch Changes

  • #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

  • #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

  • #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

  • #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

  • #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

  • #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

  • #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

  • #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

  • #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

  • #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

  • #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

  • #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

What's Changed

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.3

Patch Changes

  • #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

  • #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

  • #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

  • #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

  • #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

  • #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

  • #10853 93d8e53 Thanks @​Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

  • #10820 bba3092 Thanks @​JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

  • #10835 3447b2f Thanks @​dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

  • #10875 b12e486 Thanks @​dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

  • #10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

  • #10867 a21463e Thanks @​dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

2.5.2

Patch Changes

  • #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

  • #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

  • #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

    <script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>

  • #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

  • #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

  • #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

... (truncated)

Commits

Updates @commitlint/cli from 21.1.0 to 21.2.1

Release notes

Sourced from @​commitlint/cli's releases.

v21.2.1

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

Chore, doc, etc.

New Contributors

Full Changelog: conventional-changelog/commitlint@v21.2.0...v21.2.1

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

Changelog

Sourced from @​commitlint/cli's changelog.

21.2.1 (2026-07-08)

Note: Version bump only for package @​commitlint/cli

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
Commits

Updates @commitlint/config-conventional from 21.1.0 to 21.2.0

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.0

21.2.0 (2026-06-30)

Features

Chore

Full Changelog: conventional-changelog/commitlint@v21.1.0...v21.2.0

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.0 (2026-06-30)

Features

  • resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)
Commits
  • 1b4e5bc v21.2.0
  • fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
  • See full diff in compare view

Updates knip from 6.18.0 to 6.26.0

Release notes

Sourced from knip's releases.

Release 6.26.0

  • ci: add path filters (#1871) (4249935adffe1b8eca9570fb325fa19cc8010584) - thanks @​trueberryless!
  • Add CodeRabbit as gold sponsor (1da09fdc8f4d851f3cad30659200018bfb47a5e0)
  • Fix up docs a bit more (39125a7f473e006f61629781bff1ac4a050ca460)
  • Don't report ambient declaration files as unused (aed361c00a82829c2fc80a65a2f7af174316782e)
  • Register oclif command files as entries (3b4d58c9da83d93b6821a2b24f57b919ba886756)
  • Add electron-vite plugin (d92107ea504833b3ee7ad2b695e22d40528b24c3)
  • Add esbuild plugin (ef3b601d957546554de2cb1fbff859f5bdafb741)
  • Ignore more globally available binaries (829298129fdfd1b41a1f8dff5022b9fbbe25f454)
  • Resolve #-imports to source when node condition is unbuilt (resolve #1873) (f2713ed1e499ab286b86615d4b8ec34f711d1bd2)
  • Ignore gh as a globally available binary (a6f0772e5db03a8412a3ac036756779f22d1a27d)
  • Resolve Vitest benchmark files as entries (57429139f7e93f2a4bee35a53d450c4f45dea9ff)
  • Extract shared Vue auto-import machinery into plugins/_vue (73010753d432ae58eb12c7eec9c5723036009749)
  • Scope compiler extensions per workspace (5e6f82b963a83e5801484efbc01a4b6a9ce39ea3)
  • Resolve auto-imported components in the Vue SFC compiler (009aad8f9dab589898e5dba4c85fa41ea57c1a49)
  • Add plugins for the Vue auto-import ecosystem (f638c8302cdd26a63e477344a7cf44ef60af7788)
  • Enable Vue SFC compiler on unplugin-vue and @​vitejs/plugin-vue (9396ab159919147ef81dad16e365e531b32b4b12)
  • Recognize vite-plugin-vue-meta-layouts (same layouts convention) (3ceee89228b0173eddc0466bf50e8181286ffebc)
  • Add vite-plugin-pages and unplugin-icons plugins (9bc17540bcf8eb142474ed84837c1e2cebb7fe73)
  • Add vite-plugin-pwa and @​intlify/unplugin-vue-i18n plugins (45dea0a397ed754c34617ed18deef4dc6f0ec0d4)
  • Dog, food. (e1249ade2558d3801d85e2dc63349d884f3443d4)
  • Update query snapshot (a45941d2db381c04f8a38416533217ee84f77ca7)
  • Don't misread Nitro route types as Vue component auto-imports (43aecd5414eb63bec3637f37ffac0c62a71e7e74)
  • Read oxlint jsPlugins from vite-plus vite.config and .oxlintrc.json (589ffda4e3a7d0c0d772191ad6f8d6e60dd298cf)
  • Add vite-plus plugin for run.tasks and staged scripts (f041c191e4e10dd181ad212b71079e3e10bcf341)
  • Support @​vite-pwa/nuxt PWA config in nuxt.config (8fa7b116690e37484798ad98eca002d26c0c80fe)
  • Add @​vite-pwa/assets-generator plugin (4254f7d53a284a4ea4612f650ae03495bcb0d582)
  • Add @​nuxtjs/i18n plugin (dfb9acbe5a08ebc85562f59a04e7f4bedb4925f1)
  • Read plugin entries from vite.config options and index.html (d533da8cc2b431d206eb7c55323ea51846eca0bb)
  • Fix false positives in VitePress, next-mdx and unplugin-vue-i18n plugins (b99702a76e26b1943a16517f1633de3a0713c196)
  • Respect optional peers in pnpm and Yarn packageExtensions (aab080bbd436494316df045011ab22cbebca06b4)
  • Detect babel plugins in the Storybook config (5dea975adf9b88971ad56434132282a099c7d58c)
  • Add shared AST helpers for imported calls and first property values (c84bb7a87a17f1921c12bb02bcfd43f905cae595)
  • Inline trivial resolveFromAST wrappers and normalize orval and sst (620079d1d07b69a69bbb67b6a6e68963b6c2fc21)
  • Extract inline resolveFromAST implementations to dedicated files (b5231c12f915428067d790187d2dd4c44e2559d4)
  • Normalize resolveFromAST files to a uniform contract (fc1ba0fb45aaf623de678a57bea3b5567ea04750)
  • chore: migrate to Astro 7 and Sätteri (#1875) (f256a5b276c3d69dd5081c591bbb183aacebf766) - thanks @​trueberryless!
  • Show contributor count on docs homepage (6b8454a2841905ce7f08e1a23b54bc17a0854608)
  • Exclude gitignored package entry points (606e5d051b4f0620c776aa23352153b8253bd75b)
  • Add Tauri plugin (199180da79c71acc80865dc65ce89653a26d9579)
  • Add Laravel plugin (197453378f2b60e5143a30ec78b438f02b37c53b)
  • Add Quasar plugin (a220729074bfbb9e7d03ba329e89ad553c3a7799)

Release 6.25.0

  • fix: derive package name from package.json under Yarn nodeLinker: pnpm store (#1852) (3764605ed150b975fb6c88c4c4aa47f5bf9ae149) - thanks @​blowery!
  • Pick up types used in module augmentations via path aliases (resolve #1850) (9cc5a4132793990b5fcf9eae6f3db37426d979c0)
  • feat: add support for packageExtensions in yarn and pnpm (#1847) (61d3164cdac6e9252b3c52ce3bb2909949b4690e) - thanks @​trueberryless!
  • fix(ci): do not run integration on forks (#1855) (d23c10d1ae764c0b70addaafc79f01c543cc5efa) - thanks @​trueberryless!
  • chore(ci): improve security through specific permissions (#1856) (1eb42e639f9ec12d6d2ef88e1aaf07397b5bf226) - thanks @​trueberryless!
  • chore(ci): add concurrency blocks (#1857) (3bf3d115cf677fadcfe8fa72ce0e68cfd435d399) - thanks @​trueberryless!

... (truncated)

Commits
  • 441faf0 Release knip@6.26.0
  • a220729 Add Quasar plugin
  • 1974533 Add Laravel plugin
  • 199180d Add Tauri plugin
  • 606e5d0 Exclude gitignored package entry points
  • fc1ba0f Normalize resolveFromAST files to a uniform contract
  • b5231c1 Extract inline resolveFromAST implementations to dedicated files
  • 620079d Inline trivial resolveFromAST wrappers and normalize orval and sst
  • c84bb7a Add shared AST helpers for imported calls and first property values
  • 5dea975 Detect babel plugins in the Storybook config
  • Additional commits viewable in compare view

Updates lefthook from 2.1.9 to 2.1.10

Release notes

Sourced from lefthook's releases.

v2.1.10

Changelog

  • c0a32e900407bf3e2e97c99a7dd2e3f2864ba13a deps: July 2026 (#1463)
  • 0b87ca6dc643dab804a1aad59c24003ef147c11a deps: June 2026 (#1447)
  • afce7244cf02abaf996ebe87bb557a725e46993e deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)
  • fbb61b369b57a17469bd6997d1624608ce977f61 feat: AI coding agents integration (#1448)
  • cbfb4a5db29b46ac8bf399665cd9ada81022b848 fix: make test suite stable when NO_COLOR is set (#1449)
Changelog

Sourced from lefthook's changelog.

2.1.10 (2026-07-08)

Commits

Updates turbo from 2.9.18 to 2.10.4

Release notes

Sourced from turbo's releases.

Turborepo v2.10.4

What's Changed

Changelog

... (truncated)

Commits
  • 1506a11 publish 2.10.4 to registry
  • 11a68c7 fix: Stop flagging relative imports that resolve into node_modules in boundar...
  • 947b478 fix: Raise the open-file soft limit at startup (#13282)
  • ddc584d feat: Make turbo prune Cargo-aware (#13281)
  • ff0d508 perf: Skip dependency-closure assembly for toolchains that derive nothing (#1...
  • 39d623e feat: Make turbo watch Cargo-aware (#13280)
  • af01fdf fix: Collapse nested package-manager fallback conditional (#13279)
  • 7e02f94 release(turborepo): 2.10.4-canary.2 (#13278)
  • 8e3a59f release(library): 0.0.1-canary.23 (#13276)
  • ce18f0a test: Add end-to-end coverage for Cargo workspaces (#13274)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot Bot added scope: infra Docker, CI/CD, env type: chore Maintenance, dépendances, CI labels Jul 13, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/root-tooling-2d54cd6989 branch from 8f186d6 to a72ee85 Compare July 13, 2026 09:00
@dependabot
chore(deps-dev): bump the root-tooling group across 1 directory with …
faae724 
…6 updates

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-tooling
- dependency-name: "@commitlint/cli"
  dependency-version: 21.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-tooling
- dependency-name: "@commitlint/config-conventional"
  dependency-version: 21.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-tooling
- dependency-name: knip
  dependency-version: 6.26.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-tooling
- dependency-name: lefthook
  dependency-version: 2.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: root-tooling
- dependency-name: turbo
  dependency-version: 2.10.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: root-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/root-tooling-2d54cd6989 branch from a72ee85 to faae724 Compare July 13, 2026 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

scope: infra Docker, CI/CD, env type: chore Maintenance, dépendances, CI

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants