chore(deps-dev): bump the pnpm-development-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #7 · sandrinodm/codepull

dependabot · 2026-09-07T21:46:32Z

Bumps the pnpm-development-dependencies group with 6 updates in the / directory:

Package	From	To
@biomejs/biome	`2.5.4`	`2.5.11`
@types/node	`26.1.1`	`26.4.0`
@vitest/coverage-v8	`4.1.10`	`4.1.11`
jsdoc-lint	`0.4.0`	`0.6.0`
release-it	`20.2.1`	`21.0.2`
vitest	`4.1.10`	`4.1.11`

Updates @biomejs/biome from 2.5.4 to 2.5.11

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes
#11499 9743d0c Thanks @scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.
#11437 88f805e Thanks @Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.
{options.map(() =>
  <div />
  <div />
)}
#11437 88f805e Thanks @Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

#11507 e2fc036 Thanks @dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

#11398 afc4615 Thanks @dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

#11526 372cd68 Thanks @dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

The refactor enabling these fixes also improves the performance of the rule.

#11458 a7cd286 Thanks @dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

#11515 382b15d Thanks @dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.
#11516 6f40e82 Thanks @levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.
const result = computed(() => list.find((item) => item.label === "a"));
Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.
#11495 496268d Thanks @Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

#11407 6ef52b0 Thanks @1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.
#11322 5c353e6 Thanks @jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

For example, the following snippet triggers the rule:
<div set:html={content} />

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.11

Patch Changes
#11499 9743d0c Thanks @scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.
#11437 88f805e Thanks @Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.
{options.map(() =>
  <div />
  <div />
)}
#11437 88f805e Thanks @Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

#11507 e2fc036 Thanks @dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

#11398 afc4615 Thanks @dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

#11526 372cd68 Thanks @dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

The refactor enabling these fixes also improves the performance of the rule.

#11458 a7cd286 Thanks @dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

#11515 382b15d Thanks @dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.
#11516 6f40e82 Thanks @levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.
const result = computed(() => list.find((item) => item.label === "a"));
Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.
#11495 496268d Thanks @Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

#11407 6ef52b0 Thanks @1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.
#11322 5c353e6 Thanks @jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

For example, the following snippet triggers the rule:
<div set:html={content} />
#11462 18883b7 Thanks @dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

4d9c1d5 ci: release (#11457)
18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
05797b1 ci: release (#11450)
5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
2081460 ci: release (#11309)
6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
a8798ea feat: useNamedLayer (#11377)
85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.4.0

Commits

See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
See full diff in compare view

Updates jsdoc-lint from 0.4.0 to 0.6.0

Release notes

Sourced from jsdoc-lint's releases.

v0.6.0

Full Changelog: sandrinodm/jsdoc-lint@v0.5.1...v0.6.0

v0.5.1

Full Changelog: sandrinodm/jsdoc-lint@v0.5.0...v0.5.1

v0.5.0

What's Changed

chore(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in sandrinodm/jsdoc-lint#6

chore(deps-dev): bump the pnpm-development-dependencies group with 5 updates by @dependabot[bot] in sandrinodm/jsdoc-lint#7

chore(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in sandrinodm/jsdoc-lint#9

Full Changelog: sandrinodm/jsdoc-lint@v0.4.0...v0.5.0

Commits

ee7907a chore: release 0.6.0
4a923ea feat: support TypeScript 7 declaration parsing
3853296 chore: release 0.5.1
18a992d fix: correct repository metadata
9243396 chore: release 0.5.0
ef7bd65 feat: expand JSDoc declaration coverage
c467780 chore(deps): bump actions/setup-node from 6 to 7
5ea1eea chore(deps-dev): bump the pnpm-development-dependencies group with 5 updates
c0b1956 chore(deps): bump actions/checkout from 6 to 7
See full diff in compare view

Updates release-it from 20.2.1 to 21.0.2

Release notes

Sourced from release-it's releases.

Release 21.0.2

Prevent duplicate comments on resolved issues and PRs (#1324) (7ca61cccd16ad56742ee0cb694c946353b66c117) - thanks @krisu-pl!

Migrate to pnpm + update deps (6c211f087f465af8942060812ec4ee662419da9f)

Release 21.0.1

Fix regression and support --no-hooks to skip all hooks (a8888b45b1d9db40a8f8ea5ad625b15b53d78925)

Release 21.0.0

fix(ci): do not run integration on forks (#1315) (1e90d9f28f08a847029ed58f8ac211028d4203ca) - thanks @trueberryless!

Pin GitHub Actions to immutable commits (#1316) (38355d8068ac5c0818bc183ddb39db643aeab0c3)

Fix npm publish workspace config resolution (#1312) (3bf251f5ab4c3665397aef8a7a4db6a21e02a98f) - thanks @cyphercodes!

Add gitlab.repoId option (#1224) (e4e9d0e35cbd99492c8b1a7b48e5a695951af7a2) - thanks @microHoffman!

Exit successfully when no release version is available (56c70c3f1436101a9284c535bed233081af85960)

Support numeric GitLab repository IDs (0332c4ac4ecb8b714c8971b3953c972f59fe1f30)

Parse CLI arguments strictly (resolve #1196) (caf77c928bfefa48339e8246261ffb8e41d70a4c)

fix: shell caching and working tree detection (#1317) (8d1f7522ffc6afb445a00ab03357fdc7554b48ac) - thanks @Mopsgamer!

Remove dependabot workflow (e7e04ef3fb6151324ffde438a278539fbbc24eec)

Fix configured GitHub proxy routing (1ed9cddf5d18d2c4107500081254cc7af22eff42)

Upgrade dependencies and require Node 22 (c055e7fa5b2dcaf5078d4a5c337140a5bea0ac7e)

Fix npm custom registry argument handling (resolve #1318) (98c45c4503e1d8bad0b7c38d99f6fda380c3681e)

Pin GitLab releases to the current commit (resolve #1216) (70ab5769852bc5a3fafe4ac193f28bd247fa067e)

Refresh GitHub Actions and package preview runtime (5c5513966ba2d4f1133c9b33c33850470c12a934)

Document v21 runtime requirements (daab8460c0f0ed7f8a97c0ef806ef506d59f7268)

Simplify git-cliff recipe (resolve #1195) (52c89a7965d3aff0a5d2474903fc902dbde59cf5)

Make GitLab CA tests platform-independent (ba4326fb1a79b700a909ac6adab8bd242401971c)

Raise Node 22 requirement to 22.21 (df94838844154a6b885af1888af81a75d43c80d9)

Verify GitLab server certificates by default (c381a2d4ce1deb26a9e54ead63339c4860231bfd)

Update changelog for v21 (2637e8a91fb560f23686773d3f476bff20daa5ae)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: [https://github.com/release-it/release-it/releases][1]

v21 (2026-07-25)

Removed support for Node.js v20 and raised the Node.js v22 minimum to v22.21.0.

CLI argument parsing is now strict. Unknown options, invalid booleans, and extra positional arguments are rejected.

GitLab server certificates are verified by default. Configure private CA or explicitly set gitlab.secure to false.

v20 (2026-03-24)

Upgraded undici from v6 to v7 to resolve security vulnerabilities.

Upgraded proxy-agent from v6 to v7 to fix DEP0169 (url.parse() deprecation).

Migrated from deprecated inquirer to @inquirer/prompts.

Bumped engines.node to minimum Node.js v20.19.0 (was v20.12.0).

v19 (2025-04-18)

No breaking changes (dependency party)

v18 (2025-01-06)

Removed support for Node.js v18.

v17 (2023-11-11)

Removed support for Node.js v16.

v16 (2023-07-05)

Removed support for Node.js v14.

v15 (2022-04-30)

Removed support for Node.js v10 and v12.

Removed support for GitLab v12.4 and lower.

Removed anonymous metrics (and the option to disable it).

Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

Removed global property from plugins. Use this.config[key] instead.

Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

... (truncated)

Commits

aa8752d Release 21.0.2
6c211f0 Migrate to pnpm + update deps
7ca61cc Prevent duplicate comments on resolved issues and PRs (#1324)
2a1d141 Release 21.0.1
a8888b4 Fix regression and support --no-hooks to skip all hooks
5e9c193 Release 21.0.0
2637e8a Update changelog for v21
c381a2d Verify GitLab server certificates by default
df94838 Raise Node 22 requirement to 22.21
ba4326f Make GitLab CA tests platform-independent
Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…1 directory with 6 updates Bumps the pnpm-development-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.4` | `2.5.11` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.4.0` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [jsdoc-lint](https://github.com/sandrinodm/jsdoc-lint) | `0.4.0` | `0.6.0` | | [release-it](https://github.com/release-it/release-it) | `20.2.1` | `21.0.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@biomejs/biome` from 2.5.4 to 2.5.11 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.11/packages/@biomejs/biome) Updates `@types/node` from 26.1.1 to 26.4.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `jsdoc-lint` from 0.4.0 to 0.6.0 - [Release notes](https://github.com/sandrinodm/jsdoc-lint/releases) - [Commits](sandrinodm/jsdoc-lint@v0.4.0...v0.6.0) Updates `release-it` from 20.2.1 to 21.0.2 - [Release notes](https://github.com/release-it/release-it/releases) - [Changelog](https://github.com/release-it/release-it/blob/main/CHANGELOG.md) - [Commits](release-it/release-it@20.2.1...21.0.2) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-development-dependencies - dependency-name: "@types/node" dependency-version: 26.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pnpm-development-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-development-dependencies - dependency-name: jsdoc-lint dependency-version: 0.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: pnpm-development-dependencies - dependency-name: release-it dependency-version: 21.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: pnpm-development-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pnpm-development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

Navigation Menu

chore(deps-dev): bump the pnpm-development-dependencies group across 1 directory with 6 updates - #7

chore(deps-dev): bump the pnpm-development-dependencies group across 1 directory with 6 updates#7
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/pnpm-development-dependencies-cd56196ee2

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

Biome CLI v2.5.11

2.5.11

Patch Changes

2.5.11

Patch Changes

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v0.6.0

v0.5.1

v0.5.0

What's Changed

Release 21.0.2

Release 21.0.1

Release 21.0.0

Changelog

v21 (2026-07-25)

v20 (2026-03-24)

v19 (2025-04-18)

v18 (2025-01-06)

v17 (2023-11-11)

v16 (2023-07-05)

v15 (2022-04-30)

v14 (2020-09-03)

v13 (2020-03-07)

v4.1.11

🐞 Bug Fixes

View changes on GitHub

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants