Update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@biomejs/biome (source)	2.0.6 → 2.5.3
@internationalized/date (source)	3.12.1 → 3.12.2
@lucide/svelte (source)	1.14.0 → 1.23.0
@napi-rs/canvas	1.0.0 → 1.0.2
@number-flow/svelte (source)	0.4.0 → 0.4.1
@orval/zod (source)	7.16.0 → 7.21.0
@quantco/pnpm-licenses	2.2.1 → 2.4.2
@sinclair/typebox	0.34.41 → 0.34.49
@sveltejs/adapter-node (source)	5.5.4 → 5.5.7
@sveltejs/kit (source)	2.62.0 → 2.69.2
@sveltejs/vite-plugin-svelte (source)	7.1.2 → 7.2.0
@tailwindcss/vite (source)	4.2.4 → 4.3.2
@tiptap/core (source)	3.15.3 → 3.27.3
@tiptap/extension-image (source)	3.15.3 → 3.27.3
@tiptap/extension-link (source)	3.15.3 → 3.27.3
@tiptap/extension-table (source)	3.15.3 → 3.27.3
@tiptap/extension-table-cell (source)	3.15.3 → 3.27.3
@tiptap/extension-table-header (source)	3.15.3 → 3.27.3
@tiptap/extension-table-row (source)	3.15.3 → 3.27.3
@tiptap/starter-kit (source)	3.15.3 → 3.27.3
@types/node (source)	24.10.0 → 24.13.3
@types/qs (source)	6.14.0 → 6.15.1
@typeschema/class-validator (source)	^0.2.0 → ^0.3.0
arktype (source)	2.1.25 → 2.2.3
bits-ui	2.18.0 → 2.18.1
class-validator	^0.14.2 → ^0.15.0
concurrently	9.2.1 → 9.2.3
d3-format (source)	3.1.0 → 3.1.2
date-fns	4.1.0 → 4.4.0
dotenv	17.2.3 → 17.4.2
emoji-picker-element	1.27.0 → 1.29.1
eslint (source)	9.39.2 → 9.39.4
eslint-plugin-svelte (source)	3.16.0 → 3.20.0
globals	17.6.0 → 17.7.0
isomorphic-dompurify	3.12.0 → 3.18.0
joi	17.13.3 → 17.13.4
layerchart (source)	2.0.0-next.62 → 2.0.1
marked (source)	18.0.3 → 18.0.5
orval (source)	7.16.0 → 7.21.0
pnpm (source)	10.15.0 → 10.34.4
pnpm (source)	10.15.0 → 10.34.4
prettier (source)	3.8.3 → 3.9.4
prettier-plugin-svelte	3.5.1 → 3.5.2
qs	6.14.0 → 6.15.3
rehype-github-alerts	4.1.1 → 4.2.0
rehype-pretty-code (source)	0.14.1 → 0.14.4
svelte (source)	5.56.1 → 5.56.4
svelte-check	4.4.8 → 4.7.2
svelte-dnd-action	0.9.69 → 0.9.70
svelte-time (source)	2.1.0 → 2.2.0
sveltekit-superforms (source)	2.30.1 → 2.30.2
tailwind-merge	3.5.0 → 3.6.0
tailwindcss (source)	4.2.4 → 4.3.2
typescript (source)	5.8.3 → 5.9.3
typescript-eslint (source)	8.59.1 → 8.63.0
valibot (source)	1.1.0 → 1.4.2
velite	^0.3.1 → ^0.4.0
vite (source)	8.0.14 → 8.1.3
vitest (source)	4.0.16 → 4.1.10
zod (source)	4.1.12 → 4.4.3

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.3

Compare Source

Patch Changes

• #​10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #​10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #​10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #​10827 098ba41 Thanks @​Aqu1bp! - Fixed #​10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #​10773 3c6513d Thanks @​otkrickey! - Fixed #​10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @&#8203;click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #​10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0]() more accurately.

• #​10865 6450276 Thanks @​ematipico! - Fixed #​10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

• #​10853 93d8e53 Thanks @​Netail! - Fixed #​10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

• #​10820 bba3092 Thanks @​JamBalaya56562! - Fixed #​10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

• #​10835 3447b2f Thanks @​dyc3! - Fixed #​10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

• #​10875 b12e486 Thanks @​dyc3! - Fixed #​10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

• #​10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

• #​10867 a21463e Thanks @​dyc3! - Fixed #​10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

v2.5.2

Compare Source

Patch Changes

• #​10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #​10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #​10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #​10752 f62fb8b Thanks @​ematipico! - Fixed #​10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #​10796 f1b3ab2 Thanks @​ematipico! - Fixed #​10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #​10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  
  // Now also reported, like `as const` (returns `false`):
  function isReady(): boolean {
    return false as false;
  }

• #​10678 8f073a7 Thanks @​PranavAchar01! - Fixed #​7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #​10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

• #​10757 6232fcd Thanks @​PranavAchar01! - Fixed #​8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

  @​utility container {
    @​variant 2xl {
      max-width: 1400px;
    }
  }

• #​10777 575ced6 Thanks @​WaterWhisperer! - Fixed an issue reported in #​10708: the GitLab reporter now handles --verbose diagnostics filtering correctly.

• #​10281 0efe244 Thanks @​Zelys-DFKH! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments.

• #​10758 e36fd8a Thanks @​henrybrewer00-dotcom! - Fixed #​10697: The formatter no longer removes the parentheses around an await or yield expression used as the target of a TypeScript instantiation expression. For example, (await makeFactory)<Value> is no longer reformatted to await makeFactory<Value>, which would change the meaning of the code.

• #​10586 3617094 Thanks @​IxxyDev! - Fixed #​9568: noFloatingPromises no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise.

  function bestEffort(cb: () => Promise<number>): Promise<number>;
  function bestEffort(cb: () => number): number;
  function bestEffort(
    cb: () => number | Promise<number>,
  ): Promise<number> | number {
    return cb() as Promise<number> | number;
  }
  
  // This resolves to the second overload, which returns `number`, so it is no
  // longer flagged as a floating promise.
  bestEffort(() => 42);

• #​10766 7aff4c1 Thanks @​JamBalaya56562! - Fixed #​2862: noInteractiveElementToNoninteractiveRole no longer reports custom elements (a tag name containing a dash, e.g. <my-button role="img" />). Per the W3C HTML-ARIA specification, a custom element may be given any role or none.

• #​10680 771daa4 Thanks @​WaterWhisperer! - Fixed #​10635: Biome now recognizes chained
  table tests such as test.concurrent.each() and it.concurrent.each() as test calls, fixing
  noMisplacedAssertion false positives and improving formatting for those test declarations.

• #​10759 34570b5 Thanks @​henrybrewer00-dotcom! - Fixed #​10636: noStaticElementInteractions no longer reports a false positive for event handlers on Svelte special elements such as <svelte:window>, <svelte:document>, and <svelte:body>. These are not real DOM elements, so they are now ignored by the rule.

• #​10741 bd2364e Thanks @​JamBalaya56562! - Fixed #​6686: the rage command now respects the --config-path option and the BIOME_CONFIG_PATH environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as Not set when no biome.json existed in the working directory.

• #​10763 2c3e82d Thanks @​Aqu1bp! - Fixed #​10742: noSolidDestructuredProps now reports destructured props in Solid function components and JSX children.

• #​10606 a4cc4ab Thanks @​Mokto! - Fixed false positives in noUnusedImports, noUnusedVariables, and useImportType for Svelte components that use both a <script module> and a <script> block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused.

• #​10767 36d5aa7 Thanks @​otkrickey! - Fixed #​10754: useVueValidVBind no longer reports the Vue 3.4+ same-name shorthand as missing a value. :foo and v-bind:foo are now accepted as equivalent to :foo="foo", while v-bind, v-bind:[dynamicArg], and :[dynamicArg] without a value continue to be reported.

• #​10775 a918af0 Thanks @​WaterWhisperer! - Fixed an issue reported in #​10708: biome rage didn't detect running Biome daemon pipes on Windows.

• #​10730 5a2e65b Thanks @​dinocosta! - Fixed an issue where Biome was resolving the well-known Zed settings file from the wrong location on macOS and Windows.

• #​10807 d97fffe Thanks @​ematipico! - Fixed an issue where .scss files were incorrectly analyzed when running biome check.

• [#​10672](https://redirect.github.com/biomejs/biome

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.