🔧 chore(sync): advance main to dev/v1.6 by scttbnsn · Pull Request #596 · CodesWhat/drydock

scttbnsn · 2026-07-24T18:56:18Z

Routine dev → main sync, per the branch model (main only advances by merging from dev/v1.6). This one carries the CI-hardening and bot-config batch:

🔧 chore(ci): block release cuts when main has drifted from the dev branch #590/🔧 chore(ci): point bot PRs and the browser gate at the integration branch #592 drift guard + integration-branch targeting (already on dev, now visible to the bot: Renovate reads renovate.json from the default branch, so baseBranchPatterns and skipInstalls only take effect on main)
🐛 fix(deps): stop Renovate shipping package.json bumps without the lockfile #594 skipInstalls: false + the lockfile-sync guard (runs npm's own ci --dry-run check per workspace)
🔧 chore(repo): untrack the gitignored .planning docs #593 .planning untracked + tracked-ignored-files guard
🔧 chore(i18n): sync translations from Crowdin #545 Crowdin translation sync with all 21 review comments fixed upstream
Five Renovate dependency batches (chore(deps): update npm minor/patch (apps/demo) #484/fix(deps): update npm minor/patch (ui) #485/chore(deps): update npm minor/patch () #487/fix(deps): update npm minor/patch (app) #489/chore(deps): update npm minor/patch (apps/web) #510)
postcss override 8.5.22 (GHSA-r28c-9q8g-f849)

After merge, git diff origin/main origin/dev/v1.6 must be empty (tree equality — the invariant release-cut enforces).

Review-driven corrections to the v1.5.2 docs/api batch (040d490), found by two adversarially-verified review passes. Targets v1.6 (no standalone v1.5.2). - 🐛 fix(api): define NotificationOutboxEntry/NotificationOutboxResult schemas — both were referenced by $ref but never declared, making the assembled OpenAPI document invalid (Swagger UI/Redoc/codegen failed on the unresolved refs) - ✅ test(api): add a recursive guard that fails on ANY dangling #/components/schemas/* $ref, so this class of bug can't regress - 🐛 fix(api): emit the canonical /api/v1 base in every pagination _links (container list, watch, security vulnerabilities, update-operations, audit) to match the migrated spec - 🐛 fix(api): correct registryWebhookSignature headers in the spec — drop x-gitlab-token (never checked), add x-registry-signature + x-harbor-signature (both accepted by the handler) - 🐛 fix(api): revert LogoutResponse.logoutUrl to type:string (the handler omits the field, it never emits null) - 🐛 fix(api): correct the remote-trigger 409 description (rollback-container only), document the outbox GET 500, and the scan-all 400 scanner-not-configured case - ✅ test(api): add spec-structure tests for /api/v1/log/components, /auth/status, /api/v1/app auth posture, RegistryWebhookResponse, and the full /api/v1/webhooks/registry responses - 📝 docs(api): correct the registry webhook header list in api/index.mdx; drop legacy dd.trigger.include from the edited eligibility row; document the now-reachable GET /api/v1/containers/backups in CHANGELOG

- 🐛 fix(ui): cancelUpdateOperation now POSTs /api/v1/operations/:id/cancel (was the deprecated /api/ alias slated for removal in v1.6.0, which would have 404'd) - 🐛 fix(ui): ConfigView webhook panel and copyable curl example show /api/v1/webhook/* to match the published docs

…anches - 📝 docs(readme): point the docs-refresh note and roadmap row at v1.6 (the standalone v1.5.2 lane was dropped — folded into v1.6) - 📝 docs(contributing): add the qlty-smells advisory row and renumber the pre-push pipeline table to match lefthook.yml - ✅ test(web): cover the docs-link-rewriter bare /docs/assets and single-quoted-attribute branches

- suppressHydrationWarning on the 7 homepage .reveal wrappers (the pre-hydration reveal bootstrap mutates them, causing a hydration mismatch) - og:image + twitter:image on /compare, /compare/[slug], and the Trivy security advisory (page-level openGraph was replacing the layout's and dropping the share image) - dockge compare: i18n row reflects shipped 17-locale support (was stale 'Planned'/competitor; both ship i18n now → tie)

- discord-icon.tsx: official Discord mark, mirrors github-icon API - site-config: discordUrl invite - footer: Discord social link between GitHub and Docs - README: Community section pointing to Discord + GitHub Issues

First commit of #242 table unification. Adds an isMobile prop (default false, non-regressive): the first non-icon column pins sticky-left during horizontal scroll, interactive rows are floored at a 44px touch target, and the 8px resize handle is hidden on touch. 3769 ui tests green at 100% coverage. Refs: #242

Removes the DataCardGrid/DataListAccordion render branches and the view-mode switcher binding from the 5 simple data views; DataTable now renders unconditionally. Also drops AuditView's ?view= URL-query mode mechanism (now a no-op). useViewMode/DataCardGrid/DataListAccordion source files are deleted in a later commit. 3763 ui tests green at 100% coverage, typecheck clean. Refs: #242

Removes the card/list render branches and view-mode switcher from the 4 remaining non-container views. AgentsView drops its non-table EmptyState (DataTable empty slot covers it); SecurityView keeps its breakpoint-driven isCompact column swap; TriggersView's inline test button moves into the DataTable actions column. 3763 ui tests green at 100% coverage, typecheck clean. Refs: #242

Removes the ~427-line DataCardGrid/DataListAccordion render block and the containerViewMode switcher from ContainersGroupedViews/ContainersView/ContainersListContent; the column picker is now always shown, and the template-context type + its typecheck guard drop containerViewMode. Dead helpers (getContainerViewMemo, getGroupByKey) removed. 3747 ui tests green at 100% coverage, tsc clean. Refs: #242

Removes DataCardGrid.vue and DataListAccordion.vue (now-unused card/list surfaces) plus useViewMode.ts and auditViewMode.ts, each with its spec. Cleans up the main.ts global registrations, the preferences index export, the ComponentImports/main registration assertions, the data-view stubs, and rewrites the lifecycle spec off useViewMode. 3674 ui tests green at 100% coverage, tsc clean. Refs: #242

The table/cards/list switcher is dead now that every view is table-only. Removes the modelValue/viewModes props, the update:modelValue emit, defaultViewModes, viewModeName/viewModeLabel, and the switcher button group; keeps the count display, filter toggle, badge, slots, and filter panel. Test stubs simplified to match. 3669 ui tests green at 100% coverage, tsc clean. Refs: #242

Every view is table-only now, so viewMode/mode are dead. Bumps CURRENT_SCHEMA_VERSION 7->8, removes containers.viewMode and views.*.mode from the schema and DEFAULTS (security/agents keep their sort fields; the mode-only views collapse to empty stubs), and strips the dead migration branches (SIMPLE_VIEW_MODE_KEYS, migrateSimpleViewModePreferences, migrateAuditViewPreference, the mode logic in migrateSortableViewPreference/migrateContainersPreference/sanitizeContainers). Legacy dd-*-view-v1 keys stay in LEGACY_KEYS so they're still cleaned up, just not migrated. mergeDefaults drops any persisted mode field, so no explicit v7->v8 transform is needed. 3657 ui tests green at 100% coverage, tsc clean. Refs: #242

After schema v8 dropped every view-mode field, the ViewMode type, VIEW_MODES set, and isViewMode guard have zero consumers. Removes them from schema.ts/validators.ts and the preferences index re-export, with their validators.spec/index.spec tests. 3651 ui tests green at 100% coverage, tsc clean. Refs: #242

The v1.5.1 brand refresh (#439) moved the website to the cropped whale "headshot" icon but left the app UI on the old full-body whale. Ship the same icon set in ui/ so the product matches getdrydock.com. - Replace ui/public favicon.ico, favicon-96x96.png, apple-touch-icon.png and both web-app-manifest PNGs with the website's headshot assets - Remove the stale favicon.svg (browsers preferred it over the PNGs, so it kept rendering the old mark) and its <link>; the website ships no SVG - Add a ?v=2 cache-buster to the icon links so existing installs re-fetch instead of serving the aggressively cached old favicon - Match the website manifest's "any maskable" PWA icon purpose Ref: #439

…ast (#466) The SPA history-mode fallback returned index.html for every unmatched path, including a request for a content-hashed /assets/*.js bundle that a prior build referenced but the upgrade deleted. Browsers won't execute a module script served as text/html, so a page cached from the old build (often by a reverse proxy that ignores the HTML's Cache-Control: no-store) white-screened, and caching proxies could poison the asset URL with HTML. - 🐛 fix(api): return a clean 404 (no-store) for /assets/* misses in the UI catch-all instead of the SPA shell (app/api/ui.ts) - ✅ test(api): cover the 404 branch + the index.html fallback branch (app/api/ui.test.ts — 100% coverage on ui.ts) - 📝 docs(server): add a "Reverse proxy caching (blank page after an update)" section with browser/proxy cache guidance + per-proxy notes Doesn't self-heal an already-blank page (clearing the browser/proxy cache is still the fix for that), but stops drydock turning a missing bundle into a silent white screen. Ref: #466

C8-fix for #242 responsive DataTable — corrects the a11y/touch defects shipped in 4b11bd8: - logical inset props (start-0/end-0) so the sticky identity + actions columns render correctly in RTL (ar) - z-stack fix: header sticky cell z-20 out-stacks body sticky cell z-10 - 48px min touch row height (Material 3), overscroll-x-contain (Safari back-nav), scope=col on all header cells - new per-theme --dd-sticky-separator token (>=3:1, WCAG 1.4.11) replacing the sub-threshold grey box-shadow; avoids reusing the 1.58:1 --dd-border-strong Follow-up (not in this commit): AppIconButton size=toolbar renders 32px — clears WCAG 2.5.8 min (24px) but under the 44px target.

…ainer width - ✨ feat(ui): card mode renders each row as a stacked card (title from the first non-icon column, priority-or-order subtitle, dt/dd body) reusing the existing cell/actions/full-row slots — no per-view changes needed - ✨ feat(ui): native sort select + direction toggle replace the clickable table header in card mode, emitting the same update:sortKey/update:sortAsc - 🌐 i18n(ui): add sharedComponents.dataTable.sortBy + sort direction labels - ✅ test(ui): 41 new card-mode specs (breakpoint boundaries, slot reuse, sort control edge cases, virtual-scroll spacers, 44px touch targets, logical-properties-only RTL guard) Card mode triggers on DataTable's own container width (ResizeObserver), deliberately separate from the 768px window-based isMobile prop. Refs: #242

- ✨ feat(ui): first @media print rules in the app — cards keep break-inside: avoid so a card never splits across pages, the card-mode sort chrome (select + direction toggle) is hidden on paper, and the table's horizontal scroll container becomes overflow: visible so off-screen columns print instead of being clipped - ✅ test(ui): source-assertion specs for the print block (house pattern from the column-sizing standard) + DOM assertions for the two new hook classes (dd-data-table-scroll, dd-data-table-card-sort-bar) Refs: #242

… composition - ✨ feat(ui): new DataTableColumn fields — cardTitle forces a column to be the card title (table mode unaffected); cardPriority drives subtitle promotion (highest positive wins, ties by declared order) and body demotion (negative = out of the card; data stays reachable via the DetailPanel). Deliberately distinct from the auto-hide priority field, whose semantics run the opposite direction (higher = dropped first) — Containers pipes those values through, so reusing them would have promoted registry/uptime as the subtitle - 🐛 fix(ui): NotificationsView card title was the bare enabled ToggleSwitch (first non-icon column) — name is now flagged cardTitle, triggers is the subtitle - 🐛 fix(ui): AuditView card title was the raw timestamp — containerName is now the title, action the subtitle - ✨ feat(ui): density annotations — Containers subtitle = update kind with server/registry/uptime demoted; Watchers demotes cron; Agents subtitle = status with docker/os demoted; Servers subtitle = status; Security wide branch subtitle = critical - 🐛 fix(ui): Dashboard recent-updates widget mobile columns had empty labels, rendering blank dt labels in card mode — now reuse the desktop i18n keys - ✅ test(ui): 27 new specs across DataTable, useColumnVisibility, and eight view suites, incl. regression proof that the auto-hide priority field no longer influences card composition Refs: #242

- ✨ feat(ui): new useFocusTrap composable — saves the previously focused element on activation, focuses the container (tabindex=-1), cycles Tab/Shift+Tab within focusable descendants, and restores focus on deactivation or scope disposal when the saved element is still connected. Built on a post-flush watchEffect because watch with immediate+post still runs its first call synchronously at setup, before template refs bind - ✨ feat(ui): DetailPanel activates the trap only when open on mobile — the desktop panel is a non-modal sticky sidebar that stays open across row clicks, so trapping or moving focus there would break keyboard row-browsing (matches the existing conditional aria-modal) - 🐛 fix(ui): mobile panel offset used physical right-0 — now logical end-0 so the overlay anchors correctly in RTL locales - ✅ test(ui): 15 composable specs (activation, restore, disconnected restore target, wrap both directions, no-focusables, disposal) + 6 DetailPanel specs incl. desktop must-not-steal-focus guards Refs: #242

…only User column pickers hide columns from the table, but card mode (<640px container) deliberately ignores the hidden set — mobile has no picker to un-hide a column, so every non-demoted column must stay reachable there. - ✨ feat(ui): hiddenColumnKeys prop filters the table pipeline at normalizedColumns, so flex width redistribution excludes hidden columns and the template loops need no changes; full-width/spacer colspans follow the filtered count - ✨ feat(ui): card computeds now read an unfiltered normalized set (cardResolvedColumns) with a card-side first-non-icon fallback, so the card title stays stable even when its column is table-hidden - ✅ test(ui): 10 specs — th/td/colgroup omission, width redistribution, sticky-column reflow when the first non-icon column is hidden, colspan shrink, card-mode precedence (hidden column reappears in cards), and composition with cardPriority demotion (each mechanism in its own mode) Refs: #242

…ble, picker) - ✨ feat(ui): defaulted views.{security,watchers,servers,audit,agents} .hiddenColumns preference fields — persisted as the HIDDEN set (not the visible set, unlike Containers) so columns added in future releases stay visible for existing users; no schema version bump needed, mergeDefaults backfills; sanitizeViews clamps garbage, unknown keys, and required keys - ✨ feat(ui): useViewColumnVisibility composable — per-call state seeded from preferences with deep-watch write-back, required-column toggle no-op, hiddenCount scoped to the current column set, reset - ✨ feat(ui): shared DataTableColumnPicker component modeled on the Containers picker (config icon trigger + hidden-count badge, teleported flip-aware popover, Escape/outside-click close), hidden below 640px — no picker on mobile since card mode ignores hiding; required rows never emit toggle - 🌐 i18n(ui): sharedComponents.columnPicker keys (tooltip, heading, reset, badge tooltip) - ✅ test(ui): 41 specs across sanitize clamps, composable persistence, and picker interaction; preferences .ts files stay gate-enforced at 100% Refs: #242

…and Audit - ✨ feat(ui): each view marks its identity column required, derives pickerColumns from tableColumns, persists hiding via useViewColumnVisibility, and renders DataTableColumnPicker in the filter bar's extra-buttons slot - ♻️ refactor(ui): SecurityView's compact (<1024px window) branch no longer swaps to a two-column set — tableColumns always returns all 7 and the severity columns are force-hidden via the hiddenColumnKeys union instead, so card mode finally sees the full set (critical subtitle annotation engages on mobile); the picker hides in compact so users can't toggle columns the override would re-hide - 🐛 fix(ui): SecurityView spec mocked useBreakpoints with plain objects instead of refs, so template auto-unwrap never applied and every isCompact v-if was constantly truthy in tests — dormant infra bug, now real refs - ✅ test(ui): sync guards pinning each view's column keys to VIEW_TABLE_COLUMN_KEYS, picker render/toggle/persistence per view, Security compact-union and picker-absence cases Refs: #242

… path - ♻️ refactor(ui): delete the bespoke picker (in-memory visible-set ref, non-teleported popover, hand-rolled positioning) in favor of DataTableColumnPicker + useViewColumnVisibility - ✨ feat(ui): picker choices now persist to preferences.views.agents.hiddenColumns — the bespoke picker had no persistence and reset on every reload - ♻️ refactor(ui): the compact (<1024px window) collapse to required columns now flows through the hiddenColumnKeys union instead of pre-filtering, so card mode sees the full 7-column set; the in-name compact badge row is unchanged - 🗑️ remove(ui): dead agentsView.list.toggleColumns/columnPickerHeading keys across all 17 locales (key-parity gate forbids orphans) - ✅ test(ui): sync guard, required flag, persistence, compact union/picker-absence, badge-row cases; useBreakpoints mock switched to real refs (same dormant auto-unwrap bug class as SecurityView.spec) Refs: #242

Containers pre-filtered its columns before DataTable saw them, so picker-hidden and width-auto-hidden columns vanished from mobile cards — where no picker exists to bring them back. - 🐛 fix(ui): tableColumns now maps the full column catalog and hiding flows through DataTable's hiddenColumnKeys prop (picker-hidden ∪ width-auto-hidden), which card mode ignores by design; the uptime ticker stays gated on picker-visibility so opt-out users pay no cost - ♻️ refactor(ui): ContainersListContent adopts the shared DataTableColumnPicker; bespoke popover, showColumnPicker plumbing, and global click/scroll handlers deleted; new resetColumns restores the shipped default set (opt-in uptime stays hidden) - 🗑️ remove(ui): activeColumns (zero consumers) and the +N auto-hidden badge (picker-hidden count is the actionable signal); dead containerComponents.listContent picker keys purged from all 17 locales - ✅ test(ui): hiddenColumnKeys cases (picker-only, auto-only, union, opt-in column), reset, wiring assertions across five containers specs Refs: #242

- 🗑️ remove(ui): dataFilterBar.viewMode/viewModeLabel/viewModes.* (the switcher died in a76780f) and dataCardGrid/dataListAccordion keys (components died in d3329a0) from sharedComponents - 🗑️ remove(ui): dead per-view card/list label sets (audit, security, registries, servers, triggers, watchers, agents) — every removal backed by a zero-consumer grep incl. template-literal t() sweeps - 🌐 i18n(ui): securityView.card.total kept (live in SecurityDetailPanel); all 17 locales updated in lockstep, -884 lines Refs: #242

…ph, one-clock maturity panel (#566) ## What The display-honesty batch: renames and removes the update-status vocabulary that #498 and #556 reported as unreadable, based on a peer-tool UX research pass (WUD, Diun, Watchtower, Cup, Dockge, Arcane, Portainer, Komodo, Home Assistant, Renovate/Dependabot) and an owner-approved design. - **"Digest" → "Digest update"** in the Update column (Cup's web-UI string, Arcane's popover title). A digest-only change now reads as what it is: an update. - **NEW/MATURE badges removed.** The freshness fact moves into the update-kind badge's tooltip ("Detected 3 days ago"). Idle state gets no chrome; `UpdateMaturityBadge.vue` deleted. - **"Pinned" leaves the Update column.** It was an update status pretending to be a tag property (only rendered when a newer family version existed — the exact inconsistency reported in #498). Pinned-ness is now a persistent pin glyph on the Tag cell (existing `pin` icon-map entry, not the padlock — that's a live action affordance), with a tooltip carrying the `dd.tag.family=loose` remedy. Up-to-date pinned rows read "Current" like everything else. - **Maturity panel keeps exactly one clock.** The policy sentence names the clock the gate actually measures against ("Candidate published {date} — {n} more days until the {minDays}-day minimum", detection-date fallback), and the duplicated countdown collapses to "{countdown} · unlocks {date}". - **Backend rider:** `resolveMaturityClock()` in `app/model/maturity-policy.ts` (behavior-preserving refactor of `getMaturityStartMs`) now exposes `clockSource`/`clockStartAt` as additive optional fields on the maturity blocker's `details`, and both UI call sites (`container-mapper.ts`, `useContainerPolicy.ts`) consume the backend verdict instead of re-deriving maturity-blocked from `updateDetectedAt` alone — three drifting formulas become one. - **Column picker honesty:** breakpoint-auto-hidden columns stay checked but get a muted "{column} — hidden to fit" annotation, and the "+1" toolbar badge tooltip names the hidden columns instead of a bare count. - **Unknown-kind badge:** the silent unknown-update-kind fallback now renders a neutral "Unknown" badge. - **Bouncer "Blocked" → "Security hold"** (display string only; the maturity/hard-block wording is untouched). i18n: net 12 keys added / 7 removed / 12 values changed, English catalogs only per convention, plus stale values for the *repurposed* keys dropped from all 16 non-English locales so they fall back to English until Crowdin retranslates (otherwise German would render the old badge text "NEU" as a tooltip). ## Why Direct follow-up to the rc.2 field feedback in #498 (Cesc1986) and the #556 display cluster. Design researched and approved before implementation; targets v1.6.1/rc.3 — nothing here touches the rc.2 soak. ## Tests TDD gates green in full: app 100/100/100/100 (12,244 tests), ui 100/100/100/100 (4,236 tests). New coverage for the clock resolution (source precedence + tie-breaks), blocker serialization, pin glyph, unknown-kind fallback, column-picker annotation branches, collapsed countdown, and both `useContainerPolicy` paths (backend-verdict preferred, legacy fallback). ## Notes for review - `dashboard-container-metrics.ts` kept its `freshUpdates` KPI via a local `isFreshUpdate()` helper (same 7-day threshold) after the badge helper's deletion — dashboard behavior unchanged. - The owner does a rendered visual pass in the QA environment before this merges.  ## Changelog - ✨ Added backend-resolved maturity clocks with source/start metadata and defensive eligibility parsing. - ✨ Added shared update-kind labeling with localized `Unknown` fallback. - ✨ Added pin-gate policy detection and `tagPinGated` propagation from backend to UI. - ✨ Added auto-hidden column annotations and accurate picker badge/tooltips. - 🔧 Changed update terminology: “Digest update” and “Security hold”. - 🔧 Consolidated maturity countdowns into update-kind/status tooltips and insight notes. - 🔧 Moved pinned status to persistent pin glyphs in version/tag cells. - 🔧 Preserved dashboard fresh-update KPI behavior with an independent seven-day threshold. - 🔧 Improved tooltip fallback synchronization and registry search by dotted instance ID. - 🔧 Updated pluralized legacy-configuration banner translations. - 🗑️ Removed `UpdateMaturityBadge`, `getUpdateMaturity`, separate NEW/MATURE badges, and the dedicated pinned update-status state. - 🗑️ Removed stale localized `blockedByBouncer`, `updateAge`, maturity-badge, and pinned-summary values. - ⚠️ Updated the `Container` contract: removed `updateMaturity`; added `updateMaturityTooltip`, `updatePolicyState`, and `tagPinGated`. ## Concerns - Verify backend `updateEligibility` payloads expose sufficiently reliable maturity clock metadata. - Confirm Crowdin retranslation coverage for removed and repurposed locale keys. - Audit downstream consumers for the removed `getUpdateMaturity`, `updateMaturity`, and `pinned` APIs.

Release plumbing for the v1.6.0-rc.3 cut — the full identity bump the guard tests enforce. - Dated `[1.6.0-rc.3] — 2026-07-21` CHANGELOG heading, fresh empty `[Unreleased]` section, matching link-reference definitions - rc.3 across README badge/highlights summary, website site-config + timeline, updates page (new rc.3 highlights section), API doc example payloads, quickstart tag matrix, and the demo runtime fixtures - Guard tests updated in lockstep: release-identity, release-docs-identity (compare base now `v1.6.0-rc.2...v1.6.0-rc.3`), changelog-links rc.3 delta over rc.2: #566 display-honesty batch, #567 security hardening, #568 maturity-clock restart fix (#565), #569 docs freshness. Verified: 105/105 script tests, 43/43 web-script tests, full pre-push gate green. Last dev-side change before the release head freeze.  ## Changelog 🔧 **Changed** - Updated release identity from `v1.6.0-rc.2` to `v1.6.0-rc.3` across README, website metadata, roadmap, docs, API examples, quickstart tags, and demo fixtures. - Added the dated `v1.6.0-rc.3` updates section and refreshed changelog link references. - Updated release identity and documentation guard tests, including rc comparison ranges and candidate fixtures. ✨ **Added** - Documented the rc.3 changes covering issues `#566`, `#567`, `#568/`#565, and `#569`. 🔒 **Security** - Documented the rc.3 security hardening batch. ## Verification - Script tests: 105/105 passed - Web-script tests: 43/43 passed - Full pre-push gate: passed ## Concerns - Verify the release date `July 21, 2026` is correct. - Confirm all remaining `1.6.0-rc.2` references are intentional.

Merge origin/main (#560 /store persistence quickstart, #561 rc.2-audit copy freshness + SRI guard hardening, #562 README translations) into the rc.3 release head. Identity conflicts resolved to the rc.3 side with main's copy/badge deltas re-applied (150K pulls, 20 providers, Node 24.7+, Biome 2.5, unified-clock roadmap row). Guard tests 105/105 + 44/44.

Closes every repository-actionable finding from the comprehensive v1.6 review, incorporates the superseded E2E correction from #573, and includes all follow-up review fixes and evidence hardening.

## Summary - replace two secret-like bearer-token fixtures with low-entropy test values - preserve the strict cache-expiry boundary assertions - restore the tracked-working-tree Gitleaks gate after earlier tests shifted the allowlisted source lines ## Verification - `node ./node_modules/vitest/vitest.mjs run registries/BaseRegistry.test.ts --maxWorkers=1 --fileParallelism=false` (221 passed) - `./scripts/scan-secrets.sh` (history and tracked tree clean) - full pre-push gate (100% app/UI coverage, app/UI builds, scripts, workflows, typecheck, Zizmor)

Settles the main↔dev/v1.6 divergence. main carried the rc.3/rc.4/rc.5 cuts plus #579/#580/#581/#583/#586, while dev/v1.6 was left holding superseded #566-era UI. Verified lossless before merging — main is a strict superset of dev/v1.6: - Three-way merge-base analysis over all 112 differing paths found 0 files where dev/v1.6 advanced and main did not. - All 14 dev-side rc.3 CHANGELOG bullets are already present on main under the identical [1.6.0-rc.3] heading. - e2e/features/step_definitions/ui.js exists only on dev because #581 deleted it deliberately during the Cucumber hardening. - The 16 non-English dashboardView.updateKind.digest keys were removed deliberately by #580 alongside the EN "Digest" → "Image update" rename, so the runtime falls back to the current wording until Crowdin re-translates. Carrying dev's pre-rename values forward would have undone that fix. - The remaining conflicts were stale rc.3 version strings and the #566 update-status vocabulary that #580 superseded. Every conflict resolved to main. The resulting tree is byte-identical to origin/main (tree 6dd9fc1).

Rescued from the `fix/playwright-qa-readiness` worktree during the main↔dev reconciliation audit — this commit had reached neither branch and would have been lost when that worktree was cleaned up. It's the root-cause fix for the Playwright flake that burned an rc.5 cut cycle (`apiRequestContext.post: Timeout 45000ms` on the notification-bell spec, plus the intermittent "Start drydock" Cucumber failures). ## What it does - **`e2e/playwright/auth.setup.ts`** — auth setup now polls `/api/v1/containers` until the *complete* 29-container QA fixture snapshot is present (specific named containers with their `dd.group` labels and a populated `result`) before writing `storageState`. Previously specs could start against a half-populated store, so assertions raced the startup watcher scan. 180s poll budget at 2s intervals, setup timeout raised to 240s. - **`test/qa-compose.yml`** — parks the local and remote watcher crons on `0 0 29 2 *` with `JITTER=0` and `WATCHEVENTS=false`, so no scheduled or event-driven rescan can mutate fixtures mid-suite. The startup scan still runs; only the later races are removed. - **`.github/tests/e2e-playwright-workflow.test.ts`** — coverage asserting the readiness gating stays wired up. ## Verification Full pre-push gate green: clean-tree, ts-nocheck, biome, qlty, qlty-smells, scripts-test, workflow-tests (9 files / 46 tests), typecheck-ui, coverage (app + ui both at 100%), build.  ✨ Added - Playwright fixture-readiness gating for 29 expected QA containers before saving `storageState`. - Workflow test coverage for setup sequencing and readiness configuration. - Documentation of the startup race and cold-stack validation. 🔧 Changed - Increased Playwright setup timeout to 240 seconds with a 180-second readiness polling budget. - Disabled scheduled and event-driven watcher rescans during browser tests while preserving the startup scan. - Added required container, label, result, and update-availability checks. - Readiness validation is tightly coupled to a hardcoded set of 29 containers and labels. - The `0 0 29 2 *` watcher schedule should remain intentional and documented as a disabled schedule.

…anch (#590) v1.6's rc.3–rc.5 fixes landed straight on `main` while `dev/v1.6` sat 112 files behind holding superseded UI, and nothing caught it for weeks. Two gaps made that possible; both are closed here. ## 1. `release-cut.yml` refuses to tag a drifted main New *Assert main is in sync with the active dev branch* step derives `dev/vX.Y` from the release tag and fails the cut when main's tree differs, so a direct-to-main fix can't be tagged without being forward-ported first. - Derives the branch from the tag rather than hardcoding a version (`v1.6.0-rc.6` → `dev/v1.6`, `v1.10.3-rc.1` → `dev/v1.10`). - Skips cleanly when the dev branch is absent — retired after GA, or not yet created. - Runs after `Checkout` and before any tagging or publishing work. **It compares trees, not commit ancestry.** This repo allows squash merges only (`allow_merge_commit: false`, `allow_rebase_merge: false`), so every `dev → main` sync mints a commit `dev` lacks. A `merge-base --is-ancestor` check would fail on every cut after the first and would have to be disabled, defeating the guard. Identical trees is the invariant that actually holds. ## 2. `ci-verify.yml` now gates `dev/**` pull requests The trigger was `pull_request: branches: [main]`, so **PRs into `dev/v1.6` ran no backend or frontend CI at all** — dev was only ever as good as whatever the author ran locally. The integration branch is where features are supposed to land, so it now gets the same gate main gets. ## Verification Full pre-push gate green (284s): clean-tree, ts-nocheck, biome, qlty, qlty-smells, scripts-test, workflow-tests, typecheck-ui, coverage (app + ui at 100%), build, zizmor. New tests cover the failure path, the tree-not-ancestry choice, the post-GA skip, step ordering, and the widened trigger. Guard logic was also exercised against the live repo: tag→branch derivation for 5 tag shapes, `ls-remote` presence/absence, and a real `main` vs `dev/v1.6` comparison (currently in sync, so a cut today passes).  ## Changelog ✨ Added - Added a release guard that blocks tagging and publishing when `main`’s tree differs from the active `dev/vX.Y` branch. - Added coverage for drift detection, retired development branches, tree comparison, ordering, and CI triggers. 🔧 Changed - CI verification now runs for pull requests targeting `main` and `dev/**`. - Confirm the release guard derives the expected development branch correctly from `release_tag`. - Confirm missing development branches intentionally bypass the drift check. - Confirm the guard executes before all tagging and publishing steps.

The switcher read as buried under the logo, title, and tagline. Since the tagline directly above it is English, a non-English reader hit a sentence they may not read before finding their own language. It is now the first thing rendered. Kept inside `<div align="center">` rather than above it, so it stays centered instead of rendering left-aligned over a centered logo. Applied to all seven READMEs (`README.md` + 6 translations) so the copies do not drift — the Spanish one needed a different matcher since Spanish is bold rather than a link there. Pure move: 2 lines changed per file, no content edits. Full pre-push gate green (275s), `release-docs-identity` 11/11.  ### Changelog - 🔧 Changed language switcher placement in all seven README files, moving it above the logo while keeping it within the centered header. - 🗑️ Removed the previous switcher locations without changing content. - ✅ Full pre-push gate passed, including `release-docs-identity` (11/11).

…anch (#592) #590 makes release-cut refuse to tag a drifted `main`. This is the other half: the automation that was creating the drift. Renovate and Crowdin both opened their PRs against `main`. Every one of those merges put work on `main` that `dev/v1.6` never received — 11 such PRs are open right now — so with #590 in place the next cut would fail on drift the bots themselves caused. ## Renovate `baseBranches` now matches `dev/vX.Y` by pattern instead of falling through to the default branch. A pattern rather than a pinned `dev/v1.6` so it follows the branch into `dev/v1.7` without an edit that gets forgotten at the minor bump. Verified the regex accepts `dev/v1.6` and `dev/v1.10` and rejects `main`, `dev/v1.6.1`, and `release/v1.6`. ## Crowdin The action's base branch is a static input, so a hardcoded value would go stale the same way. A new step resolves it at run time: highest `dev/vX.Y` on origin, sorted with `-V` so `dev/v1.10` beats `dev/v1.9` rather than losing a lexical compare. Falls back to the default branch when no dev branch exists — the window between a GA and the next branch being cut — so translations are never stranded with nowhere to land. Needs `fetch-depth: 0`; the default shallow clone has no refs to query. Source upload now also fires on `dev/**`, since that's where the English strings change first. Resolution logic was run against the live repo: it returns `dev/v1.6`. ## Playwright `pull_request` was `[main]` only, so **no PR into `dev/v1.6` has ever run the browser suite.** The first signal was release-cut polling "Wait for successful E2E Playwright on release source SHA", which is a cut cycle burned on something a PR run would have caught. Same widening #590 applied to `ci-verify`. ## Verification Full pre-push gate green (275s): clean-tree, ts-nocheck, biome, qlty, qlty-smells, scripts-test, workflow-tests, typecheck-ui, coverage (app + ui at 100%), build, zizmor. New `integration-branch-targets.test.ts` covers the Renovate pattern against five branch shapes, the Crowdin resolution step and its fallback, the `fetch-depth` requirement, and both widened trigger lists. The 11 open bot PRs get retargeted once this lands.  ✨ Added - Tests covering integration-branch matching, Crowdin fallback behavior, checkout depth, and workflow triggers. 🔧 Changed - Renovate now targets only `dev/vX.Y` branches. - Crowdin dynamically targets the highest matching `dev/vX.Y` branch, falling back to the default branch. - Crowdin uploads now trigger from `main` and `dev/**`. - Playwright and `ci-verify` cover pull requests targeting `main` and `dev/**`. - Crowdin uses full-depth checkout for branch resolution. - Contributor guidance now directs changes and PRs to the active release branch. 🐛 Fixed - Prevented bot- and contributor-created drift on `main` from causing release-cut failures. - Retarget the 11 existing bot PRs to the appropriate integration branch after merge.

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@biomejs/biome](https://biomejs.dev) ([source](https://redirect.github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome)) | [`2.4.16` → `2.5.5`](https://renovatebot.com/diffs/npm/@biomejs%2fbiome/2.4.16/2.5.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@biomejs%2fbiome/2.5.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@biomejs%2fbiome/2.4.16/2.5.5?slim=true) | | [@tailwindcss/postcss](https://tailwindcss.com) ([source](https://redirect.github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss)) | [`4.3.1` → `4.3.3`](https://renovatebot.com/diffs/npm/@tailwindcss%2fpostcss/4.3.1/4.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tailwindcss%2fpostcss/4.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tailwindcss%2fpostcss/4.3.1/4.3.3?slim=true) | | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.9.4` → `25.9.5`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.4/25.9.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/25.9.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/25.9.4/25.9.5?slim=true) | | [fumadocs-core](https://fumadocs.dev) | [`16.10.6` → `16.11.5`](https://renovatebot.com/diffs/npm/fumadocs-core/16.10.6/16.11.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fumadocs-core/16.11.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fumadocs-core/16.10.6/16.11.5?slim=true) | | [fumadocs-mdx](https://fumadocs.dev) | [`15.0.13` → `15.2.0`](https://renovatebot.com/diffs/npm/fumadocs-mdx/15.0.13/15.2.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fumadocs-mdx/15.2.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fumadocs-mdx/15.0.13/15.2.0?slim=true) | | [fumadocs-ui](https://fumadocs.dev) | [`16.10.6` → `16.11.5`](https://renovatebot.com/diffs/npm/fumadocs-ui/16.10.6/16.11.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fumadocs-ui/16.11.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fumadocs-ui/16.10.6/16.11.5?slim=true) | | [lefthook](https://redirect.github.com/evilmartians/lefthook) | [`2.1.9` → `2.1.10`](https://renovatebot.com/diffs/npm/lefthook/2.1.9/2.1.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lefthook/2.1.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lefthook/2.1.9/2.1.10?slim=true) | | [lucide-react](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react)) | [`1.21.0` → `1.25.0`](https://renovatebot.com/diffs/npm/lucide-react/1.21.0/1.25.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lucide-react/1.25.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lucide-react/1.21.0/1.25.0?slim=true) | | [tailwindcss](https://tailwindcss.com) ([source](https://redirect.github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)) | [`4.3.1` → `4.3.3`](https://renovatebot.com/diffs/npm/tailwindcss/4.3.1/4.3.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/tailwindcss/4.3.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tailwindcss/4.3.1/4.3.3?slim=true) | --- ### Release Notes <details> <summary>biomejs/biome (@biomejs/biome)</summary> ### [`v2.5.5`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#255) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.4...@biomejs/biome@2.5.5) ##### Patch Changes - [#10972](https://redirect.github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://redirect.github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/) for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing `2n` case: ```ts declare const value: 1n | 2n; switch (value) { case 1n: break; } ``` - [#10972](https://redirect.github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://redirect.github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed false positives in [`noBaseToString`](https://biomejs.dev/linter/rules/no-base-to-string/) and [`useNullishCoalescing`](https://biomejs.dev/linter/rules/use-nullish-coalescing/) when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved: ```ts type Recursive = Recursive; declare const value: Recursive; String(value); value || "fallback"; ``` - [#10977](https://redirect.github.com/biomejs/biome/pull/10977) [`0bf7486`](https://redirect.github.com/biomejs/biome/commit/0bf748653e488d0b959d39847641438cdb28188b) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10922](https://redirect.github.com/biomejs/biome/issues/10922): the action [`useSortedAttributes`](https://biomejs.dev/assist/actions/use-sorted-attributes/) no longer triggers for HTML instructions. - [#10957](https://redirect.github.com/biomejs/biome/pull/10957) [`cf263c4`](https://redirect.github.com/biomejs/biome/commit/cf263c4700e9f24115e541d1f142934a9b2d878f) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Fixed [`noThenProperty`](https://biomejs.dev/linter/rules/no-then-property/) failing to detect `Object.fromEntries`, `Object.defineProperty`, and `Reflect.defineProperty` calls with comments between their tokens. - [#10983](https://redirect.github.com/biomejs/biome/pull/10983) [`edc0ed7`](https://redirect.github.com/biomejs/biome/commit/edc0ed738ab8da3d512d527196684bd668090854) Thanks [@ayaangazali](https://redirect.github.com/ayaangazali)! - Fixed [#10980](https://redirect.github.com/biomejs/biome/issues/10980): [`useAriaPropsSupportedByRole`](https://biomejs.dev/linter/rules/use-aria-props-supported-by-role/) no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as `<a {href} aria-label="...">` in Astro and Svelte files. Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the `link` role instead of `generic`. - [#10889](https://redirect.github.com/biomejs/biome/pull/10889) [`89526e3`](https://redirect.github.com/biomejs/biome/commit/89526e3858c437408ec9ff192c35a866ad991d1b) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries. ```diff - A:HOVER { COLOR: INITIAL; } + A:hover { color: initial; } - @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } } + @keyframes :GLOBAL KeepFrames { from { color: RED; } } - @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } } + @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } } ``` - [#10964](https://redirect.github.com/biomejs/biome/pull/10964) [`794ccd0`](https://redirect.github.com/biomejs/biome/commit/794ccd0528345c4eaa87af1d86f02475277a0a22) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatting for comments between declaration values and `!important`. ```diff -a { color: /* before */ /* after */ red !important; } +a { color: /* before */ red /* after */ !important; } ``` - [#10993](https://redirect.github.com/biomejs/biome/pull/10993) [`b7a9694`](https://redirect.github.com/biomejs/biome/commit/b7a969425d4292fc7c50440da7aea41ce5c9a9c2) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks. ```diff -.before > /* comment */ .after {} +.before /* comment */ > .after {} ``` It now also keeps selectors with escaped newlines in attribute values inline when they fit. ```diff -div - span[foo="bar\ +div span[foo="bar\ value"] {} ``` - [#10978](https://redirect.github.com/biomejs/biome/pull/10978) [`8ebafe1`](https://redirect.github.com/biomejs/biome/commit/8ebafe1c7489f1f7af379b8e52b8ad063c82d28a) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10870](https://redirect.github.com/biomejs/biome/issues/10870): [`noUnresolvedImports`](https://biomejs.dev/linter/rules/no-unresolved-imports/) no longer reports false positives such as `import type { NextRequest } from "next/server"`. - [#10901](https://redirect.github.com/biomejs/biome/pull/10901) [`68c10e6`](https://redirect.github.com/biomejs/biome/commit/68c10e672fc886b31423b18be01e873d3bf77f43) Thanks [@Socialpranker](https://redirect.github.com/Socialpranker)! - Fixed [#10622](https://redirect.github.com/biomejs/biome/issues/10622): the HTML/Vue parser no longer panics on the argument-less `v-bind` shorthand (`:="props"`). This syntax is valid Vue and equivalent to `v-bind="props"`, so the parser now accepts it (along with the longhand `v-bind:="props"`) instead of crashing while building a diagnostic for a missing argument. - [#10936](https://redirect.github.com/biomejs/biome/pull/10936) [`7df46f5`](https://redirect.github.com/biomejs/biome/commit/7df46f5be0880a02cb37453f01b83c1ba59b1e44) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Improved generic tuple inference for [`useIncludes`](https://biomejs.dev/linter/rules/use-includes/). The rule now recognizes specialised tuple element types returned through generic aliases. - [#10941](https://redirect.github.com/biomejs/biome/pull/10941) [`f787725`](https://redirect.github.com/biomejs/biome/commit/f7877258271e20523d5c673e62912fce1d85cd56) Thanks [@siketyan](https://redirect.github.com/siketyan)! - Fixed [`#10855`](https://redirect.github.com/biomejs/biome/issues/10855): Biome now supports parsing and formatting CSS custom media queries declared with [`@custom-media`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@custom-media). - [#10969](https://redirect.github.com/biomejs/biome/pull/10969) [`72d309b`](https://redirect.github.com/biomejs/biome/commit/72d309b655cee70473e20b061f5a45112139688c) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations. - [`e62f6b6`](https://redirect.github.com/biomejs/biome/commit/e62f6b61461227bbfd57fdf1b50b2dc8c01ea5a0) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10963](https://redirect.github.com/biomejs/biome/issues/10963): Biome no longer panics when a type-aware rule such as [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) checks a call to a function with multiple call signatures imported from another module. - [#10931](https://redirect.github.com/biomejs/biome/pull/10931) [`899c60d`](https://redirect.github.com/biomejs/biome/commit/899c60d506115b3f62030236cbd0901bf294e6ab) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed `check --write` command. Now the command reports code frame of the formatted code, if the formatter is enabled. - [#10904](https://redirect.github.com/biomejs/biome/pull/10904) [`ceee4f4`](https://redirect.github.com/biomejs/biome/commit/ceee4f43dabf88d86b87c9a4ce6051b6738869c2) Thanks [@qzwxsaedc](https://redirect.github.com/qzwxsaedc)! - Fixed [#10892](https://redirect.github.com/biomejs/biome/issues/10892): [`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/) no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged: ```ts import type Types from "./types"; declare function parse(): Types.Result<string>; const result = parse(); if (!result.success) { } ``` - [#10962](https://redirect.github.com/biomejs/biome/pull/10962) [`f0a67f2`](https://redirect.github.com/biomejs/biome/commit/f0a67f2e56c0785595c5cf14a93dba5bb32acf2d) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Biome no longer removes embedded styles and scripts in HTML files. - [#11000](https://redirect.github.com/biomejs/biome/pull/11000) [`5039a1e`](https://redirect.github.com/biomejs/biome/commit/5039a1ee35771d0193de65a6326781313ab77afb) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects. - [#10957](https://redirect.github.com/biomejs/biome/pull/10957) [`cf263c4`](https://redirect.github.com/biomejs/biome/commit/cf263c4700e9f24115e541d1f142934a9b2d878f) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Improved the performance of the [`noThenProperty`](https://biomejs.dev/linter/rules/no-then-property/) lint rule by about 50%. - [#10992](https://redirect.github.com/biomejs/biome/pull/10992) [`4bf9b21`](https://redirect.github.com/biomejs/biome/commit/4bf9b21319df240e2c5ef2e5a9cb2e9582a0e1d1) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/): The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates. For example, the following callback is now reported. ```ts declare function consume(...args: [number, () => void]): void; const prefix: [number] = [1]; consume(...prefix, async () => {}); ``` - [#10915](https://redirect.github.com/biomejs/biome/pull/10915) [`b3b12b3`](https://redirect.github.com/biomejs/biome/commit/b3b12b3fe390feabbd9ba097922d6c7e56823406) Thanks [@Functionhx](https://redirect.github.com/Functionhx)! - Added the rule [`noNegationInEqualityCheck`](https://biomejs.dev/linter/rules/no-negation-in-equality-check/). The rule flags negated expressions on the left side of strict equality checks like `!foo === bar` — due to operator precedence this evaluates as `(!foo) === bar` which is almost always a mistake for `foo !== bar`. The rule provides an unsafe fix that flips the operator. ```js // Invalid !foo === bar; !foo !== bar; // Valid foo !== bar; foo === bar; ``` - [#10970](https://redirect.github.com/biomejs/biome/pull/10970) [`bd1038b`](https://redirect.github.com/biomejs/biome/commit/bd1038be1ad110aae60bcdbe9a154c6a2fc85c14) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Improved overload selection for [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/). Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, `noMisusedPromises` now reports the async callback passed to the synchronous overload: ```ts declare function consume(kind: "async", callback: () => Promise<void>): void; declare function consume(kind: "sync", callback: () => void): void; consume("sync", async () => {}); ``` - [#10933](https://redirect.github.com/biomejs/biome/pull/10933) [`48a4abb`](https://redirect.github.com/biomejs/biome/commit/48a4abb99d41b1241b2a5812a12247b671d0dfed) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/) to recognize bigint zero indexes. - [#10931](https://redirect.github.com/biomejs/biome/pull/10931) [`899c60d`](https://redirect.github.com/biomejs/biome/commit/899c60d506115b3f62030236cbd0901bf294e6ab) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled. - [#10969](https://redirect.github.com/biomejs/biome/pull/10969) [`72d309b`](https://redirect.github.com/biomejs/biome/commit/72d309b655cee70473e20b061f5a45112139688c) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Hardened the Biome Language Server by improving its synchronisation logic. - [#10972](https://redirect.github.com/biomejs/biome/pull/10972) [`ab8c21b`](https://redirect.github.com/biomejs/biome/commit/ab8c21b35e81708276e4283a4a0ff86ea815e345) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed false positives in [`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/) and [`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/) when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, `useAwaitThenable` no longer reports `await value` when the value's thenability is unknown: ```ts declare const value: unknown; async function consume() { await value; } ``` ### [`v2.5.4`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#254) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.3...@biomejs/biome@2.5.4) ##### Patch Changes - [#10665](https://redirect.github.com/biomejs/biome/pull/10665) [`55ff995`](https://redirect.github.com/biomejs/biome/commit/55ff995098148446b7e7fdfc19053902bb987122) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Improved the performance of the HTML parser slightly in our synthetic benchmarks. - [#10894](https://redirect.github.com/biomejs/biome/pull/10894) [`f4fb10e`](https://redirect.github.com/biomejs/biome/commit/f4fb10e176e537e8ce2cac0c3fd4c38a77f91886) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#6392](https://redirect.github.com/biomejs/biome/issues/6392): On-type formatting no longer moves comments before an `if` statement into its body. - [#10939](https://redirect.github.com/biomejs/biome/pull/10939) [`f2799db`](https://redirect.github.com/biomejs/biome/commit/f2799db38e3d8a644207d9b8f957abea6cb3d9fa) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10930](https://redirect.github.com/biomejs/biome/issues/10930): [`noLabelWithoutControl`](https://biomejs.dev/linter/rules/no-label-without-control/) now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content. - [#10945](https://redirect.github.com/biomejs/biome/pull/10945) [`ae15d98`](https://redirect.github.com/biomejs/biome/commit/ae15d98bbf2222fbb34e3e31832cba9676a6d01c) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10942](https://redirect.github.com/biomejs/biome/issues/10942): Svelte directives don't throw an accidental debug log anymore. - [#10842](https://redirect.github.com/biomejs/biome/pull/10842) [`5e1abfe`](https://redirect.github.com/biomejs/biome/commit/5e1abfee59155b5fdca8813314371ed54c06acfb) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#9196](https://redirect.github.com/biomejs/biome/issues/9196): `biome check --write --unsafe` no longer hangs forever when applying the [`noCommentText`](https://biomejs.dev/linter/rules/no-comment-text/) code fix. The rule's fix now wraps the comment in a real JSX expression container (`{/* comment */}`) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule. - [#10891](https://redirect.github.com/biomejs/biome/pull/10891) [`ecca79e`](https://redirect.github.com/biomejs/biome/commit/ecca79e8ff10f40aa676212c0db0a970c6091615) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [`#10885`](https://redirect.github.com/biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change. - [#10886](https://redirect.github.com/biomejs/biome/pull/10886) [`60c8043`](https://redirect.github.com/biomejs/biome/commit/60c8043527f7ccc7b505471e1042f2a4324e4d31) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Fixed [#10727](https://redirect.github.com/biomejs/biome/issues/10727): Biome now breaks the arguments of curried `test.each`, `it.each`, `describe.each`, and `test.for` calls when they exceed the configured line width. ```diff - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => { - expect(a).toBe(b); - }); + test.each([[1, 2]])( + "a description that is long enough to push the hugged opening line beyond the print width", + (a, b) => { + expect(a).toBe(b); + }, + ); ``` - [#10895](https://redirect.github.com/biomejs/biome/pull/10895) [`01a85f0`](https://redirect.github.com/biomejs/biome/commit/01a85f04b09f0af05b16a15c137421e312ceada5) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon. ### [`v2.5.3`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#253) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.2...@biomejs/biome@2.5.3) ##### Patch Changes - [#10815](https://redirect.github.com/biomejs/biome/pull/10815) [`86613d5`](https://redirect.github.com/biomejs/biome/commit/86613d5b01eb965b460ccefbf27f168d87774aaf) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed a parser panic reported in [#10708](https://redirect.github.com/biomejs/biome/issues/10708): Biome now recovers when unsupported CSS Modules `@value` rules or scoped `@keyframes` names end at EOF. - [#10534](https://redirect.github.com/biomejs/biome/pull/10534) [`da9b403`](https://redirect.github.com/biomejs/biome/commit/da9b403b6bbacc8d75d56e327a46f4ed0285913e) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Fixed [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) false positives in Svelte files: Svelte store subscriptions (`$store` references in templates now keep the underlying `store` binding from being flagged), and `$bindable()` props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused. - [#10827](https://redirect.github.com/biomejs/biome/pull/10827) [`098ba41`](https://redirect.github.com/biomejs/biome/commit/098ba41c99e6efaac8eb182eec258a567bb00123) Thanks [@Aqu1bp](https://redirect.github.com/Aqu1bp)! - Fixed [#10698](https://redirect.github.com/biomejs/biome/issues/10698): The [`noUnsafeOptionalChaining`](https://biomejs.dev/linter/rules/no-unsafe-optional-chaining/) rule now reports unsafe optional chains wrapped in TypeScript `as`, `satisfies`, type assertion, and instantiation expressions, such as `new (value?.constructor as Constructor)()`. - [#10773](https://redirect.github.com/biomejs/biome/pull/10773) [`3c6513d`](https://redirect.github.com/biomejs/biome/commit/3c6513d4e9a82a195785144caa9d96093c3861ff) Thanks [@otkrickey](https://redirect.github.com/otkrickey)! - Fixed [#10772](https://redirect.github.com/biomejs/biome/issues/10772): [`useVueValidVOn`](https://biomejs.dev/linter/rules/use-vue-valid-v-on/) no longer reports a missing handler for v-on directives using a verb modifier (`.stop` / `.prevent`) without an expression, e.g. `<div @click.stop></div>`. The rule also accepts the arg-less object syntax `<div v-on="$listeners"></div>` instead of reporting a missing event name. - [#10721](https://redirect.github.com/biomejs/biome/pull/10721) [`d83c66b`](https://redirect.github.com/biomejs/biome/commit/d83c66b39a820703d94100f8a6502cc6dbad26a1) Thanks [@minseong0324](https://redirect.github.com/minseong0324)! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves `Error(...)`, `new Error(...)`, optional `Error#stack`, and calls through indexed function values such as `handlers[0]()` more accurately. - [#10865](https://redirect.github.com/biomejs/biome/pull/10865) [`6450276`](https://redirect.github.com/biomejs/biome/commit/6450276764ee4794a0fcb46c139f95b68d892427) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10845](https://redirect.github.com/biomejs/biome/issues/10845). Biome Language Server no longer goes in deadlock when the scanner is enabled. - [#10853](https://redirect.github.com/biomejs/biome/pull/10853) [`93d8e53`](https://redirect.github.com/biomejs/biome/commit/93d8e5352454bccfbd179db03b3155776599c52c) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10840](https://redirect.github.com/biomejs/biome/issues/10840): Astro shorthand attribute syntax is now correctly being parsed from embedded nodes. - [#10820](https://redirect.github.com/biomejs/biome/pull/10820) [`bba3092`](https://redirect.github.com/biomejs/biome/commit/bba30920715920142e933939f6270feedca933a5) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#10619](https://redirect.github.com/biomejs/biome/issues/10619): [`noProcessEnv`](https://biomejs.dev/linter/rules/no-process-env/) now also reports computed (bracket) member access. Previously only dot access was checked, so `process["env"]` and `env["NODE_ENV"]` (where `env` is imported from `node:process`) were missed. Both static and computed accesses are now reported. - [#10835](https://redirect.github.com/biomejs/biome/pull/10835) [`3447b2f`](https://redirect.github.com/biomejs/biome/commit/3447b2f5a3c430efc8e917514260af5341c5509d) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Fixed [#10824](https://redirect.github.com/biomejs/biome/issues/10824): [`useDomQuerySelector`](https://biomejs.dev/linter/rules/use-dom-query-selector/) now supports an `ignore` option for receiver identifiers that should not be reported. - [#10875](https://redirect.github.com/biomejs/biome/pull/10875) [`b12e486`](https://redirect.github.com/biomejs/biome/commit/b12e486d0f0b80d02d2208e239190f8756d39d48) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Fixed [#10795](https://redirect.github.com/biomejs/biome/issues/10795): `--profile-rules` now reports timings for each plugin separately as `plugin/<pluginName>`, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single `plugin/plugin` entry. - [#10877](https://redirect.github.com/biomejs/biome/pull/10877) [`d6bc447`](https://redirect.github.com/biomejs/biome/commit/d6bc4473a210758ee49f6cad41bc69587a7cf125) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [biome-zed#164](https://redirect.github.com/biomejs/biome-zed/issues/164): Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as `)`, `]`, and `}`. - [#10867](https://redirect.github.com/biomejs/biome/pull/10867) [`a21463e`](https://redirect.github.com/biomejs/biome/commit/a21463e5f616a2db5035b470cd206ac9da4d9423) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Fixed [#10864](https://redirect.github.com/biomejs/biome/issues/10864): Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as `<textarea rows=4></textarea>`. ### [`v2.5.2`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#252) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.1...@biomejs/biome@2.5.2) ##### Patch Changes - [#10595](https://redirect.github.com/biomejs/biome/pull/10595) [`f458028`](https://redirect.github.com/biomejs/biome/commit/f4580289094a8fe5c85252adc3399c060bab811e) Thanks [@pkallos](https://redirect.github.com/pkallos)! - Added the option `ignoreBooleanCoercion` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||` and `||=` used inside a `Boolean()` call, where coalescing on falsy values is intentional. - [#10798](https://redirect.github.com/biomejs/biome/pull/10798) [`4a32b63`](https://redirect.github.com/biomejs/biome/commit/4a32b63eb41f144dc8faf6b5cdb05e1de5dbcb63) Thanks [@pkallos](https://redirect.github.com/pkallos)! - Added the option `ignorePrimitives` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||`, `||=`, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use `true` to ignore all primitives, or an object selecting `string`, `number`, `boolean`, or `bigint`. - [#10545](https://redirect.github.com/biomejs/biome/pull/10545) [`f3d4c00`](https://redirect.github.com/biomejs/biome/commit/f3d4c0082676c5188e9a6aa516318c7e3d59bda6) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Added the new nursery rule [`noSvelteUnnecessaryStateWrap`](https://biomejs.dev/linter/rules/no-svelte-unnecessary-state-wrap/), which reports unnecessary `$state()` wrapping of classes from `svelte/reactivity` that are already reactive. ```svelte <script> import { SvelteMap } from "svelte/reactivity"; const map = $state(new SvelteMap()); // redundant </script> ``` - [#10752](https://redirect.github.com/biomejs/biome/pull/10752) [`f62fb8b`](https://redirect.github.com/biomejs/biome/commit/f62fb8b53092fe85e16f9d4ea0e584fee7031ab5) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10739](https://redirect.github.com/biomejs/biome/issues/10739). Now the rule [`useValidAutocomplete`](https://biomejs.dev/linter/rules/use-valid-autocomplete/) correctly flags the `autoComplete` attribute. - [#10796](https://redirect.github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://redirect.github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10768](https://redirect.github.com/biomejs/biome/issues/10768). Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates. - [#10719](https://redirect.github.com/biomejs/biome/pull/10719) [`aa649b5`](https://redirect.github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://redirect.github.com/minseong0324)! - Fixed [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) false positive on returns that use a widening type assertion: `"a" as string` is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as `false as false`, matching the existing `as const` behavior. ```ts // No longer flagged (returns are `string`): function getValue(b: boolean): string { if (b) return "a" as string; return "b" as string; } // Now also reported, like `as const` (returns `false`): function isReady(): boolean { return false as false; } ``` - [#10678](https://redirect.github.com/biomejs/biome/pull/10678) [`8f073a7`](https://redirect.github.com/biomejs/biome/commit/8f073a7cd72b4cf46c2ebf2bc08f4068fc4b5e34) Thanks [@PranavAchar01](https://redirect.github.com/PranavAchar01)! - Fixed [#7718](https://redirect.github.com/biomejs/biome/issues/7718): Biome now correctly parses CSS nesting selectors when `&` appears as a trailing sub-selector after a type selector, e.g. `h1& { color: red; }`. - [#10756](https://redirect.github.com/biomejs/biome/pull/10756) [`5ec965a`](https://redirect.github.com/biomejs/biome/commit/5ec965a2620dec7cb40aa4946ba1d41408b11fd9) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatter output for selector lists with `allowWrongLineComments` and `//` comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators. ```diff -.powerPathNavigator - .helm - button.pressedButton, // pressed +.powerPathNavigator .helm button.pressedButton, // pressed .powerPathNavigator .helm button:active:not(.disabledButton) { } ``` - [#10757](https://redirect.github.com/biomejs/biome/pull/10757) [`6232fcd`](https://redirect.github.com/biomejs/biome/commit/6232fcdef77471e6a6a74bcc33ff7b2b2a9f85a2) Thanks [@PranavAchar01](https://redirect.github.com/PranavAchar01)! - Fixed [#8269](https://redirect.github.com/biomejs/biome/issues/8269): the CSS parser now accepts Tailwind `@variant` and `@utility` names that start with a digit, such as the `2xl` breakpoint. ```css @utility container { @variant 2xl { max-width: 1400px; } } ``` - [#10777](https://redirect.github.com/biomejs/biome/pull/10777) [`575ced6`](https://redirect.github.com/biomejs/biome/commit/575ced6fd7fe3597fdec36e572763e4a5d590244) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://redirect.github.com/biomejs/biome/issues/10708): the GitLab reporter now handles `--verbose` diagnostics filtering correctly. - [#10281](https://redirect.github.com/biomejs/biome/pull/10281) [`0efe244`](https://redirect.github.com/biomejs/biome/commit/0efe2442e9b81d83f7332fd792ad6096678f8b2c) Thanks [@Zelys-DFKH](https://redirect.github.com/Zelys-DFKH)! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments. - [#10758](https://redirect.github.com/biomejs/biome/pull/10758) [`e36fd8a`](https://redirect.github.com/biomejs/biome/commit/e36fd8a9f1314744276df515a1137f21802d3aa5) Thanks [@henrybrewer00-dotcom](https://redirect.github.com/henrybrewer00-dotcom)! - Fixed [#10697](https://redirect.github.com/biomejs/biome/issues/10697): The formatter no longer removes the parentheses around an `await` or `yield` expression used as the target of a TypeScript instantiation expression. For example, `(await makeFactory)<Value>` is no longer reformatted to `await makeFactory<Value>`, which would change the meaning of the code. - [#10586](https://redirect.github.com/biomejs/biome/pull/10586) [`3617094`](https://redirect.github.com/biomejs/biome/commit/3617094f00e90f7167ff20baf3c12b5014188b35) Thanks [@IxxyDev](https://redirect.github.com/IxxyDev)! - Fixed [#9568](https://redirect.github.com/biomejs/biome/issues/9568): [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise. ```ts function bestEffort(cb: () => Promise<number>): Promise<number>; function bestEffort(cb: () => number): number; function bestEffort( cb: () => number | Promise<number>, ): Promise<number> | number { return cb() as Promise<number> | number; } // This resolves to the second overload, which returns `number`, so it is no // longer flagged as a floating promise. bestEffort(() => 42); ``` - [#10766](https://redirect.github.com/biomejs/biome/pull/10766) [`7aff4c1`](https://redirect.github.com/biomejs/biome/commit/7aff4c11900579a62dc27ef4e02a4c4760fbbff4) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#2862](https://redirect.github.com/biomejs/biome/issues/2862): [`noInteractiveElementToNoninteractiveRole`](https://biomejs.dev/linter/rules/no-interactive-element-to-noninteractive-role/) no longer reports custom elements (a tag name containing a dash, e.g. `<my-button role="img" />`). Per the [W3C HTML-ARIA specification](https://www.w3.org/TR/html-aria/#el-autonomous-custom-element), a custom element may be given any role or none. - [#10680](https://redirect.github.com/biomejs/biome/pull/10680) [`771daa4`](https://redirect.github.com/biomejs/biome/commit/771daa4f7d229a8754f47923f03b899dc0fc5630) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed [#10635](https://redirect.github.com/biomejs/biome/issues/10635): Biome now recognizes chained table tests such as `test.concurrent.each()` and `it.concurrent.each()` as test calls, fixing `noMisplacedAssertion` false positives and improving formatting for those test declarations. - [#10759](https://redirect.github.com/biomejs/biome/pull/10759) [`34570b5`](https://redirect.github.com/biomejs/biome/commit/34570b5b793c44e978b12589dafcfda22dba7df1) Thanks [@henrybrewer00-dotcom](https://redirect.github.com/henrybrewer00-dotcom)! - Fixed [#10636](https://redirect.github.com/biomejs/biome/issues/10636): [noStaticElementInteractions](https://biomejs.dev/linter/rules/no-static-element-interactions/) no longer reports a false positive for event handlers on Svelte special elements such as `<svelte:window>`, `<svelte:document>`, and `<svelte:body>`. These are not real DOM elements, so they are now ignored by the rule. - [#10741](https://redirect.github.com/biomejs/biome/pull/10741) [`bd2364e`](https://redirect.github.com/biomejs/biome/commit/bd2364e3d077e3a77addcab6dbe127db38654e4a) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#6686](https://redirect.github.com/biomejs/biome/issues/6686): the `rage` command now respects the `--config-path` option and the `BIOME_CONFIG_PATH` environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as `Not set` when no `biome.json` existed in the working directory. - [#10763](https://redirect.github.com/biomejs/biome/pull/10763) [`2c3e82d`](https://redirect.github.com/biomejs/biome/commit/2c3e82d0235ad2f8331744aefc708d1b71f7177c) Thanks [@Aqu1bp](https://redirect.github.com/Aqu1bp)! - Fixed [#10742](https://redirect.github.com/biomejs/biome/issues/10742): [`noSolidDestructuredProps`](https://biomejs.dev/linter/rules/no-solid-destructured-props) now reports destructured props in Solid function components and JSX children. - [#10606](https://redirect.github.com/biomejs/biome/pull/10606) [`a4cc4ab`](https://redirect.github.com/biomejs/biome/commit/a4cc4ab0b01a8ef1731d37cb44bccc5522876f2e) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Fixed false positives in `noUnusedImports`, `noUnusedVariables`, and `useImportType` for Svelte components that use both a `<script module>` and a `<script>` block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused. - [#10767](https://redirect.github.com/biomejs/biome/pull/10767) [`36d5aa7`](https://redirect.github.com/biomejs/biome/commit/36d5aa77d751bf33485cd2c92d89e4c5764e1e50) Thanks [@otkrickey](https://redirect.github.com/otkrickey)! - Fixed [#10754](https://redirect.github.com/biomejs/biome/issues/10754): [`useVueValidVBind`](https://biomejs.dev/linter/rules/use-vue-valid-v-bind/) no longer reports the Vue 3.4+ same-name shorthand as missing a value. `:foo` and `v-bind:foo` are now accepted as equivalent to `:foo="foo"`, while `v-bind`, `v-bind:[dynamicArg]`, and `:[dynamicArg]` without a value continue to be reported. - [#10775](https://redirect.github.com/biomejs/biome/pull/10775) [`a918af0`](https://redirect.github.com/biomejs/biome/commit/a918af0ba827a7fd60a12c96b58daebc8af61db2) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://redirect.github.com/biomejs/biome/issues/10708): `biome rage` didn't detect running Biome daemon pipes on Windows. - [#10730](https://redirect.github.com/biomejs/biome/pull/10730) [`5a2e65b`](https://redirect.github.com/biomejs/biome/commit/5a2e65b9929ef0f2294c20e028fd396d760d2b26) Thanks [@dinocosta](https://redirect.github.com/dinocosta)! - Fixed an issue where Biome was resolving [the well-known Zed settings file](https://biomejs.dev/guides/configure-biome/#well-known-files) from the wrong location on macOS and Windows. - [#10807](https://redirect.github.com/biomejs/biome/pull/10807) [`d97fffe`](https://redirect.github.com/biomejs/biome/commit/d97fffe0aba04cddec66943d6bff3e99d440b451) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where `.scss` files were incorrectly analyzed when running `biome check`. - [#10672](https://redirect.github.com/biomejs/biome/pull/10672) [`53c6efc`](https://redirect.github.com/biomejs/biome/commit/53c6efcd3e5e2769bf8edbe14b8c06ee9fda52d2) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed a bug where Biome incorrectly formatted snippets that have parsing errors. - [#10719](https://redirect.github.com/biomejs/biome/pull/10719) [`aa649b5`](https://redirect.github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://redirect.github.com/minseong0324)! - Fixed [`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/) false positive when awaiting a custom thenable that is not the global `Promise`. A value with a callable `then` member is now recognized as awaitable. ```ts interface Thenable<T> { then(onfulfilled: (value: T) => void): void; } declare const t: Thenable<number>; async function f() { await t; } ``` - [#10734](https://redirect.github.com/biomejs/biome/pull/10734) [`4396496`](https://redirect.github.com/biomejs/biome/commit/43964961c88ca0f93ee83d10621844fa2dc7515c) Thanks [@BangDori](https://redirect.github.com/BangDori)! - Fixed [#10708](https://redirect.github.com/biomejs/biome/issues/10708): `biome migrate` now preserves trivia when migrating the deprecated `recommended` option to `preset`. - [#10683](https://redirect.github.com/biomejs/biome/pull/10683) [`ae31a00`](https://redirect.github.com/biomejs/biome/commit/ae31a004a20ed33d6aa35d5ec8bb4c433273a517) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10657](https://redirect.github.com/biomejs/biome/issues/10657) [#10671](https://redirect.github.com/biomejs/biome/issues/10671) [#10661](https://redirect.github.com/biomejs/biome/issues/10661) [#10637](https://redirect.github.com/biomejs/biome/issues/10637) [#10718](https://redirect.github.com/biomejs/biome/issues/10718): HTML rules now correctly handle dynamic attributes. - [#10746](https://redirect.github.com/biomejs/biome/pull/10746) [`54e8239`](https://redirect.github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't correctly detect styles defined inside the Astro directive `is:global`. - [#10770](https://redirect.github.com/biomejs/biome/pull/10770) [`dd1429c`](https://redirect.github.com/biomejs/biome/commit/dd1429c604f58b89524a3f5329e2920d198e8d9f) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Improved the Biome Language Server DX by orchestrating certain operations, so that they won't block the editor during typing. This improvement is more visible in large documents. - [#10473](https://redirect.github.com/biomejs/biome/pull/10473) [`d9b5133`](https://redirect.github.com/biomejs/biome/commit/d9b5133de7e211b22f4531fe220070690a18c8d1) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Improved [`noUnusedImports`](https://biomejs.dev/linter/rules/no-unused-imports/), [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/), [`noUnusedFunctionParameters`](https://biomejs.dev/linter/rules/no-unused-function-parameters/), and [`useImportType`](https://biomejs.dev/linter/rules/use-import-type/) for Svelte, Vue, and Astro files (with `html.experimentalFullSupportEnabled`). Bindings used only in the template — including component tags, attribute interpolations, directives, `bind:` shorthand, and snippet parameters — are no longer reported as unused, while genuinely unused ones still are. - [#10796](https://redirect.github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://redirect.github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where the Biome Language Server didn't enable project or type-aware lint rules, even when they were explicitly enabled. - [#10746](https://redirect.github.com/biomejs/biome/pull/10746) [`54e8239`](https://redirect.github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't detect styles declared inside HTML documents. - [#10774](https://redirect.github.com/biomejs/biome/pull/10774) [`bde945b`](https://redirect.github.com/biomejs/biome/commit/bde945bee29cb566086828ad788153d9111a125a) Thanks [@pattrickrice](https://redirect.github.com/pattrickrice)! - Fixed [#10268](https://redirect.github.com/biomejs/biome/issues/10268) where a race condition resulted in internal errors such as: `The file biome.json does not exist in the workspace`. ### [`v2.5.1`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#251) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.0...@biomejs/biome@2.5.1) ##### Patch Changes - [#10722](https://redirect.github.com/biomejs/biome/pull/10722) [`f8a303d`](https://redirect.github.com/biomejs/biome/commit/f8a303d08b6b22f56edb8ff5e7caa665532d613a) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatter output for comments between import media queries. ```diff -@import url("print.css") print, -/* comment */ -screen; +@import url("print.css") print, /* comment */ screen; ``` - [#10738](https://redirect.github.com/biomejs/biome/pull/10738) [`9fdc560`](https://redirect.github.com/biomejs/biome/commit/9fdc5600997ef59ca7ed55ac212473de9bdb0b2a) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#9899](https://redirect.github.com/biomejs/biome/issues/9899): the `json` and `json-pretty` reporters now escape backslashes in a diagnostic's `location.path`. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON. ```diff - "path": "src\account\setup-passkey.tsx", + "path": "src\\account\\setup-passkey.tsx", ``` - [#10626](https://redirect.github.com/biomejs/biome/pull/10626) [`5f837df`](https://redirect.github.com/biomejs/biome/commit/5f837df033afc34d43b398aeddc06c1d4fa491d9) Thanks [@tom-groves](https://redirect.github.com/tom-groves)! - Fixed [#10625](https://redirect.github.com/biomejs/biome/issues/10625): `biome migrate` no longer emits an invalid trailing comma when a renamed rule (such as `noConsoleLog` → `noConsole`) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON `biome.json` with a parsing error. - [#10535](https://redirect.github.com/biomejs/biome/pull/10535) [`c245f9d`](https://redirect.github.com/biomejs/biome/commit/c245f9d9e239471d5437cd08f9cfa4601a85abd5) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Fixed a false positive in [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) for Svelte files where variables referenced inside `{@html expr}` blocks were incorrectly reported as unused. - [#10668](https://redirect.github.com/biomejs/biome/pull/10668) [`a0f197e`](https://redirect.github.com/biomejs/biome/commit/a0f197eb1a6974539927f105ff1dde1f51d07d74) Thanks [@Netail](https://redirect.github.com/Netail)! - The `biome init` command has been updated to include a more up-to-date URL to [the first-party extensions page](https://biomejs.dev/editors/first-party-extensions/). - [#10667](https://redirect.github.com/biomejs/biome/pull/10667) [`d8c3e87`](https://redirect.github.com/biomejs/biome/commit/d8c3e878d53515c02bd6c5cb899b2eaec046c542) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10664](https://redirect.github.com/biomejs/biome/issues/10664): [useErrorCause](https://biomejs.dev/linter/rules/use-error-cause/) now correctly detects a shorthand property. - [#10696](https://redirect.github.com/biomejs/biome/pull/10696) [`ef2373f`](https://redirect.github.com/biomejs/biome/commit/ef2373f29be15673705884d345c9af189e30b581) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#9566](https://redirect.github.com/biomejs/biome/issues/9566). Improved how the Biome Language Server loads multiple configuration files inside a workspace. - [#10705](https://redirect.github.com/biomejs/biome/pull/10705) [`4ccb410`](https://redirect.github.com/biomejs/biome/commit/4ccb410dc00a6fb243934dad2e8681a9d5d9529e) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10652](https://redirect.github.com/biomejs/biome/issues/10652). Biome plugins are now properly filtered when using `--only` and `--skip` flags. - [#10669](https://redirect.github.com/biomejs/biome/pull/10669) [`aa0a6eb`](https://redirect.github.com/biomejs/biome/commit/aa0a6eb8007493961cd578f04201248c15fd809a) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10651](https://redirect.github.com/biomejs/biome/issues/10651): [useInlineScriptId](https://biomejs.dev/linter/rules/use-inline-script-id/) now correctly trims trivia to detect if an id attribute has been set. - [#10689](https://redirect.github.com/biomejs/biome/pull/10689) [`844b1be`](https://redirect.github.com/biomejs/biome/commit/844b1be60ded28bf4c650d85806919ceb57bc402) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10658](https://redirect.github.com/biomejs/biome/issues/10658). The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now **disabled by default**. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files. If you relied on this new feature, you must now turn on using the \[editor settings] of the extension e.g. [Zed](https://biomejs.dev/reference/zed/#goto_definition) and [VSCode](https://biomejs.dev/reference/vscode/#biomegotodefinition). - [#10695](https://redirect.github.com/biomejs/biome/pull/10695) [`043fbb5`](https://redirect.github.com/biomejs/biome/commit/043fbb514f1b96c5b723cd86c8db4b9bc9f03631) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10674](https://redirect.github.com/biomejs/biome/issues/10674). Biome now throws an error when the field `level` is missing from a rule option. - [#10712](https://redirect.github.com/biomejs/biome/pull/10712) [`5941df2`](https://redirect.github.com/biomejs/biome/commit/5941df2a0d6904e487e73d4dc7231dcaf7b3a2f0) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Improved the diagnostic and the documentation of [`useFlatMap`](https://biomejs.dev/linter/rules/use-flat-map/). - [#10615](https://redirect.github.com/biomejs/biome/pull/10615) [`23814f1`](https://redirect.github.com/biomejs/biome/commit/23814f1ad8430df906a39323ee31d27d7b9ca17b) Thanks [@qwertycxz](https://redirect.github.com/qwertycxz)! - Improved the DX the JSON schema when it's used by certain code editors like VSCode. - [#10688](https://redirect.github.com/biomejs/biome/pull/10688) [`ec69489`](https://redirect.github.com/biomejs/biome/commit/ec694896a0c75176aca040392e3309df1b2e963d) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning. - [#10701](https://redirect.github.com/biomejs/biome/pull/10701) [`6c2e0d7`](https://redirect.github.com/biomejs/biome/commit/6c2e0d7bba1cbc457a42adf6c982a773bc7e4605) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10694](https://redirect.github.com/biomejs/biome/issues/10694). The Biome Language Server no longer prints an error when the user hovers a variable imported from node\_modules. - [#10681](https://redirect.github.com/biomejs/biome/pull/10681) [`888515b`](https://redirect.github.com/biomejs/biome/commit/888515b088cde688a95680362a619221c023f9d0) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Fixed [`useExportType`](https://biomejs.dev/linter/rules/use-export-type/) that reported useless details in some diagnostics. - [#10220](https://redirect.github.com/biomejs/biome/pull/10220) [`3694a13`](https://redirect.github.com/biomejs/biome/commit/3694a135a9976915889988c36d9eb40d679f06e6) Thanks [@theBGuy](https://redirect.github.com/theBGuy)! - Fixed [`useAnchorContent`](https://biomejs.dev/linter/rules/use-anchor-content/) false positive for `<a>` elements used as render prop values (e.g. `render={<a href="..." />}`), a pattern where the receiving component renders its children inside the anchor element. - [#10702](https://redirect.github.com/biomejs/biome/pull/10702) [`98823fb`](https://redirect.github.com/biomejs/biome/commit/98823fb2e70095b09e1ca4bb9733850bbe8ff33f) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10612](https://redirect.github.com/biomejs/biome/issues/10612). The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore: ```svg <?xml version="1.0" encoding="UTF-8" ?> <svg></svg> ``` ### [`v2.5.0`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#250) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.4.16...@biomejs/biome@2.5.0) ##### Minor Changes - [#9539](https://redirect.github.com/biomejs/biome/pull/9539) [`f0615fd`](https://redirect.github.com/biomejs/biome/commit/f0615fdae80fa7257fc1d0448d2027cb1acff46e) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added a new reporter called `concise`. When `--reporter=concise` is passed the commands `format`, `lint`, `check` and `ci`, the diagnostics are printed in a compact manner: ``` ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused. ! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused. × > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/CodesWhat/drydock).  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: scttbnsn <80784472+scttbnsn@users.noreply.github.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@aws-sdk/client-ecr](https://redirect.github.com/aws/aws-sdk-js-v3/tree/main/clients/client-ecr) ([source](https://redirect.github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-ecr)) | [`3.1079.0` → `3.1091.0`](https://renovatebot.com/diffs/npm/@aws-sdk%2fclient-ecr/3.1079.0/3.1091.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@aws-sdk%2fclient-ecr/3.1091.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@aws-sdk%2fclient-ecr/3.1079.0/3.1091.0?slim=true) | | [@slack/web-api](https://docs.slack.dev/tools/node-slack-sdk/web-api/) ([source](https://redirect.github.com/slackapi/node-slack-sdk)) | [`7.18.0` → `7.19.0`](https://renovatebot.com/diffs/npm/@slack%2fweb-api/7.18.0/7.19.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@slack%2fweb-api/7.19.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@slack%2fweb-api/7.18.0/7.19.0?slim=true) | | [@smithy/node-http-handler](https://redirect.github.com/smithy-lang/smithy-typescript/tree/main/packages/node-http-handler) ([source](https://redirect.github.com/smithy-lang/smithy-typescript/tree/HEAD/packages/node-http-handler)) | [`4.9.3` → `4.9.8`](https://renovatebot.com/diffs/npm/@smithy%2fnode-http-handler/4.9.3/4.9.8) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@smithy%2fnode-http-handler/4.9.8?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@smithy%2fnode-http-handler/4.9.3/4.9.8?slim=true) | | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.9.4` → `25.9.5`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.4/25.9.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/25.9.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/25.9.4/25.9.5?slim=true) | | [@vitest/coverage-v8](https://vitest.dev/guide/coverage) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8)) | [`4.1.9` → `4.1.10`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.9/4.1.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.9/4.1.10?slim=true) | | [cron-parser](https://redirect.github.com/harrisiirak/cron-parser) | [`5.6.1` → `5.6.2`](https://renovatebot.com/diffs/npm/cron-parser/5.6.1/5.6.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/cron-parser/5.6.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/cron-parser/5.6.1/5.6.2?slim=true) | | [express-rate-limit](https://redirect.github.com/express-rate-limit/express-rate-limit) | [`8.5.2` → `8.6.0`](https://renovatebot.com/diffs/npm/express-rate-limit/8.5.2/8.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/express-rate-limit/8.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/express-rate-limit/8.5.2/8.6.0?slim=true) | | [fast-check](https://fast-check.dev/) ([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check)) | [`4.8.0` → `4.9.0`](https://renovatebot.com/diffs/npm/fast-check/4.8.0/4.9.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-check/4.9.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-check/4.8.0/4.9.0?slim=true) | | [helmet](https://helmet.js.org/) ([source](https://redirect.github.com/helmetjs/helmet)) | [`8.2.0` → `8.3.0`](https://renovatebot.com/diffs/npm/helmet/8.2.0/8.3.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/helmet/8.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/helmet/8.2.0/8.3.0?slim=true) | | [knip](https://knip.dev) ([source](https://redirect.github.com/webpro-nl/knip/tree/HEAD/packages/knip)) | [`6.24.0` → `6.27.0`](https://renovatebot.com/diffs/npm/knip/6.24.0/6.27.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/knip/6.27.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/knip/6.24.0/6.27.0?slim=true) | | [mqtt](https://redirect.github.com/mqttjs/MQTT.js) | [`5.15.1` → `5.15.2`](https://renovatebot.com/diffs/npm/mqtt/5.15.1/5.15.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mqtt/5.15.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mqtt/5.15.1/5.15.2?slim=true) | | [node-cron](https://nodecron.com) ([source](https://redirect.github.com/node-cron/node-cron)) | [`4.5.0` → `4.6.0`](https://renovatebot.com/diffs/npm/node-cron/4.5.0/4.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/node-cron/4.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/node-cron/4.5.0/4.6.0?slim=true) | | [p-limit](https://redirect.github.com/sindresorhus/p-limit) | [`7.3.0` → `7.3.1`](https://renovatebot.com/diffs/npm/p-limit/7.3.0/7.3.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/p-limit/7.3.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/p-limit/7.3.0/7.3.1?slim=true) | | [postcss](https://postcss.org/) ([source](https://redirect.github.com/postcss/postcss)) | [`8.5.16` → `8.5.21`](https://renovatebot.com/diffs/npm/postcss/8.5.16/8.5.21) | ![age](https://developer.mend.io/api/mc/badges/age/npm/postcss/8.5.21?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/postcss/8.5.16/8.5.21?slim=true) | | [re2js](https://redirect.github.com/le0pard/re2js) | [`2.8.5` → `2.8.6`](https://renovatebot.com/diffs/npm/re2js/2.8.5/2.8.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/re2js/2.8.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/re2js/2.8.5/2.8.6?slim=true) | | [undici](https://undici.nodejs.org) ([source](https://redirect.github.com/nodejs/undici)) | [`8.6.0` → `8.8.0`](https://renovatebot.com/diffs/npm/undici/8.6.0/8.8.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/undici/8.8.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/undici/8.6.0/8.8.0?slim=true) | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.1.3` → `8.1.5`](https://renovatebot.com/diffs/npm/vite/8.1.3/8.1.5) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.1.5?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.1.3/8.1.5?slim=true) | | [vitest](https://vitest.dev) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.9` → `4.1.10`](https://renovatebot.com/diffs/npm/vitest/4.1.9/4.1.10) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.10?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.9/4.1.10?slim=true) | | [ws](https://redirect.github.com/websockets/ws) | [`8.21.0` → `8.21.1`](https://renovatebot.com/diffs/npm/ws/8.21.0/8.21.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/ws/8.21.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ws/8.21.0/8.21.1?slim=true) | --- ### Release Notes <details> <summary>aws/aws-sdk-js-v3 (@aws-sdk/client-ecr)</summary> ### [`v3.1091.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310910-2026-07-20) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1090.0...v3.1091.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1090.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310900-2026-07-17) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1089.0...v3.1090.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1089.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310890-2026-07-16) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1088.0...v3.1089.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1088.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310880-2026-07-15) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1087.0...v3.1088.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1087.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310870-2026-07-14) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1086.0...v3.1087.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1086.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310860-2026-07-13) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1085.0...v3.1086.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1085.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310850-2026-07-10) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1084.0...v3.1085.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1084.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310840-2026-07-09) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1083.0...v3.1084.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1083.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310830-2026-07-08) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1082.0...v3.1083.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1082.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310820-2026-07-08) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1081.0...v3.1082.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1081.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310810-2026-07-07) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1080.0...v3.1081.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) ### [`v3.1080.0`](https://redirect.github.com/aws/aws-sdk-js-v3/blob/HEAD/clients/client-ecr/CHANGELOG.md#310800-2026-07-06) [Compare Source](https://redirect.github.com/aws/aws-sdk-js-v3/compare/v3.1079.0...v3.1080.0) **Note:** Version bump only for package [@aws-sdk/client-ecr](https://redirect.github.com/aws-sdk/client-ecr) </details> <details> <summary>slackapi/node-slack-sdk (@slack/web-api)</summary> ### [`v7.19.0`](https://redirect.github.com/slackapi/node-slack-sdk/releases/tag/%40slack/web-api%407.19.0) [Compare Source](https://redirect.github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.18.0...@slack/web-api@7.19.0) ##### Minor Changes - [`a795b86`](https://redirect.github.com/slackapi/node-slack-sdk/commit/a795b86): feat: expand app manifest types — add `agent_view` and `assistant_view` features, recent agent events (`app_context_changed`, `assistant_thread_started`, `assistant_thread_context_changed`), optional OAuth scopes (`bot_optional`/`user_optional`), and event `metadata_subscriptions` </details> <details> <summary>smithy-lang/smithy-typescript (@smithy/node-http-handler)</summary> ### [`v4.9.8`](https://redirect.github.com/smithy-lang/smithy-typescript/blob/HEAD/packages/node-http-handler/CHANGELOG.md#498) [Compare Source](https://redirect.github.com/smithy-lang/smithy-typescript/compare/@smithy/node-http-handler@4.9.7...@smithy/node-http-handler@4.9.8) ##### Patch Changes - Updated dependencies \[[`3248fbd`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/3248fbd)] - [@smithy/core](https://redirect.github.com/smithy/core)@3.29.6 ### [`v4.9.7`](https://redirect.github.com/smithy-lang/smithy-typescript/blob/HEAD/packages/node-http-handler/CHANGELOG.md#497) [Compare Source](https://redirect.github.com/smithy-lang/smithy-typescript/compare/@smithy/node-http-handler@4.9.6...@smithy/node-http-handler@4.9.7) ##### Patch Changes - Updated dependencies \[[`b44cb0a`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/b44cb0a)] - [@smithy/core](https://redirect.github.com/smithy/core)@3.29.5 ### [`v4.9.6`](https://redirect.github.com/smithy-lang/smithy-typescript/blob/HEAD/packages/node-http-handler/CHANGELOG.md#496) [Compare Source](https://redirect.github.com/smithy-lang/smithy-typescript/compare/@smithy/node-http-handler@4.9.5...@smithy/node-http-handler@4.9.6) ##### Patch Changes - Updated dependencies \[[`5fca3a0`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/5fca3a0)] - [@smithy/core](https://redirect.github.com/smithy/core)@3.29.4 ### [`v4.9.5`](https://redirect.github.com/smithy-lang/smithy-typescript/blob/HEAD/packages/node-http-handler/CHANGELOG.md#495) [Compare Source](https://redirect.github.com/smithy-lang/smithy-typescript/compare/@smithy/node-http-handler@4.9.4...@smithy/node-http-handler@4.9.5) ##### Patch Changes - Updated dependencies \[[`a97abc3`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/a97abc3)] - [@smithy/types](https://redirect.github.com/smithy/types)@4.16.1 - [@smithy/core](https://redirect.github.com/smithy/core)@3.29.3 ### [`v4.9.4`](https://redirect.github.com/smithy-lang/smithy-typescript/blob/HEAD/packages/node-http-handler/CHANGELOG.md#494) [Compare Source](https://redirect.github.com/smithy-lang/smithy-typescript/compare/@smithy/node-http-handler@4.9.3...@smithy/node-http-handler@4.9.4) ##### Patch Changes - [`273e480`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/273e480): types updates for isolatedModules=true - Updated dependencies \[[`273e480`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/273e480)] - Updated dependencies \[[`74b3d45`](https://redirect.github.com/smithy-lang/smithy-typescript/commit/74b3d45)] - [@smithy/types](https://redirect.github.com/smithy/types)@4.16.0 - [@smithy/core](https://redirect.github.com/smithy/core)@3.29.2 </details> <details> <summary>vitest-dev/vitest (@vitest/coverage-v8)</summary> ### [`v4.1.10`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.10) [Compare Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) ##### 🐞 Bug Fixes - **browser**: Check fs access in builtin commands \[backport to v4] - by [@hi-ogawa](https://redirect.github.com/hi-ogawa), **Hiroshi Ogawa** and **OpenCode (claude-opus-4-8)** in [#10680](https://redirect.github.com/vitest-dev/vitest/issues/10680) [<samp>(5c18d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5c18dd267) - **vm**: Fix external module resolve error with deps optimizer query for encoded URI \[backport to v4] - by [@SveLil](https://redirect.github.com/SveLil) and [@hi-ogawa](https://redirect.github.com/hi-ogawa) in [#10661](https://redirect.github.com/vitest-dev/vitest/issues/10661) [<samp>(bae52)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/bae52b511) ##### [View changes on GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10) </details> <details> <summary>harrisiirak/cron-parser (cron-parser)</summary> ### [`v5.6.2`](https://redirect.github.com/harrisiirak/cron-parser/releases/tag/v5.6.2) [Compare Source](https://redirect.github.com/harrisiirak/cron-parser/compare/v5.6.1...v5.6.2) #### What's Changed - fix: enforce iteration loop limit so unsatisfiable expressions throw instead of returning a bogus date by [@spokodev](https://redirect.github.com/spokodev) in [#415](https://redirect.github.com/harrisiirak/cron-parser/pull/415) - fix: do not drop a matching day of month when the day of week uses an nth (#) occurrence by [@spokodev](https://redirect.github.com/spokodev) in [#414](https://redirect.github.com/harrisiirak/cron-parser/pull/414) **Full Changelog**: <https://github.com/harrisiirak/cron-parser/compare/v5.6.1...v5.6.2> </details> <details> <summary>express-rate-limit/express-rate-limit (express-rate-limit)</summary> ### [`v8.6.0`](https://redirect.github.com/express-rate-limit/express-rate-limit/releases/tag/v8.6.0) [Compare Source](https://redirect.github.com/express-rate-limit/express-rate-limit/compare/v8.5.2...v8.6.0) You can view the changelog [here](https://express-rate-limit.mintlify.app/reference/changelog). </details> <details> <summary>dubzzz/fast-check (fast-check)</summary> ### [`v4.9.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#490) [Compare Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.8.0...v4.9.0) *Shrinkable `entityGraph` and few performance chips* \[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.9.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.8.0...v4.9.0)] #### Features - ([PR#7008](https://redirect.github.com/dubzzz/fast-check/pull/7008)) Towards shrinkable `entityGraph` thanks to `chainUntil` #### Fixes - ([PR#7010](https://redirect.github.com/dubzzz/fast-check/pull/7010)) Bug: Fix latent state-sharing bug in entityGraph - ([PR#7063](https://redirect.github.com/dubzzz/fast-check/pull/7063)) Bug: Equiprobable alternatives in `stringMatching` - ([PR#6973](https://redirect.github.com/dubzzz/fast-check/pull/6973)) CI: Drop caches on push for build package flow - ([PR#6971](https://redirect.github.com/dubzzz/fast-check/pull/6971)) CI: Only mark fast-check's releases as latest - ([PR#6974](https://redirect.github.com/dubzzz/fast-check/pull/6974)) CI: Drop pull\_request\_target flows - ([PR#6975](https://redirect.github.com/dubzzz/fast-check/pull/6975)) CI: Drop discussion creation on release publish - ([PR#6976](https://redirect.github.com/dubzzz/fast-check/pull/6976)) CI: Drop caches from publication steps - ([PR#6977](https://redirect.github.com/dubzzz/fast-check/pull/6977)) CI: Revert "Drop caches from publication steps" - ([PR#6978](https://redirect.github.com/dubzzz/fast-check/pull/6978)) CI: Make zizmor audit a required status check - ([PR#6991](https://redirect.github.com/dubzzz/fast-check/pull/6991)) CI: Remove Claude Code workflow - ([PR#6994](https://redirect.github.com/dubzzz/fast-check/pull/6994)) CI: Replace `pnpm dlx` with `pnpm exec` for `pkg-pr-new` - ([PR#6995](https://redirect.github.com/dubzzz/fast-check/pull/6995)) CI: Inline zizmor ignores in workflow - ([PR#6996](https://redirect.github.com/dubzzz/fast-check/pull/6996)) CI: Move to `devEngines.packageManager` - ([PR#7005](https://redirect.github.com/dubzzz/fast-check/pull/7005)) CI: Update PULL\_REQUEST\_TEMPLATE.md - ([PR#7011](https://redirect.github.com/dubzzz/fast-check/pull/7011)) CI: Drop OTP prompt from npm publish - ([PR#7013](https://redirect.github.com/dubzzz/fast-check/pull/7013)) CI: Switch release jobs to npm stage publish - ([PR#7027](https://redirect.github.com/dubzzz/fast-check/pull/7027)) CI: Run benchmarks against `main` - ([PR#7037](https://redirect.github.com/dubzzz/fast-check/pull/7037)) CI: Use comparison mode for `bench` - ([PR#7069](https://redirect.github.com/dubzzz/fast-check/pull/7069)) CI: Run pnpm dedupe to deduplicate lockfile - ([PR#6959](https://redirect.github.com/dubzzz/fast-check/pull/6959)) CI: Announce releases on Bluesky - ([PR#7105](https://redirect.github.com/dubzzz/fast-check/pull/7105)) CI: Switch to actions/attest for attestations - ([PR#7117](https://redirect.github.com/dubzzz/fast-check/pull/7117)) CI: Use pnpm version in changelog script - ([PR#7120](https://redirect.github.com/dubzzz/fast-check/pull/7120)) CI: Allow unclean tree in changelog generation - ([PR#7125](https://redirect.github.com/dubzzz/fast-check/pull/7125)) CI: Stage publish using `pnpm` in publish jobs - ([PR#7065](https://redirect.github.com/dubzzz/fast-check/pull/7065)) Clean: Delete skills directory - ([PR#6983](https://redirect.github.com/dubzzz/fast-check/pull/6983)) Doc: Tweak PR Template to hint AI agents into revealing themselves - ([PR#7092](https://redirect.github.com/dubzzz/fast-check/pull/7092)) Doc: Add back skills directory - ([PR#7095](https://redirect.github.com/dubzzz/fast-check/pull/7095)) Doc: Add release notes for fast-check 4.8.0 - ([PR#7104](https://redirect.github.com/dubzzz/fast-check/pull/7104)) Doc: Add makeeno as doc contributor - ([PR#7103](https://redirect.github.com/dubzzz/fast-check/pull/7103)) Doc: Fix info box in docs - ([PR#7108](https://redirect.github.com/dubzzz/fast-check/pull/7108)) Doc: Add jneidel as doc contributor - ([PR#7035](https://redirect.github.com/dubzzz/fast-check/pull/7035)) Performance: Faster `fc.integer` on `generate` - ([PR#7046](https://redirect.github.com/dubzzz/fast-check/pull/7046)) Performance: Faster fc.record on generate - ([PR#7047](https://redirect.github.com/dubzzz/fast-check/pull/7047)) Performance: Faster fc.dictionary on generate - ([PR#7048](https://redirect.github.com/dubzzz/fast-check/pull/7048)) Performance: Faster `fc.webPath`/`fc.webUrl` on `generate` - ([PR#7050](https://redirect.github.com/dubzzz/fast-check/pull/7050)) Performance: Faster `fc.stringMatching` for `\W` `\D` `\S` `.` - ([PR#7054](https://redirect.github.com/dubzzz/fast-check/pull/7054)) Performance: Faster `fc.stringMatching` on `generate` - ([PR#7049](https://redirect.github.com/dubzzz/fast-check/pull/7049)) Performance: Drop nested `tuple` on `generate` for `fc.record` - ([PR#7045](https://redirect.github.com/dubzzz/fast-check/pull/7045)) Performance: Faster `fc.entityGraph` on `generate` - ([PR#7071](https://redirect.github.com/dubzzz/fast-check/pull/7071)) Performance: Early exit on empty tuple in `fc.entityGraph` - ([PR#7004](https://redirect.github.com/dubzzz/fast-check/pull/7004)) Refactor: Extract code from `onTheFlyLinksForEntityGraph` - ([PR#7006](https://redirect.github.com/dubzzz/fast-check/pull/7006)) Refactor: Move `generate` logic to the `Arbitrary` for `entityGraph` - ([PR#7007](https://redirect.github.com/dubzzz/fast-check/pull/7007)) Refactor: Introduce `ProductionState` for `onTheFlyLinks...` - ([PR#6990](https://redirect.github.com/dubzzz/fast-check/pull/6990)) Script: Skip scripts during `pnpm i` in changelog generation - ([PR#7039](https://redirect.github.com/dubzzz/fast-check/pull/7039)) Script: More benchmark commands - ([PR#6972](https://redirect.github.com/dubzzz/fast-check/pull/6972)) Security: Pass `--ignore-scripts` to `pnpm i` calls - ([PR#7028](https://redirect.github.com/dubzzz/fast-check/pull/7028)) Test: Add benchmarks for key arbitraries - ([PR#7034](https://redirect.github.com/dubzzz/fast-check/pull/7034)) Test: Expand benchmark coverage across arbitrary families - ([PR#7041](https://redirect.github.com/dubzzz/fast-check/pull/7041)) Test: Add runners related benchs - ([PR#7064](https://redirect.github.com/dubzzz/fast-check/pull/7064)) Test: Clarify arbitrary benchmark names - ([PR#7068](https://redirect.github.com/dubzzz/fast-check/pull/7068)) Test: More reliable arbitraries.bench.ts - ([PR#7088](https://redirect.github.com/dubzzz/fast-check/pull/7088)) Typo: Typo in type `EntityGraphContraints` *** </details> <details> <summary>helmetjs/helmet (helmet)</summary> ### [`v8.3.0`](https://redirect.github.com/helmetjs/helmet/blob/HEAD/CHANGELOG.md#830---2026-07-11) [Compare Source](https://redirect.github.com/helmetjs/helmet/compare/v8.2.0...v8.3.0) ##### Changed - `Content-Security-Policy`: improved performance by \~7% when there are no dynamic directives - `Content-Security-Policy`: improved error handling for invalid directive names ##### Fixed - `Content-Security-Policy`: `useDefaults: false` with no directives is no longer valid, both at runtime and the type level - `Content-Security-Policy`: dynamically-computed directive values would `throw`, not call `next`, when invalid - `Content-Security-Policy`: dynamically-computed directive value entries would `throw`, not call `next`, when function threw </details> <details> <summary>webpro-nl/knip (knip)</summary> ### [`v6.27.0`](https://redirect.github.com/webpro-nl/knip/releases/tag/knip%406.27.0): Release 6.27.0 [Compare Source](https://redirect.github.com/webpro-nl/knip/compare/knip@6.26.0...knip@6.27.0) - Add Temporal plugin ([`98191a0`](https://redirect.github.com/webpro-nl/knip/commit/98191a04aad0572bead191b101bfecef75067b0c)) - Handle -d alias for react-email dir argument ([`53d1fec`](https://redirect.github.com/webpro-nl/knip/commit/53d1fec3213db8d6a84dfa7a82050b122782e065)) - Expand pnpm script references with forwarded arguments ([`33e9799`](https://redirect.github.com/webpro-nl/knip/commit/33e9799df39450033061b9c4c07daf22f5d15721)) - Treat path-shaped script tokens as file references, extend known global binaries ([`d9508c2`](https://redirect.github.com/webpro-nl/knip/commit/d9508c282ab81351beda4b2f859435b49f142c51)) - Mark tsdown neverBundle dependencies as referenced ([`5fd863b`](https://redirect.github.com/webpro-nl/knip/commit/5fd863ba12e68842f91ab1a94e7e30d1e571da92)) - Support TanStack Start in tanstack-router plugin ([`bd63cd8`](https://redirect.github.com/webpro-nl/knip/commit/bd63cd8af88dac03a98aa17f1add322f7bdf4a94)) - Mark vite ssr.external dependencies as referenced ([`91de938`](https://redirect.github.com/webpro-nl/knip/commit/91de938032062cb667bced0eadef9e67d1e20b1f)) - Expand bun, npm, and yarn script references with forwarded arguments ([`b5a3176`](https://redirect.github.com/webpro-nl/knip/commit/b5a31767a83e2cec3fb20c3b146d94c0412a4fd6)) - Add Latitude as sponsor ([`4267675`](https://redirect.github.com/webpro-nl/knip/commit/42676759cad5fb10ac96fd7c0457037e906f4b68)) - Regenerate plugin list in docs ([`1d2cdff`](https://redirect.github.com/webpro-nl/knip/commit/1d2cdffb4d4151f848c44e066eff43e9efbf44fe)) - Support Vue 2 template auto-imports (close [#1881](https://redirect.github.com/webpro-nl/knip/issues/1881)) ([`2157f39`](https://redirect.github.com/webpro-nl/knip/commit/2157f3913f77216d268b2255899b6fc58609f9bb)) - Ignore block-commented stylesheet imports (resolve [#1880](https://redirect.github.com/webpro-nl/knip/issues/1880), close [#1882](https://redirect.github.com/webpro-nl/knip/issues/1882)) ([`a627f53`](https://redirect.github.com/webpro-nl/knip/commit/a627f53221547d5397d70722fcc2fd723889e579)) - Support TypeScript 5.0 narrowing for ssr.external ([`989292f`](https://redirect.github.com/webpro-nl/knip/commit/989292f79b9d19028bfc7ba988b74ba691041a45)) - Resolve local binaries from bun run ([`5e9a7f0`](https://redirect.github.com/webpro-nl/knip/commit/5e9a7f0286e2c2175bb299c514cc7b67a7cf24f1)) - Support Vitest inline project config extensions ([`f682327`](https://redirect.github.com/webpro-nl/knip/commit/f682327f6181f44e3924715efa7404aa39e532f0)) - Resolve package names from aliased node\_modules paths ([`c273d5f`](https://redirect.github.com/webpro-nl/knip/commit/c273d5fbc1b0d3eaf27b38c3f31d3a2a4b6b184a)) - Support Tailwind CSS URL imports ([`57a4770`](https://redirect.github.com/webpro-nl/knip/commit/57a4770447cc4c8f9ea4ffb9171c0c92eed4f255)) - Resolve unbuilt workspace package exports (close [#1877](https://redirect.github.com/webpro-nl/knip/issues/1877)) ([`1b0a2c0`](https://redirect.github.com/webpro-nl/knip/commit/1b0a2c0ee784db165c7f92fe10397a6cb513c1cf)) - Skip unresolved imports of gitignored generated files ([`605c904`](https://redirect.github.com/webpro-nl/knip/commit/605c9049f73838beb1c6fee83c6a5421ae1a6d07)) - Attribute imports of aliased packages to the declared dependency ([`d05e775`](https://redirect.github.com/webpro-nl/knip/commit/d05e775c9a3a5676dc9eadcc1093f7d9983efd06)) - Flag unresolvable imports of transitive peer deps as unlisted (resolve [#1883](https://redirect.github.com/webpro-nl/knip/issues/1883)) ([`18f0bff`](https://redirect.github.com/webpro-nl/knip/commit/18f0bff4ea683837f75ca744d3fbde52df49b297)) - Don't count ambient module declarations in script files as imports ([`e52aecf`](https://redirect.github.com/webpro-nl/knip/commit/e52aecfd7c022cbe72b1c11dde3f4968579ac409)) - Update rolldown snapshot ([`a63e927`](https://redirect.github.com/webpro-nl/knip/commit/a63e92788239062682603a5727ede371db7845c8)) - Remove obsolete workarounds from ecosystem tests ([`a521cf7`](https://redirect.github.com/webpro-nl/knip/commit/a521cf790d726c18e644e2e316cdc09eb654f607)) - Handle snapshotSerializers in Vitest plugin (resolve [#1884](https://redirect.github.com/webpro-nl/knip/issues/1884)) ([`b597de9`](https://redirect.github.com/webpro-nl/knip/commit/b597de951f6f0e897afdbbbb8a7d0c06c8d2437d)) - Set the stage ([`c059c2b`](https://redirect.github.com/webpro-nl/knip/commit/c059c2be5803609924b852c2bf0cd90906a6a831)) ### [`v6.26.0`](https://redirect.github.com/webpro-nl/knip/releases/tag/knip%406.26.0): Release 6.26.0 [Compare Source](https://redirect.github.com/webpro-nl/knip/compare/knip@6.25.0...knip@6.26.0) - ci: add path filters ([#1871](https://redirect.github.com/webpro-nl/knip/issues/1871)) ([`4249935`](https://redirect.github.com/webpro-nl/knip/commit/4249935adffe1b8eca9570fb325fa19cc8010584)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Add CodeRabbit as gold sponsor ([`1da09fd`](https://redirect.github.com/webpro-nl/knip/commit/1da09fdc8f4d851f3cad30659200018bfb47a5e0)) - Fix up docs a bit more ([`39125a7`](https://redirect.github.com/webpro-nl/knip/commit/39125a7f473e006f61629781bff1ac4a050ca460)) - Don't report ambient declaration files as unused ([`aed361c`](https://redirect.github.com/webpro-nl/knip/commit/aed361c00a82829c2fc80a65a2f7af174316782e)) - Register oclif command files as entries ([`3b4d58c`](https://redirect.github.com/webpro-nl/knip/commit/3b4d58c9da83d93b6821a2b24f57b919ba886756)) - Add electron-vite plugin ([`d92107e`](https://redirect.github.com/webpro-nl/knip/commit/d92107ea504833b3ee7ad2b695e22d40528b24c3)) - Add esbuild plugin ([`ef3b601`](https://redirect.github.com/webpro-nl/knip/commit/ef3b601d957546554de2cb1fbff859f5bdafb741)) - Ignore more globally available binaries ([`8292981`](https://redirect.github.com/webpro-nl/knip/commit/829298129fdfd1b41a1f8dff5022b9fbbe25f454)) - Resolve `#`-imports to source when node condition is unbuilt (resolve [#1873](https://redirect.github.com/webpro-nl/knip/issues/1873)) ([`f2713ed`](https://redirect.github.com/webpro-nl/knip/commit/f2713ed1e499ab286b86615d4b8ec34f711d1bd2)) - Ignore gh as a globally available binary ([`a6f0772`](https://redirect.github.com/webpro-nl/knip/commit/a6f0772e5db03a8412a3ac036756779f22d1a27d)) - Resolve Vitest benchmark files as entries ([`5742913`](https://redirect.github.com/webpro-nl/knip/commit/57429139f7e93f2a4bee35a53d450c4f45dea9ff)) - Extract shared Vue auto-import machinery into plugins/\_vue ([`7301075`](https://redirect.github.com/webpro-nl/knip/commit/73010753d432ae58eb12c7eec9c5723036009749)) - Scope compiler extensions per workspace ([`5e6f82b`](https://redirect.github.com/webpro-nl/knip/commit/5e6f82b963a83e5801484efbc01a4b6a9ce39ea3)) - Resolve auto-imported components in the Vue SFC compiler ([`009aad8`](https://redirect.github.com/webpro-nl/knip/commit/009aad8f9dab589898e5dba4c85fa41ea57c1a49)) - Add plugins for the Vue auto-import ecosystem ([`f638c83`](https://redirect.github.com/webpro-nl/knip/commit/f638c8302cdd26a63e477344a7cf44ef60af7788)) - Enable Vue SFC compiler on unplugin-vue and [@vitejs/plugin-vue](https://redirect.github.com/vitejs/plugin-vue) ([`9396ab1`](https://redirect.github.com/webpro-nl/knip/commit/9396ab159919147ef81dad16e365e531b32b4b12)) - Recognize vite-plugin-vue-meta-layouts (same layouts convention) ([`3ceee89`](https://redirect.github.com/webpro-nl/knip/commit/3ceee89228b0173eddc0466bf50e8181286ffebc)) - Add vite-plugin-pages and unplugin-icons plugins ([`9bc1754`](https://redirect.github.com/webpro-nl/knip/commit/9bc17540bcf8eb142474ed84837c1e2cebb7fe73)) - Add vite-plugin-pwa and [@intlify/unplugin-vue-i18n](https://redirect.github.com/intlify/unplugin-vue-i18n) plugins ([`45dea0a`](https://redirect.github.com/webpro-nl/knip/commit/45dea0a397ed754c34617ed18deef4dc6f0ec0d4)) - Dog, food. ([`e1249ad`](https://redirect.github.com/webpro-nl/knip/commit/e1249ade2558d3801d85e2dc63349d884f3443d4)) - Update query snapshot ([`a45941d`](https://redirect.github.com/webpro-nl/knip/commit/a45941d2db381c04f8a38416533217ee84f77ca7)) - Don't misread Nitro route types as Vue component auto-imports ([`43aecd5`](https://redirect.github.com/webpro-nl/knip/commit/43aecd5414eb63bec3637f37ffac0c62a71e7e74)) - Read oxlint jsPlugins from vite-plus vite.config and .oxlintrc.json ([`589ffda`](https://redirect.github.com/webpro-nl/knip/commit/589ffda4e3a7d0c0d772191ad6f8d6e60dd298cf)) - Add vite-plus plugin for run.tasks and staged scripts ([`f041c19`](https://redirect.github.com/webpro-nl/knip/commit/f041c191e4e10dd181ad212b71079e3e10bcf341)) - Support [@vite-pwa/nuxt](https://redirect.github.com/vite-pwa/nuxt) PWA config in nuxt.config ([`8fa7b11`](https://redirect.github.com/webpro-nl/knip/commit/8fa7b116690e37484798ad98eca002d26c0c80fe)) - Add [@vite-pwa/assets-generator](https://redirect.github.com/vite-pwa/assets-generator) plugin ([`4254f7d`](https://redirect.github.com/webpro-nl/knip/commit/4254f7d53a284a4ea4612f650ae03495bcb0d582)) - Add [@nuxtjs/i18n](https://redirect.github.com/nuxtjs/i18n) plugin ([`dfb9acb`](https://redirect.github.com/webpro-nl/knip/commit/dfb9acbe5a08ebc85562f59a04e7f4bedb4925f1)) - Read plugin entries from vite.config options and index.html ([`d533da8`](https://redirect.github.com/webpro-nl/knip/commit/d533da8cc2b431d206eb7c55323ea51846eca0bb)) - Fix false positives in VitePress, next-mdx and unplugin-vue-i18n plugins ([`b99702a`](https://redirect.github.com/webpro-nl/knip/commit/b99702a76e26b1943a16517f1633de3a0713c196)) - Respect optional peers in pnpm and Yarn packageExtensions ([`aab080b`](https://redirect.github.com/webpro-nl/knip/commit/aab080bbd436494316df045011ab22cbebca06b4)) - Detect babel plugins in the Storybook config ([`5dea975`](https://redirect.github.com/webpro-nl/knip/commit/5dea975adf9b88971ad56434132282a099c7d58c)) - Add shared AST helpers for imported calls and first property values ([`c84bb7a`](https://redirect.github.com/webpro-nl/knip/commit/c84bb7a87a17f1921c12bb02bcfd43f905cae595)) - Inline trivial resolveFromAST wrappers and normalize orval and sst ([`620079d`](https://redirect.github.com/webpro-nl/knip/commit/620079d1d07b69a69bbb67b6a6e68963b6c2fc21)) - Extract inline resolveFromAST implementations to dedicated files ([`b5231c1`](https://redirect.github.com/webpro-nl/knip/commit/b5231c12f915428067d790187d2dd4c44e2559d4)) - Normalize resolveFromAST files to a uniform contract ([`fc1ba0f`](https://redirect.github.com/webpro-nl/knip/commit/fc1ba0fb45aaf623de678a57bea3b5567ea04750)) - chore: migrate to Astro 7 and Sätteri ([#1875](https://redirect.github.com/webpro-nl/knip/issues/1875)) ([`f256a5b`](https://redirect.github.com/webpro-nl/knip/commit/f256a5b276c3d69dd5081c591bbb183aacebf766)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Show contributor count on docs homepage ([`6b8454a`](https://redirect.github.com/webpro-nl/knip/commit/6b8454a2841905ce7f08e1a23b54bc17a0854608)) - Exclude gitignored package entry points ([`606e5d0`](https://redirect.github.com/webpro-nl/knip/commit/606e5d051b4f0620c776aa23352153b8253bd75b)) - Add Tauri plugin ([`199180d`](https://redirect.github.com/webpro-nl/knip/commit/199180da79c71acc80865dc65ce89653a26d9579)) - Add Laravel plugin ([`1974533`](https://redirect.github.com/webpro-nl/knip/commit/197453378f2b60e5143a30ec78b438f02b37c53b)) - Add Quasar plugin ([`a220729`](https://redirect.github.com/webpro-nl/knip/commit/a220729074bfbb9e7d03ba329e89ad553c3a7799)) ### [`v6.25.0`](https://redirect.github.com/webpro-nl/knip/releases/tag/knip%406.25.0): Release 6.25.0 [Compare Source](https://redirect.github.com/webpro-nl/knip/compare/knip@6.24.0...knip@6.25.0) - fix: derive package name from package.json under Yarn `nodeLinker: pnpm` store ([#1852](https://redirect.github.com/webpro-nl/knip/issues/1852)) ([`3764605`](https://redirect.github.com/webpro-nl/knip/commit/3764605ed150b975fb6c88c4c4aa47f5bf9ae149)) - thanks [@blowery](https://redirect.github.com/blowery)! - Pick up types used in module augmentations via path aliases (resolve [#1850](https://redirect.github.com/webpro-nl/knip/issues/1850)) ([`9cc5a41`](https://redirect.github.com/webpro-nl/knip/commit/9cc5a4132793990b5fcf9eae6f3db37426d979c0)) - feat: add support for `packageExtensions` in yarn and pnpm ([#1847](https://redirect.github.com/webpro-nl/knip/issues/1847)) ([`61d3164`](https://redirect.github.com/webpro-nl/knip/commit/61d3164cdac6e9252b3c52ce3bb2909949b4690e)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - fix(ci): do not run integration on forks ([#1855](https://redirect.github.com/webpro-nl/knip/issues/1855)) ([`d23c10d`](https://redirect.github.com/webpro-nl/knip/commit/d23c10d1ae764c0b70addaafc79f01c543cc5efa)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - chore(ci): improve security through specific permissions ([#1856](https://redirect.github.com/webpro-nl/knip/issues/1856)) ([`1eb42e6`](https://redirect.github.com/webpro-nl/knip/commit/1eb42e639f9ec12d6d2ef88e1aaf07397b5bf226)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - chore(ci): add concurrency blocks ([#1857](https://redirect.github.com/webpro-nl/knip/issues/1857)) ([`3bf3d11`](https://redirect.github.com/webpro-nl/knip/commit/3bf3d115cf677fadcfe8fa72ce0e68cfd435d399)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - fix(next): resolve src/ entry patterns like Next.js does ([#1859](https://redirect.github.com/webpro-nl/knip/issues/1859)) ([`6e6a509`](https://redirect.github.com/webpro-nl/knip/commit/6e6a5094e924a5cd104867f3907dbbb378f871b3)) - thanks [@dayongkr](https://redirect.github.com/dayongkr)! - Fix Bun test defaults ([#1860](https://redirect.github.com/webpro-nl/knip/issues/1860)) ([`2ac4c04`](https://redirect.github.com/webpro-nl/knip/commit/2ac4c0427d2ac03939661f6dc236d15d11414fd5)) - thanks [@jakeleventhal](https://redirect.github.com/jakeleventhal)! - Extend agentic guidelines re. plugins ([`da606eb`](https://redirect.github.com/webpro-nl/knip/commit/da606eb522f01187def8747d7ddb917c6735157d)) - Support rspack and path aliases in require.context ([`d231d67`](https://redirect.github.com/webpro-nl/knip/commit/d231d67a5e8713c2f48f9d695ae12a9dbfa0260e)) - Support path aliases in import.meta.glob (resolve [#1821](https://redirect.github.com/webpro-nl/knip/issues/1821)) ([`fc7bb1e`](https://redirect.github.com/webpro-nl/knip/commit/fc7bb1ecc194e69f9f493bff5b33a4cc807fd788)) - Register MDX compiler in Storybook plugin ([`6f18138`](https://redirect.github.com/webpro-nl/knip/commit/6f1813809608cd36e44af22583805e686c51c5bd)) - Resolve TypeDoc customCss and customJs files ([`105687d`](https://redirect.github.com/webpro-nl/knip/commit/105687daf682884257a2d40f26967d80ea4abef8)) - Resolve inline Babel presets/plugins in Jest transform ([`38e4a4a`](https://redirect.github.com/webpro-nl/knip/commit/38e4a4a4a06d902cf55457155f666c3b91e05f28)) - Mark graphql-codegen generated outputs as entries ([`1255369`](https://redirect.github.com/webpro-nl/knip/commit/125536921f1845eeec1347091b238bb615f329e0)) - Add Fumadocs plugin ([`77c2142`](https://redirect.github.com/webpro-nl/knip/commit/77c2142fcc6ad6fdee651c5dc60a74c158cd8de3)) - Support next.config.mts in Next.js plugin ([`0f27e77`](https://redirect.github.com/webpro-nl/knip/commit/0f27e772935bba5eaeca73ee75ce028412c4a1cc)) - Add script command parser built on unbash ([`195510c`](https://redirect.github.com/webpro-nl/knip/commit/195510c6c912ade9cd7846302d2f9256ede9852c)) - Gate Bun test entries on an actual bun test invocation ([`92903ec`](https://redirect.github.com/webpro-nl/knip/commit/92903ec29bb8b86586e3d7e846236d8c38787ea9)) - Detect Node.js test runner via script command parser ([`a0bfe7b`](https://redirect.github.com/webpro-nl/knip/commit/a0bfe7ba2958a1270604764a9ebf09425ce857d4)) - Extract shared command walker for bash-parser and plugins ([`1301475`](https://redirect.github.com/webpro-nl/knip/commit/13014753d5031cf1de8081b3d148212a5894dde0)) - Normalize aliased glob patterns to posix for Win ([`23b4a74`](https://redirect.github.com/webpro-nl/knip/commit/23b4a744330d0dddd2b1517f2f2d72c9d373a0b9)) - Resolve inherited tsconfig paths from the extended config's directory (resolve [#1866](https://redirect.github.com/webpro-nl/knip/issues/1866)) ([`e3f0e5c`](https://redirect.github.com/webpro-nl/knip/commit/e3f0e5c69641bb7dfab06585251c98e3b3def049)) - Handle var interpolations in shell cmd scripts (resolve [#1867](https://redirect.github.com/webpro-nl/knip/issues/1867)) ([`9422d06`](https://redirect.github.com/webpro-nl/knip/commit/9422d06adb07fd29a3388ee6b037cda47fe28d1a)) - Update query snapshot ([`5e192e9`](https://redirect.github.com/webpro-nl/knip/commit/5e192e996fd680c41674c9503437ee148b0f1870)) - Add support for Prettier overrides ([#1869](https://redirect.github.com/webpro-nl/knip/issues/1869)) ([`5dc7f12`](https://redirect.github.com/webpro-nl/knip/commit/5dc7f1235ff201c461a71f8a757c611441f1607a)) - thanks [@remcohaszing](https://redirect.github.com/remcohaszing)! - Handle Serverless esbuild inject entries ([#1865](https://redirect.github.com/webpro-nl/knip/issues/1865)) ([`46111ef`](https://redirect.github.com/webpro-nl/knip/commit/46111ef2f42c2ea89a43d8944b5efdcde7db2884)) - thanks [@jakeleventhal](https://redirect.github.com/jakeleventhal)! - docs: add links to Discord and Contributing in issue templates ([#1868](https://redirect.github.com/webpro-nl/knip/issues/1868)) ([`5ab3483`](https://redirect.github.com/webpro-nl/knip/commit/5ab3483e30733edc234e9913b3bf4bf05de45470)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Add eve (Vercel framework) plugin ([#1864](https://redirect.github.com/webpro-nl/knip/issues/1864)) ([`20cd970`](https://redirect.github.com/webpro-nl/knip/commit/20cd970d2039835dd9bad79ee2e7f3a82cef1b6e)) - thanks [@jakeleventhal](https://redirect.github.com/jakeleventhal)! - Add circular dependencies as opt-in `cycles` issue type (resolve [#1734](https://redirect.github.com/webpro-nl/knip/issues/1734)) ([#1812](https://redirect.github.com/webpro-nl/knip/issues/1812)) ([`1b0ed6b`](https://redirect.github.com/webpro-nl/knip/commit/1b0ed6b3906d726b37a89b495fb22331ec2a0fbb)) - chore(ci): remove redundant tag triggers ([#1863](https://redirect.github.com/webpro-nl/knip/issues/1863)) ([`c61d008`](https://redirect.github.com/webpro-nl/knip/commit/c61d0086e4e669a8aeee230dc5ac3606832ea893)) - thanks [@trueberryless](https://redirect.github.com/trueberryless)! - Fix up docs a bit ([`89a2d8d`](https://redirect.github.com/webpro-nl/knip/commit/89a2d8d6ac27ee866a15a8bcf5a49da3cba91b08)) </details> <details> <summary>mqttjs/MQTT.js (mqtt)</summary> ### [`v5.15.2`](https://redirect.github.com/mqttjs/MQTT.js/blob/HEAD/CHANGELOG.md#5152-2026-07-06) [Compare Source](https://redirect.github.com/mqttjs/MQTT.js/compare/v5.15.1...v5.15.2) ##### Bug Fixes - **connect/tls:** don't overwrite an explicit servername (SNI) ([#2051](https://redirect.github.com/mqttjs/MQTT.js/issues/2051)) ([cd1d780](https://redirect.github.com/mqttjs/MQTT.js/commit/cd1d780f5742852e9bcf46dbd9732e0c5e20823a)) - support relative WebSocket URLs ([#2049](https://redirect.github.com/mqttjs/MQTT.js/issues/2049)) ([c4be563](https://redirect.github.com/mqttjs/MQTT.js/commit/c4be5633594b5b839862440aa78125f22021f8e6)), closes [#2035](https://redirect.github.com/mqttjs/MQTT.js/issues/2035) </details> <details> <summary>node-cron/node-cron (node-cron)</summary> ### [`v4.6.0`](https://redirect.github.com/node-cron/node-cron/blob/HEAD/CHANGELOG.md#460-2026-07-04) [Compare Source](https://redirect.github.com/node-cron/node-cron/compare/v4.5.0...v4.6.0) ##### Added - add cron.shutdown(timeout?) for graceful process teardown ([#589](https://redirect.github.com/node-cron/node-cron/issues/589)) ([35f1a61](https://redirect.github.com/node-cron/node-cron/commit/35f1a61ba7cef987f7ed342489d8d0f0220553b8)) - add unref option for heartbeat timers ([#588](https://redirect.github.com/node-cron/node-cron/issues/588)) ([35cb140](https://redirect.github.com/node-cron/node-cron/commit/35cb140d9c2d790ff295d54fbe82f6eec9b27e33)) - **day-of-month:** Quartz-style W, L-n and ? modifiers ([#570](https://redirect.github.com/node-cron/node-cron/issues/570)) ([cbe379b](https://redirect.github.com/node-cron/node-cron/commit/cbe379bce9d770c84328399dca514bd92a467c18)) - emit task:failed when a background daemon exits unexpectedly ([7bd91d6](https://redirect.github.com/node-cron/node-cron/commit/7bd91d62d1472d52f9adbddfddc0c47458623080)) - support cron expression nicknames ([@yearly](https://redirect.github.com/yearly), [@daily](https://redirect.github.com/daily), etc.) ([#579](https://redirect.github.com/node-cron/node-cron/issues/579)) ([6a6e14e](https://redirect.github.com/node-cron/node-cron/commit/6a6e14e43ab4ce5c21b52414a17e3e20311bd7bf)) ##### Fixed - background task state transition on stop/destroy without fork ([#584](https://redirect.github.com/node-cron/node-cron/issues/584)) ([9dbc6de](https://redirect.github.com/node-cron/node-cron/commit/9dbc6de269cf5855b0afc037fb4446ef9791d761)) - clear jitter timeout on runner stop ([#583](https://redirect.github.com/node-cron/node-cron/issues/583)) ([28b8146](https://redirect.github.com/node-cron/node-cron/commit/28b8146dd164ea992e1d5a649756b2bba4e062c4)) - CommonJS type resolution ([#608](https://redirect.github.com/node-cron/node-cron/issues/608)) ([ee9d294](https://redirect.github.com/node-cron/node-cron/commit/ee9d294e71e526edffa2a2f902cad71e1f570d44)) - correct falied->failed typo in daemon task error log ([#594](https://redirect.github.com/node-cron/node-cron/issues/594)) ([66c6961](https://redirect.github.com/node-cron/node-cron/commit/66c6961f2140d84cb71b101013abc170977297eb)) - correct shutdown listener typing that broke the build ([#595](https://redirect.github.com/node-cron/node-cron/issues/595)) ([7aac3ad](https://redirect.github.com/node-cron/node-cron/commit/7aac3adc22516faad054f2b3ef7362edf62e20f3)) - correlate execute() by id, isolate event hooks, and stop counting manual runs toward maxExecutions ([#607](https://redirect.github.com/node-cron/node-cron/issues/607)) ([0f039a9](https://redirect.github.com/node-cron/node-cron/commit/0f039a94dcaf6221ea406221b1e7c5eb34a47c4b)) - daemon serialized task state with wrong field name ([#587](https://redirect.github.com/node-cron/node-cron/issues/587)) ([688d465](https://redirect.github.com/node-cron/node-cron/commit/688d465b82889f07f39dfef9170d808c1f40330e)) - expand inverted ranges with wrap-around instead of silently swapping ([#602](https://redirect.github.com/node-cron/node-cron/issues/602)) ([a10ae53](https://redirect.github.com/node-cron/node-cron/commit/a10ae53626f1cc6e426e23266423f5e334a6871e)) - harden cron.shutdown() teardown ([#598](https://redirect.github.com/node-cron/node-cron/issues/598)) ([a0b0d1f](https://redirect.github.com/node-cron/node-cron/commit/a0b0d1ff9313d0f8532130e5fcb873f29f48fd1f)) - kill orphan child process on background task stop/destroy timeout ([#582](https://redirect.github.com/node-cron/node-cron/issues/582)) ([8179e10](https://redirect.github.com/node-cron/node-cron/commit/8179e105a02b91035bce441309c1cda12aaf4c4a)) - make concurrent background start() await the daemon and time out coordinator lookups ([#605](https://redirect.github.com/node-cron/node-cron/issues/605)) ([446f03a](https://redirect.github.com/node-cron/node-cron/commit/446f03ae8f366683c43b186b93bcba5091a00042)) - make lifecycle calls on a destroyed task safe no-ops ([#600](https://redirect.github.com/node-cron/node-cron/issues/600)) ([7fa9795](https://redirect.github.com/node-cron/node-cron/commit/7fa979514f9181aa63b0363cddb2acbf045b1f8c)) - prevent double destroy on registry remove ([#585](https://redirect.github.com/node-cron/node-cron/issues/585)) ([8ae9f06](https://redirect.github.com/node-cron/node-cron/commit/8ae9f06463954754d4958f9eb478aed73e8adc4d)) - **release-please:** match existing v-prefixed tags ([#575](https://redirect.github.com/node-cron/node-cron/issues/575)) ([e43c152](https://redirect.github.com/node-cron/node-cron/commit/e43c152188d993f59a12e3e9e258a695b44ca579)) - runner promise bugs that could hang scheduling or crash process ([#581](https://redirect.github.com/node-cron/node-cron/issues/581)) ([0ae62be](https://redirect.github.com/node-cron/node-cron/commit/0ae62be8b3639762f1b09569cbb66503c940d8e5)) - unref the IPC channel so background tasks let the process exit ([#599](https://redirect.github.com/node-cron/node-cron/issues/599)) ([534e593](https://redirect.github.com/node-cron/node-cron/commit/534e59344c019bc69869bc33e5cdcf1ff8ae1f1e)) - validate the cron expression when scheduling a task ([#603](https://redirect.github.com/node-cron/node-cron/issues/603)) ([196e6cd](https://redirect.github.com/node-cron/node-cron/commit/196e6cd41ac32ab9df56668ac70e1b5232384bb8)) - validate() consistency and multi-asterisk expansion ([#606](https://redirect.github.com/node-cron/node-cron/issues/606)) ([8cf41c4](https://redirect.github.com/node-cron/node-cron/commit/8cf41c436f5b544e32908d6e73b2679e973074e3)) - weekday 7-to-0 conversion corrupting ranges ([#580](https://redirect.github.com/node-cron/node-cron/issues/580)) ([c8a3943](https://redirect.github.com/node-cron/node-cron/commit/c8a3943817cc1338d4f03dbc7ad52fa34d449134)) ##### Changed - replace chai and sinon with native vitest assertions ([#590](https://redirect.github.com/node-cron/node-cron/issues/590)) ([d29d07a](https://redirect.github.com/node-cron/node-cron/commit/d29d07a005911b4ae19ce5a6bb55571018972e1f)) </details> <details> <summary>sindresorhus/p-limit (p-limit)</summary> ### [`v7.3.1`](https://redirect.github.com/sindresorhus/p-limit/releases/tag/v7.3.1) [Compare Source](https://redirect.github.com/sindresorhus/p-limit/compare/v7.3.0...v7.3.1) - Fix detached limit.map calls ([#108](https://redirect.github.com/sindresorhus/p-limit/issues/108)) [`ef37eb2`](https://redirect.github.com/sindresorhus/p-limit/commit/ef37eb2) *** </details> <details> <summary>postcss/postcss (postcss)</summary> ### [`v8.5.21`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8521) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.20...8.5.21) - Fixed childless at-rule losing semicolon before comment (by [@sarathfrancis90](https://redirect.github.com/sarathfrancis90)). - Fixed docs (by [@isker](https://redirect.github.com/isker)). ### [`v8.5.20`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8520) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.19...8.5.20) - Fixed missing space if `AtRule#params` is set after (by [@sarathfrancis90](https://redirect.github.com/sarathfrancis90)). - Fixed mixing AST error on warnings (by [@MahinAnowar](https://redirect.github.com/MahinAnowar)). ### [`v8.5.19`](https://redirect.github.com/postcss/postcss/releases/tag/8.5.19) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.18...8.5.19) - Fixed cleaning `before` for new nodes inserted to `Root` (by [@MahinAnowar](https://redirect.github.com/MahinAnowar)). ### [`v8.5.18`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8518) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.17...8.5.18) - Restricted loading previous source maps file to the `opts.from` folder for security reasons (use `unsafeMap: true` to disable the check). ### [`v8.5.17`](https://redirect.github.com/postcss/postcss/blob/HEAD/CHANGELOG.md#8517) [Compare Source](https://redirect.github.com/postcss/postcss/compare/8.5.16...8.5.17) - Fixed `Maximum call stack size exceeded` error. - Fixed Prototype hijacking for `postcss.fromJSON()`. - Fixed `Input#origin()` for unmapped end position (by [@chatman-media](https://redirect.github.com/chatman-media)). </details> <details> <summary>le0pard/re2js (re2js)</summary> ### [`v2.8.6`](https://redirect.github.com/le0pard/re2js/releases/tag/2.8.6) [Compare Source](https://redirect.github.com/le0pard/re2js/compare/2.8.5...2.8.6) #### What's Changed - Replace Thread Pool with a Sparse Array in js env by [@le0pard](https://redirect.github.com/le0pard) in [#48](https://redirect.github.com/le0pard/re2js/pull/48) - Bump js-yaml from 3.14.2 to 3.15.0 in the npm\_and\_yarn group across 1 directory by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#49](https://redirect.github.com/le0pard/re2js/pull/49) - [remove AtomicReference](https://redirect.github.com/le0pard/re2js/commit/1b08c6ef176c86f06bee07cdb856b381a0907ba6) - [remove O(n) for array copying in UTF-8 encoding](https://redirect.github.com/le0pard/re2js/commit/37951e5d0027ce2d812e991116703925bdece5c5) - [bugfixes for split and replace](https://redirect.github.com/le0pard/re2js/commit/b2d72010ff1382c2fcd0e9c45b957c9b5f3f95ae) **Full Changelog**: <https://github.com/le0pard/re2js/compare/2.8.5...2.8.6> </details> <details> <summary>nodejs/undici (undici)</summary> ### [`v8.8.0`](https://redirect.github.com/nodejs/undici/compare/v8.7.0...1760faa557f5f29c6dbd33fcbe6b0422cee16856) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.7.0...v8.8.0) ### [`v8.7.0`](https://redirect.github.com/nodejs/undici/releases/tag/v8.7.0) [Compare Source](https://redirect.github.com/nodejs/undici/compare/v8.6.0...v8.7.0) ##### What's Changed - test: guard balanced-pool error port lookup by [@mcollina](https://redirect.github.com/mcollina) in [#5463](https://redirect.github.com/nodejs/undici/pull/5463) - perf: optimize http/2 request hot path by [@mcollina](https://redirect.github.com/mcollina) in [#5483](https://redirect.github.com/nodejs/undici/pull/5483) - fix: do not reject open-ended Range values in simpleRangeHeaderValue by [@spokodev](https://redirect.github.com/spokodev) in [#5490](https://redirect.github.com/nodejs/undici/pull/5490) - fix(eventsource): set use-URL-credentials flag by [@Ram-blip](https://redirect.github.com/Ram-blip) in [#5489](https://redirect.github.com/nodejs/undici/pull/5489) - test: deflake connect-timeout watchdog by [@mcollina](https://redirect.github.com/mcollina) in [#5197](https://redirect.github.com/nodejs/undici/pull/5197) - docs: correct npm script name and JSON syntax in examples by [@lenoxfernando](https://redirect.github.com/lenoxfernando) in [#5496](https://redirect.github.com/nodejs/undici/pull/5496) - fix: reject non-ascii octets in validateCookiePath by [@spokodev](https://redirect.github.com/spokodev) in [#5452](https://redirect.github.com/nodejs/undici/pu > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/CodesWhat/drydock).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@biomejs/biome](https://biomejs.dev) ([source](https://redirect.github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome)) | [`2.4.16` → `2.5.2`](https://renovatebot.com/diffs/npm/@biomejs%2fbiome/2.4.16/2.5.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@biomejs%2fbiome/2.5.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@biomejs%2fbiome/2.4.16/2.5.2?slim=true) | | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | [`25.7.0` → `25.9.4`](https://renovatebot.com/diffs/npm/@types%2fnode/25.7.0/25.9.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/25.9.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/25.7.0/25.9.4?slim=true) | | [lefthook](https://redirect.github.com/evilmartians/lefthook) | [`2.1.6` → `2.1.9`](https://renovatebot.com/diffs/npm/lefthook/2.1.6/2.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/lefthook/2.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lefthook/2.1.6/2.1.9?slim=true) | | [vite](https://vite.dev) ([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.0.16` → `8.1.3`](https://renovatebot.com/diffs/npm/vite/8.0.16/8.1.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.1.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.0.16/8.1.3?slim=true) | | [vitest](https://vitest.dev) ([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)) | [`4.1.7` → `4.1.9`](https://renovatebot.com/diffs/npm/vitest/4.1.7/4.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.7/4.1.9?slim=true) | --- ### Release Notes <details> <summary>biomejs/biome (@biomejs/biome)</summary> ### [`v2.5.2`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#252) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.1...@biomejs/biome@2.5.2) ##### Patch Changes - [#10595](https://redirect.github.com/biomejs/biome/pull/10595) [`f458028`](https://redirect.github.com/biomejs/biome/commit/f4580289094a8fe5c85252adc3399c060bab811e) Thanks [@pkallos](https://redirect.github.com/pkallos)! - Added the option `ignoreBooleanCoercion` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||` and `||=` used inside a `Boolean()` call, where coalescing on falsy values is intentional. - [#10798](https://redirect.github.com/biomejs/biome/pull/10798) [`4a32b63`](https://redirect.github.com/biomejs/biome/commit/4a32b63eb41f144dc8faf6b5cdb05e1de5dbcb63) Thanks [@pkallos](https://redirect.github.com/pkallos)! - Added the option `ignorePrimitives` to [useNullishCoalescing](https://biomejs.dev/linter/rules/use-nullish-coalescing/). When enabled, Biome ignores `||`, `||=`, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use `true` to ignore all primitives, or an object selecting `string`, `number`, `boolean`, or `bigint`. - [#10545](https://redirect.github.com/biomejs/biome/pull/10545) [`f3d4c00`](https://redirect.github.com/biomejs/biome/commit/f3d4c0082676c5188e9a6aa516318c7e3d59bda6) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Added the new nursery rule [`noSvelteUnnecessaryStateWrap`](https://biomejs.dev/linter/rules/no-svelte-unnecessary-state-wrap/), which reports unnecessary `$state()` wrapping of classes from `svelte/reactivity` that are already reactive. ```svelte <script> import { SvelteMap } from "svelte/reactivity"; const map = $state(new SvelteMap()); // redundant </script> ``` - [#10752](https://redirect.github.com/biomejs/biome/pull/10752) [`f62fb8b`](https://redirect.github.com/biomejs/biome/commit/f62fb8b53092fe85e16f9d4ea0e584fee7031ab5) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10739](https://redirect.github.com/biomejs/biome/issues/10739). Now the rule [`useValidAutocomplete`](https://biomejs.dev/linter/rules/use-valid-autocomplete/) correctly flags the `autoComplete` attribute. - [#10796](https://redirect.github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://redirect.github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10768](https://redirect.github.com/biomejs/biome/issues/10768). Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates. - [#10719](https://redirect.github.com/biomejs/biome/pull/10719) [`aa649b5`](https://redirect.github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://redirect.github.com/minseong0324)! - Fixed [`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/) false positive on returns that use a widening type assertion: `"a" as string` is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as `false as false`, matching the existing `as const` behavior. ```ts // No longer flagged (returns are `string`): function getValue(b: boolean): string { if (b) return "a" as string; return "b" as string; } // Now also reported, like `as const` (returns `false`): function isReady(): boolean { return false as false; } ``` - [#10678](https://redirect.github.com/biomejs/biome/pull/10678) [`8f073a7`](https://redirect.github.com/biomejs/biome/commit/8f073a7cd72b4cf46c2ebf2bc08f4068fc4b5e34) Thanks [@PranavAchar01](https://redirect.github.com/PranavAchar01)! - Fixed [#7718](https://redirect.github.com/biomejs/biome/issues/7718): Biome now correctly parses CSS nesting selectors when `&` appears as a trailing sub-selector after a type selector, e.g. `h1& { color: red; }`. - [#10756](https://redirect.github.com/biomejs/biome/pull/10756) [`5ec965a`](https://redirect.github.com/biomejs/biome/commit/5ec965a2620dec7cb40aa4946ba1d41408b11fd9) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatter output for selector lists with `allowWrongLineComments` and `//` comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators. ```diff -.powerPathNavigator - .helm - button.pressedButton, // pressed +.powerPathNavigator .helm button.pressedButton, // pressed .powerPathNavigator .helm button:active:not(.disabledButton) { } ``` - [#10757](https://redirect.github.com/biomejs/biome/pull/10757) [`6232fcd`](https://redirect.github.com/biomejs/biome/commit/6232fcdef77471e6a6a74bcc33ff7b2b2a9f85a2) Thanks [@PranavAchar01](https://redirect.github.com/PranavAchar01)! - Fixed [#8269](https://redirect.github.com/biomejs/biome/issues/8269): the CSS parser now accepts Tailwind `@variant` and `@utility` names that start with a digit, such as the `2xl` breakpoint. ```css @utility container { @variant 2xl { max-width: 1400px; } } ``` - [#10777](https://redirect.github.com/biomejs/biome/pull/10777) [`575ced6`](https://redirect.github.com/biomejs/biome/commit/575ced6fd7fe3597fdec36e572763e4a5d590244) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://redirect.github.com/biomejs/biome/issues/10708): the GitLab reporter now handles `--verbose` diagnostics filtering correctly. - [#10281](https://redirect.github.com/biomejs/biome/pull/10281) [`0efe244`](https://redirect.github.com/biomejs/biome/commit/0efe2442e9b81d83f7332fd792ad6096678f8b2c) Thanks [@Zelys-DFKH](https://redirect.github.com/Zelys-DFKH)! - Fixed a bug where GritQL patterns rejected positional (unkeyed) arguments. - [#10758](https://redirect.github.com/biomejs/biome/pull/10758) [`e36fd8a`](https://redirect.github.com/biomejs/biome/commit/e36fd8a9f1314744276df515a1137f21802d3aa5) Thanks [@henrybrewer00-dotcom](https://redirect.github.com/henrybrewer00-dotcom)! - Fixed [#10697](https://redirect.github.com/biomejs/biome/issues/10697): The formatter no longer removes the parentheses around an `await` or `yield` expression used as the target of a TypeScript instantiation expression. For example, `(await makeFactory)<Value>` is no longer reformatted to `await makeFactory<Value>`, which would change the meaning of the code. - [#10586](https://redirect.github.com/biomejs/biome/pull/10586) [`3617094`](https://redirect.github.com/biomejs/biome/commit/3617094f00e90f7167ff20baf3c12b5014188b35) Thanks [@IxxyDev](https://redirect.github.com/IxxyDev)! - Fixed [#9568](https://redirect.github.com/biomejs/biome/issues/9568): [`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/) no longer reports a false positive when calling an overloaded function and the selected overload does not return a promise. ```ts function bestEffort(cb: () => Promise<number>): Promise<number>; function bestEffort(cb: () => number): number; function bestEffort( cb: () => number | Promise<number>, ): Promise<number> | number { return cb() as Promise<number> | number; } // This resolves to the second overload, which returns `number`, so it is no // longer flagged as a floating promise. bestEffort(() => 42); ``` - [#10766](https://redirect.github.com/biomejs/biome/pull/10766) [`7aff4c1`](https://redirect.github.com/biomejs/biome/commit/7aff4c11900579a62dc27ef4e02a4c4760fbbff4) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#2862](https://redirect.github.com/biomejs/biome/issues/2862): [`noInteractiveElementToNoninteractiveRole`](https://biomejs.dev/linter/rules/no-interactive-element-to-noninteractive-role/) no longer reports custom elements (a tag name containing a dash, e.g. `<my-button role="img" />`). Per the [W3C HTML-ARIA specification](https://www.w3.org/TR/html-aria/#el-autonomous-custom-element), a custom element may be given any role or none. - [#10680](https://redirect.github.com/biomejs/biome/pull/10680) [`771daa4`](https://redirect.github.com/biomejs/biome/commit/771daa4f7d229a8754f47923f03b899dc0fc5630) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed [#10635](https://redirect.github.com/biomejs/biome/issues/10635): Biome now recognizes chained table tests such as `test.concurrent.each()` and `it.concurrent.each()` as test calls, fixing `noMisplacedAssertion` false positives and improving formatting for those test declarations. - [#10759](https://redirect.github.com/biomejs/biome/pull/10759) [`34570b5`](https://redirect.github.com/biomejs/biome/commit/34570b5b793c44e978b12589dafcfda22dba7df1) Thanks [@henrybrewer00-dotcom](https://redirect.github.com/henrybrewer00-dotcom)! - Fixed [#10636](https://redirect.github.com/biomejs/biome/issues/10636): [noStaticElementInteractions](https://biomejs.dev/linter/rules/no-static-element-interactions/) no longer reports a false positive for event handlers on Svelte special elements such as `<svelte:window>`, `<svelte:document>`, and `<svelte:body>`. These are not real DOM elements, so they are now ignored by the rule. - [#10741](https://redirect.github.com/biomejs/biome/pull/10741) [`bd2364e`](https://redirect.github.com/biomejs/biome/commit/bd2364e3d077e3a77addcab6dbe127db38654e4a) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#6686](https://redirect.github.com/biomejs/biome/issues/6686): the `rage` command now respects the `--config-path` option and the `BIOME_CONFIG_PATH` environment variable when loading the Biome configuration. Previously it always used the default configuration resolution and reported the configuration as `Not set` when no `biome.json` existed in the working directory. - [#10763](https://redirect.github.com/biomejs/biome/pull/10763) [`2c3e82d`](https://redirect.github.com/biomejs/biome/commit/2c3e82d0235ad2f8331744aefc708d1b71f7177c) Thanks [@Aqu1bp](https://redirect.github.com/Aqu1bp)! - Fixed [#10742](https://redirect.github.com/biomejs/biome/issues/10742): [`noSolidDestructuredProps`](https://biomejs.dev/linter/rules/no-solid-destructured-props) now reports destructured props in Solid function components and JSX children. - [#10606](https://redirect.github.com/biomejs/biome/pull/10606) [`a4cc4ab`](https://redirect.github.com/biomejs/biome/commit/a4cc4ab0b01a8ef1731d37cb44bccc5522876f2e) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Fixed false positives in `noUnusedImports`, `noUnusedVariables`, and `useImportType` for Svelte components that use both a `<script module>` and a `<script>` block. The two blocks compile to a single module and share a top-level scope, so a binding (import, function, or variable) declared in one block and used only in the other is no longer reported as unused. - [#10767](https://redirect.github.com/biomejs/biome/pull/10767) [`36d5aa7`](https://redirect.github.com/biomejs/biome/commit/36d5aa77d751bf33485cd2c92d89e4c5764e1e50) Thanks [@otkrickey](https://redirect.github.com/otkrickey)! - Fixed [#10754](https://redirect.github.com/biomejs/biome/issues/10754): [`useVueValidVBind`](https://biomejs.dev/linter/rules/use-vue-valid-v-bind/) no longer reports the Vue 3.4+ same-name shorthand as missing a value. `:foo` and `v-bind:foo` are now accepted as equivalent to `:foo="foo"`, while `v-bind`, `v-bind:[dynamicArg]`, and `:[dynamicArg]` without a value continue to be reported. - [#10775](https://redirect.github.com/biomejs/biome/pull/10775) [`a918af0`](https://redirect.github.com/biomejs/biome/commit/a918af0ba827a7fd60a12c96b58daebc8af61db2) Thanks [@WaterWhisperer](https://redirect.github.com/WaterWhisperer)! - Fixed an issue reported in [#10708](https://redirect.github.com/biomejs/biome/issues/10708): `biome rage` didn't detect running Biome daemon pipes on Windows. - [#10730](https://redirect.github.com/biomejs/biome/pull/10730) [`5a2e65b`](https://redirect.github.com/biomejs/biome/commit/5a2e65b9929ef0f2294c20e028fd396d760d2b26) Thanks [@dinocosta](https://redirect.github.com/dinocosta)! - Fixed an issue where Biome was resolving [the well-known Zed settings file](https://biomejs.dev/guides/configure-biome/#well-known-files) from the wrong location on macOS and Windows. - [#10807](https://redirect.github.com/biomejs/biome/pull/10807) [`d97fffe`](https://redirect.github.com/biomejs/biome/commit/d97fffe0aba04cddec66943d6bff3e99d440b451) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where `.scss` files were incorrectly analyzed when running `biome check`. - [#10672](https://redirect.github.com/biomejs/biome/pull/10672) [`53c6efc`](https://redirect.github.com/biomejs/biome/commit/53c6efcd3e5e2769bf8edbe14b8c06ee9fda52d2) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed a bug where Biome incorrectly formatted snippets that have parsing errors. - [#10719](https://redirect.github.com/biomejs/biome/pull/10719) [`aa649b5`](https://redirect.github.com/biomejs/biome/commit/aa649b586a2221bf058af7ce80af6faa11faf846) Thanks [@minseong0324](https://redirect.github.com/minseong0324)! - Fixed [`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/) false positive when awaiting a custom thenable that is not the global `Promise`. A value with a callable `then` member is now recognized as awaitable. ```ts interface Thenable<T> { then(onfulfilled: (value: T) => void): void; } declare const t: Thenable<number>; async function f() { await t; } ``` - [#10734](https://redirect.github.com/biomejs/biome/pull/10734) [`4396496`](https://redirect.github.com/biomejs/biome/commit/43964961c88ca0f93ee83d10621844fa2dc7515c) Thanks [@BangDori](https://redirect.github.com/BangDori)! - Fixed [#10708](https://redirect.github.com/biomejs/biome/issues/10708): `biome migrate` now preserves trivia when migrating the deprecated `recommended` option to `preset`. - [#10683](https://redirect.github.com/biomejs/biome/pull/10683) [`ae31a00`](https://redirect.github.com/biomejs/biome/commit/ae31a004a20ed33d6aa35d5ec8bb4c433273a517) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10657](https://redirect.github.com/biomejs/biome/issues/10657) [#10671](https://redirect.github.com/biomejs/biome/issues/10671) [#10661](https://redirect.github.com/biomejs/biome/issues/10661) [#10637](https://redirect.github.com/biomejs/biome/issues/10637) [#10718](https://redirect.github.com/biomejs/biome/issues/10718): HTML rules now correctly handle dynamic attributes. - [#10746](https://redirect.github.com/biomejs/biome/pull/10746) [`54e8239`](https://redirect.github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't correctly detect styles defined inside the Astro directive `is:global`. - [#10770](https://redirect.github.com/biomejs/biome/pull/10770) [`dd1429c`](https://redirect.github.com/biomejs/biome/commit/dd1429c604f58b89524a3f5329e2920d198e8d9f) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Improved the Biome Language Server DX by orchestrating certain operations, so that they won't block the editor during typing. This improvement is more visible in large documents. - [#10473](https://redirect.github.com/biomejs/biome/pull/10473) [`d9b5133`](https://redirect.github.com/biomejs/biome/commit/d9b5133de7e211b22f4531fe220070690a18c8d1) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Improved [`noUnusedImports`](https://biomejs.dev/linter/rules/no-unused-imports/), [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/), [`noUnusedFunctionParameters`](https://biomejs.dev/linter/rules/no-unused-function-parameters/), and [`useImportType`](https://biomejs.dev/linter/rules/use-import-type/) for Svelte, Vue, and Astro files (with `html.experimentalFullSupportEnabled`). Bindings used only in the template — including component tags, attribute interpolations, directives, `bind:` shorthand, and snippet parameters — are no longer reported as unused, while genuinely unused ones still are. - [#10796](https://redirect.github.com/biomejs/biome/pull/10796) [`f1b3ab2`](https://redirect.github.com/biomejs/biome/commit/f1b3ab2c09522a52c93f669ce679675237b96813) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where the Biome Language Server didn't enable project or type-aware lint rules, even when they were explicitly enabled. - [#10746](https://redirect.github.com/biomejs/biome/pull/10746) [`54e8239`](https://redirect.github.com/biomejs/biome/commit/54e8239bba3f598d7923ac1e446d658714ea7832) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed an issue where [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes) didn't detect styles declared inside HTML documents. - [#10774](https://redirect.github.com/biomejs/biome/pull/10774) [`bde945b`](https://redirect.github.com/biomejs/biome/commit/bde945bee29cb566086828ad788153d9111a125a) Thanks [@pattrickrice](https://redirect.github.com/pattrickrice)! - Fixed [#10268](https://redirect.github.com/biomejs/biome/issues/10268) where a race condition resulted in internal errors such as: `The file biome.json does not exist in the workspace`. ### [`v2.5.1`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#251) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.0...@biomejs/biome@2.5.1) ##### Patch Changes - [#10722](https://redirect.github.com/biomejs/biome/pull/10722) [`f8a303d`](https://redirect.github.com/biomejs/biome/commit/f8a303d08b6b22f56edb8ff5e7caa665532d613a) Thanks [@denbezrukov](https://redirect.github.com/denbezrukov)! - Fixed CSS formatter output for comments between import media queries. ```diff -@import url("print.css") print, -/* comment */ -screen; +@import url("print.css") print, /* comment */ screen; ``` - [#10738](https://redirect.github.com/biomejs/biome/pull/10738) [`9fdc560`](https://redirect.github.com/biomejs/biome/commit/9fdc5600997ef59ca7ed55ac212473de9bdb0b2a) Thanks [@JamBalaya56562](https://redirect.github.com/JamBalaya56562)! - Fixed [#9899](https://redirect.github.com/biomejs/biome/issues/9899): the `json` and `json-pretty` reporters now escape backslashes in a diagnostic's `location.path`. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON. ```diff - "path": "src\account\setup-passkey.tsx", + "path": "src\\account\\setup-passkey.tsx", ``` - [#10626](https://redirect.github.com/biomejs/biome/pull/10626) [`5f837df`](https://redirect.github.com/biomejs/biome/commit/5f837df033afc34d43b398aeddc06c1d4fa491d9) Thanks [@tom-groves](https://redirect.github.com/tom-groves)! - Fixed [#10625](https://redirect.github.com/biomejs/biome/issues/10625): `biome migrate` no longer emits an invalid trailing comma when a renamed rule (such as `noConsoleLog` → `noConsole`) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON `biome.json` with a parsing error. - [#10535](https://redirect.github.com/biomejs/biome/pull/10535) [`c245f9d`](https://redirect.github.com/biomejs/biome/commit/c245f9d9e239471d5437cd08f9cfa4601a85abd5) Thanks [@Mokto](https://redirect.github.com/Mokto)! - Fixed a false positive in [`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/) for Svelte files where variables referenced inside `{@html expr}` blocks were incorrectly reported as unused. - [#10668](https://redirect.github.com/biomejs/biome/pull/10668) [`a0f197e`](https://redirect.github.com/biomejs/biome/commit/a0f197eb1a6974539927f105ff1dde1f51d07d74) Thanks [@Netail](https://redirect.github.com/Netail)! - The `biome init` command has been updated to include a more up-to-date URL to [the first-party extensions page](https://biomejs.dev/editors/first-party-extensions/). - [#10667](https://redirect.github.com/biomejs/biome/pull/10667) [`d8c3e87`](https://redirect.github.com/biomejs/biome/commit/d8c3e878d53515c02bd6c5cb899b2eaec046c542) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10664](https://redirect.github.com/biomejs/biome/issues/10664): [useErrorCause](https://biomejs.dev/linter/rules/use-error-cause/) now correctly detects a shorthand property. - [#10696](https://redirect.github.com/biomejs/biome/pull/10696) [`ef2373f`](https://redirect.github.com/biomejs/biome/commit/ef2373f29be15673705884d345c9af189e30b581) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#9566](https://redirect.github.com/biomejs/biome/issues/9566). Improved how the Biome Language Server loads multiple configuration files inside a workspace. - [#10705](https://redirect.github.com/biomejs/biome/pull/10705) [`4ccb410`](https://redirect.github.com/biomejs/biome/commit/4ccb410dc00a6fb243934dad2e8681a9d5d9529e) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10652](https://redirect.github.com/biomejs/biome/issues/10652). Biome plugins are now properly filtered when using `--only` and `--skip` flags. - [#10669](https://redirect.github.com/biomejs/biome/pull/10669) [`aa0a6eb`](https://redirect.github.com/biomejs/biome/commit/aa0a6eb8007493961cd578f04201248c15fd809a) Thanks [@Netail](https://redirect.github.com/Netail)! - Fixed [#10651](https://redirect.github.com/biomejs/biome/issues/10651): [useInlineScriptId](https://biomejs.dev/linter/rules/use-inline-script-id/) now correctly trims trivia to detect if an id attribute has been set. - [#10689](https://redirect.github.com/biomejs/biome/pull/10689) [`844b1be`](https://redirect.github.com/biomejs/biome/commit/844b1be60ded28bf4c650d85806919ceb57bc402) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10658](https://redirect.github.com/biomejs/biome/issues/10658). The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now **disabled by default**. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files. If you relied on this new feature, you must now turn on using the \[editor settings] of the extension e.g. [Zed](https://biomejs.dev/reference/zed/#goto_definition) and [VSCode](https://biomejs.dev/reference/vscode/#biomegotodefinition). - [#10695](https://redirect.github.com/biomejs/biome/pull/10695) [`043fbb5`](https://redirect.github.com/biomejs/biome/commit/043fbb514f1b96c5b723cd86c8db4b9bc9f03631) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10674](https://redirect.github.com/biomejs/biome/issues/10674). Biome now throws an error when the field `level` is missing from a rule option. - [#10712](https://redirect.github.com/biomejs/biome/pull/10712) [`5941df2`](https://redirect.github.com/biomejs/biome/commit/5941df2a0d6904e487e73d4dc7231dcaf7b3a2f0) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Improved the diagnostic and the documentation of [`useFlatMap`](https://biomejs.dev/linter/rules/use-flat-map/). - [#10615](https://redirect.github.com/biomejs/biome/pull/10615) [`23814f1`](https://redirect.github.com/biomejs/biome/commit/23814f1ad8430df906a39323ee31d27d7b9ca17b) Thanks [@qwertycxz](https://redirect.github.com/qwertycxz)! - Improved the DX the JSON schema when it's used by certain code editors like VSCode. - [#10688](https://redirect.github.com/biomejs/biome/pull/10688) [`ec69489`](https://redirect.github.com/biomejs/biome/commit/ec694896a0c75176aca040392e3309df1b2e963d) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning. - [#10701](https://redirect.github.com/biomejs/biome/pull/10701) [`6c2e0d7`](https://redirect.github.com/biomejs/biome/commit/6c2e0d7bba1cbc457a42adf6c982a773bc7e4605) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10694](https://redirect.github.com/biomejs/biome/issues/10694). The Biome Language Server no longer prints an error when the user hovers a variable imported from node\_modules. - [#10681](https://redirect.github.com/biomejs/biome/pull/10681) [`888515b`](https://redirect.github.com/biomejs/biome/commit/888515b088cde688a95680362a619221c023f9d0) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Fixed [`useExportType`](https://biomejs.dev/linter/rules/use-export-type/) that reported useless details in some diagnostics. - [#10220](https://redirect.github.com/biomejs/biome/pull/10220) [`3694a13`](https://redirect.github.com/biomejs/biome/commit/3694a135a9976915889988c36d9eb40d679f06e6) Thanks [@theBGuy](https://redirect.github.com/theBGuy)! - Fixed [`useAnchorContent`](https://biomejs.dev/linter/rules/use-anchor-content/) false positive for `<a>` elements used as render prop values (e.g. `render={<a href="..." />}`), a pattern where the receiving component renders its children inside the anchor element. - [#10702](https://redirect.github.com/biomejs/biome/pull/10702) [`98823fb`](https://redirect.github.com/biomejs/biome/commit/98823fb2e70095b09e1ca4bb9733850bbe8ff33f) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Fixed [#10612](https://redirect.github.com/biomejs/biome/issues/10612). The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore: ```svg <?xml version="1.0" encoding="UTF-8" ?> <svg></svg> ``` ### [`v2.5.0`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#250) [Compare Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.4.16...@biomejs/biome@2.5.0) ##### Minor Changes - [#9539](https://redirect.github.com/biomejs/biome/pull/9539) [`f0615fd`](https://redirect.github.com/biomejs/biome/commit/f0615fdae80fa7257fc1d0448d2027cb1acff46e) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added a new reporter called `concise`. When `--reporter=concise` is passed the commands `format`, `lint`, `check` and `ci`, the diagnostics are printed in a compact manner: ``` ! index.ts:2:10: lint/correctness/noUnusedImports: Several of these imports are unused. ! main.ts:9:7: lint/correctness/noUnusedVariables: This variable f is unused. × index.ts:8:5: lint/suspicious/noImplicitAnyLet: This variable implicitly has the any type. × main.ts:2:10: lint/suspicious/noRedeclare: Shouldn't redeclare 'z'. Consider to delete it or rename it. ``` - [#9495](https://redirect.github.com/biomejs/biome/pull/9495) [`2056b23`](https://redirect.github.com/biomejs/biome/commit/2056b23812a17f9c9a9015e5b725faecb04647b5) Thanks [@aviraldua93](https://redirect.github.com/aviraldua93)! - Added the [`useKeyWithClickEvents`](https://biomejs.dev/linter/rules/use-key-with-click-events/) a11y lint rule for HTML files (`.html`, `.vue`, `.svelte`, `.astro`). This is a port of the existing JSX rule. The rule enforces that elements with an `onclick` handler also have at least one keyboard event handler (`onkeydown`, `onkeyup`, or `onkeypress`) to ensure keyboard accessibility. Inherently keyboard-accessible elements (`<a>`, `<button>`, `<input>`, `<select>`, `<textarea>`, `<option>`) are excluded, as are elements hidden from assistive technologies (`aria-hidden`) or with `role="presentation"` / `role="none"`. ```html  <div onclick="handleClick()">Click me</div>  <div onclick="handleClick()" onkeydown="handleKeyDown()">Click me</div>  <button onclick="handleClick()">Submit</button> ``` - [#9152](https://redirect.github.com/biomejs/biome/pull/9152) [`9ec8500`](https://redirect.github.com/biomejs/biome/commit/9ec8500dabc7305cbe04ecf27a84a1450f012c0b) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added new nursery lint rule [`noUndeclaredClasses`](https://biomejs.dev/linter/rules/no-undeclared-classes/) for HTML, JSX, and SFC files (Vue, Astro, Svelte). The rule detects CSS class names used in `class="..."` (or `className`) attributes that are not defined in any `<style>` block or linked stylesheet reachable from the file. ```html  <html> <head> <style> .button { color: blue; } </style> </head> <body> <div class="button typo"></div> </body> </html> ``` - [#9152](https://redirect.github.com/biomejs/biome/pull/9152) [`9ec8500`](https://redirect.github.com/biomejs/biome/commit/9ec8500dabc7305cbe04ecf27a84a1450f012c0b) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added new nursery lint rule [`noUnusedClasses`](https://biomejs.dev/linter/rules/no-unused-classes/) for CSS. The rule detects CSS class selectors that are never referenced in any HTML or JSX file that imports the stylesheet. This is a project-domain rule that requires the module graph. ```css /* styles.css — .ghost is never used in any importing file */ .button { color: blue; } .ghost { color: red; } ``` ```jsx /* App.jsx */ import "./styles.css"; export default () => <div className="button" />; ``` - [#9546](https://redirect.github.com/biomejs/biome/pull/9546) [`6567efa`](https://redirect.github.com/biomejs/biome/commit/6567efa51ba074436b017e49b1d2d369e7252e74) Thanks [@nhedger](https://redirect.github.com/nhedger)! - Added a `biome upgrade` command for standalone installations. It upgrades Homebrew installs with `brew upgrade biome`, updates manually installed binaries from the latest GitHub release, and tells npm users to upgrade with their package manager instead. - [#9716](https://redirect.github.com/biomejs/biome/pull/9716) [`701767a`](https://redirect.github.com/biomejs/biome/commit/701767a3c4de8bce032933588ef2b6e5e252919f) Thanks [@faizkhairi](https://redirect.github.com/faizkhairi)! - Added the HTML version of the [`useHeadingContent`](https://biomejs.dev/linter/rules/use-heading-content/) rule. The rule now enforces that heading elements (`h1`-`h6`) have content accessible to screen readers in HTML, Vue, Svelte, and Astro files. ```html  <h1></h1>  <h1 aria-hidden="true">invisible content</h1>  <h1>heading</h1>  <h1 aria-label="Screen reader content"></h1> ``` - [#9582](https://redirect.github.com/biomejs/biome/pull/9582) [`f437ef8`](https://redirect.github.com/biomejs/biome/commit/f437ef8b6b0eb8f909d523950cf2c543042083d5) Thanks [@rahuld109](https://redirect.github.com/rahuld109)! - Added the HTML version of the [`useKeyWithMouseEvents`](https://biomejs.dev/linter/rules/use-key-with-mouse-events/) rule. The rule now enforces that `onmouseover` is accompanied by `onfocus` and `onmouseout` is accompanied by `onblur` in HTML, Vue, Svelte, and Astro files. ```html  <div onmouseover="handleMouseOver()"></div>  <div onmouseover="handleMouseOver()" onfocus="handleFocus()"></div> ``` - [#9275](https://redirect.github.com/biomejs/biome/pull/9275) [`1fdbcee`](https://redirect.github.com/biomejs/biome/commit/1fdbceea62d373f24da9c1e5cc0cdd169b573e84) Thanks [@ff1451](https://redirect.github.com/ff1451)! - Added the new assist action [`useSortedTypeFields`](https://biomejs.dev/assist/actions/use-sorted-type-fields/), which sorts the fields of GraphQL object types, interface types and input object types alphabetically, e.g. `name, age, id` becomes `age, id, name`. - [#10561](https://redirect.github.com/biomejs/biome/pull/10561) [`78075b7`](https://redirect.github.com/biomejs/biome/commit/78075b7c7cb7490c730a96f4ee9776c9e77826e7) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Added a new `style` option to [useExportType](https://biomejs.dev/linter/rules/use-export-type/), which enforces a style for exporting types. This is the same option as the one provided by `useImportType`. - [#8987](https://redirect.github.com/biomejs/biome/pull/8987) [`d16e32b`](https://redirect.github.com/biomejs/biome/commit/d16e32b5b971a4ed9cd3bf5098782c8b752af69a) Thanks [@DerTimonius](https://redirect.github.com/DerTimonius)! - Ported the [`useValidAnchor`](https://biomejs.dev/linter/rules/use-valid-anchor/) rule to HTML. This rule enforces that all anchors are valid and that they are navigable elements. - [#9533](https://redirect.github.com/biomejs/biome/pull/9533) [`4d251d4`](https://redirect.github.com/biomejs/biome/commit/4d251d489cfd33a83e42d425476f8d6c66b72d9b) Thanks [@ematipico](https://redirect.github.com/ematipico)! - The `init` command now prints the Biome logo. - [#10069](https://redirect.github.com/biomejs/biome/pull/10069) [`0eb9310`](https://redirect.github.com/biomejs/biome/commit/0eb93109e1f9bfbb20744961681b4f0b9b781ad5) Thanks [@Netail](https://redirect.github.com/Netail)! - Added the HTML lint rule [`noStaticElementInteractions`](https://biomejs.dev/linter/rules/no-static-element-interactions/), which enforces that static, visible elements (such as `<div>`) that have click handlers use the valid role attribute. **Invalid**: ```html <div onclick="myFunction()"></div> ``` - [#9134](https://redirect.github.com/biomejs/biome/pull/9134) [`2a43488`](https://redirect.github.com/biomejs/biome/commit/2a434882746d31e1bd3c8e0d711372a539ce88f8) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added the assist action [`useSortedPackageJson`](https://biomejs.dev/assist/actions/use-sorted-package-json). This action organizes package.json fields according to the same conventions as the popular [sort-package-json](https://redirect.github.com/keithamus/sort-package-json) tool. - [#9309](https://redirect.github.com/biomejs/biome/pull/9309) [`7daa18b`](https://redirect.github.com/biomejs/biome/commit/7daa18b07f7ab348942f4cb83b475e6a4b3d1125) Thanks [@Bertie690](https://redirect.github.com/Bertie690)! - The `allowDoubleNegation` option has been added to [`noImplicitCoercions`](https://biomejs.dev/linter/rules/no-implicit-coercions) to allow ignoring double negations inside code. With the option enabled, the following example is considered valid and is ignored by the rule: ```js const truthy = !!value; ``` - [#9700](https://redirect.github.com/biomejs/biome/pull/9700) [`894f3fb`](https://redirect.github.com/biomejs/biome/commit/894f3fb4c664b12ff9abd1527b535621fe4e22f6) Thanks [@ematipico](https://redirect.github.com/ematipico)! - The Biome Language server now supports the "go-to definition" feature. When the cursor of the mouse is hovering an entity (variable, CSS class, type, etc.), and the command <kbd>CTRL</kbd> + click is triggered, the editor jumps to where this entity is defined, if the language server can find it. Here's what Biome is able to resolve: - Variables and types used in JavaScript modules, defined in the same file or imported from another module. - JSX Components used in JavaScript modules, defined in the same file or imported from another module. - CSS classes used in JSX and HTML-ish files (Vue, Svelte and Astro), and defined in CSS files. - Components used in HTML-ish files and defined in other HTML-ish. - Variables used in HTML-ish files and defined in the same file or imported from another module (JavaScript or HTML-ish). - [#10070](https://redirect.github.com/biomejs/biome/pull/10070) [`bae0710`](https://redirect.github.com/biomejs/biome/commit/bae071050f5a9c335b4483ee384f21ac1e6f0b4d) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Added the `:STYLE:` group matcher for [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) that matches style imports. For example, the following configuration... ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "groups": ["**", "!:STYLE:"], "sortBareImports": true } } } } } } ``` ...places style imports last: ```diff - import "./style.css" import A from "./a.js" + import "./style.css" ``` - [#9170](https://redirect.github.com/biomejs/biome/pull/9170) [`e3107de`](https://redirect.github.com/biomejs/biome/commit/e3107deedcff0f02b61702c6645d89e8d8635b49) Thanks [@mdrobny](https://redirect.github.com/mdrobny)! - Added `bundleDependencies` option to [NoUndeclaredDependencies](https://biomejs.dev/linter/rules/no-undeclared-dependencies) rule. This rule now supports imports of packages that are defined only in `bundleDependencies` and `bundledDependencies` arrays. - [#9547](https://redirect.github.com/biomejs/biome/pull/9547) [`01f8473`](https://redirect.github.com/biomejs/biome/commit/01f847317820f805698e1b8ba9eaa8fa6c26205c) Thanks [@mujpao](https://redirect.github.com/mujpao)! - Added new assist rule [`useSortedAttributes`](https://biomejs.dev/assist/actions/use-sorted-attributes/) for HTML, porting the existing JSX rule. This rule enforces sorted HTML attributes. **Invalid** ```html <input type="text" id="name" name="name" /> ``` - [#9366](https://redirect.github.com/biomejs/biome/pull/9366) [`2ca1117`](https://redirect.github.com/biomejs/biome/commit/2ca1117f1e63f6cd99c0ce8d4b82475625838e2e) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Added the `html.parser.vue` configuration option. When enabled, it adds support for the parsing of Vue in `.html` files. Most Vue users don't need to enable this option since Vue files typically use the `.vue` extension, but it can be useful for projects that embed Vue syntax in regular HTML files. - [#9073](https://redirect.github.com/biomejs/biome/pull/9073) [`74b20ee`](https://redirect.github.com/biomejs/biome/commit/74b20eee556c9acc72ad5ea335b1bf0983d2eb2e) Thanks [@chocky335](https://redirect.github.com/chocky335)! - Added support for applying GritQL plugin rewrites as code actions. GritQL plugins that use the rewrite operator (`=>`) now produce fixable diagnostics for JavaScript, CSS, and JSON files. By default, plugin rewrites are treated as unsafe fixes and require `--write --unsafe` to apply. Plugin authors can pass `fix_kind = "safe"` to `register_diagnostic()` to mark a fix as safe, allowing it to be applied with just `--write`. **Example plugin** (`useConsoleInfo.grit`): ```grit language js `console.log($msg)` as $call where { register_diagnostic(span = $call, message = "Use console.info instead of console.log.", severity = "warn", fix_kind = "safe"), $call => `console.info($msg)` } ``` Running `biome check --write` applies safe rewrites. Unsafe rewrites (the default, or `fix_kind = "unsafe"`) still require `--write --unsafe`. - [#9384](https://redirect.github.com/biomejs/biome/pull/9384) [`f4c9edc`](https://redirect.github.com/biomejs/biome/commit/f4c9edca8f8772a1e65d9e6701fdc3f604a9f3fe) Thanks [@Conaclos](https://redirect.github.com/Conaclos)! - Added the `sortBareImports` option to [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/), which allows bare imports to be sorted within other imports when set to `false`. ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "sortBareImports": true } } } } } } ``` ```diff - import "b"; import "a"; + import "b"; import { A } from "a"; + import "./file"; import { Local } from "./file"; - import "./file"; ``` - [#8731](https://redirect.github.com/biomejs/biome/pull/8731) [`e7872bf`](https://redirect.github.com/biomejs/biome/commit/e7872bffba88f60d6c3cb6d0c2dd7a25452a0205) Thanks [@siketyan](https://redirect.github.com/siketyan)! - Added the watch mode (`--watch`) to the CLI for `check`/`format`/`lint` commands. By enabling this option, Biome will re-run the check automatically when any file in the workspace has changed after the first run. - [#10106](https://redirect.github.com/biomejs/biome/pull/10106) [`9b35f78`](https://redirect.github.com/biomejs/biome/commit/9b35f78e183edf44a3d8b7077ebb0c548a7e92f5) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Biome can now format and lint `.svg` files. - [#9967](https://redirect.github.com/biomejs/biome/pull/9967) [`e9b6c17`](https://redirect.github.com/biomejs/biome/commit/e9b6c17cd6f7e870aea68da3b6c6474aa1a9b4f6) Thanks [@dyc3](https://redirect.github.com/dyc3)! - Added HTML support for [`noExcessiveLinesPerFile`](https://biomejs.dev/linter/rules/no-excessive-lines-per-file/). Biome now reports HTML files that exceed the configured line limit, including when `skipBlankLines` is enabled. - [#9491](https://redirect.github.com/biomejs/biome/pull/9491) [`b3eb63c`](https://redirect.github.com/biomejs/biome/commit/b3eb63c7e19e6ebd41e463289de098bb003686e1) Thanks [@IxxyDev](https://redirect.github.com/IxxyDev)! - Added the HTML lint rule [`noAriaUnsupportedElements`](https://biomejs.dev/linter/rules/no-aria-unsupported-elements/). This rule enforces that elements that do not support ARIA roles, states, and properties (`meta`, `html`, `script`, `style`) do not have `role` or `aria-*` attributes. ```html  <meta charset="UTF-8" role="meta" /> ``` - [#9306](https://redirect.github.com/biomejs/biome/pull/9306) [`afd57a6`](https://redirect.github.com/biomejs/biome/commit/afd57a634bdb6b0b161dc8a2522ac460503569b1) Thanks [@viraxslot](https://redirect.github.com/viraxslot)! - Added the [`noNoninteractiveTabindex`](https://biomejs.dev/linter/rules/no-noninteractive-tabindex/) lint rule for HTML. This rule enforces that `tabindex` is not used on non-interactive elements, as it can cause usability issues for keyboard users. ```html <div tabindex="0">Invalid: non-interactive element</div> ` ``` - [#9276](https://redirect.github.com/biomejs/biome/pull/9276) [`6d041d9`](https://redirect.github.com/biomejs/biome/commit/6d041d919e06595553093e084e6aad0d39fb8109) Thanks [@IxxyDev](https://redirect.github.com/IxxyDev)! - Added the HTML lint rule [`noRedundantRoles`](https://biomejs.dev/linter/rules/no-redundant-roles/). This rule enforces that explicit `role` attributes are not the same as the implicit/default role of an HTML element. It supports HTML, Vue, Svelte, and Astro files. ```html  <button role="button"></button> ``` - [#9813](https://redirect.github.com/biomejs/biome/pull/9813) [`69aadc2`](https://redirect.github.com/biomejs/biome/commit/69aadc27741bb8a74c926e14a2a9777064cb1e03) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Added a new linter configuration called `preset`. With the new option, users can enable different kinds of rules at once. The following presets are available: - `"recommended"`: it enables all Biome-recommended rules, or recommended rules of a group; - `"all"`: it enables all Biome rules, or enables all rules of a group; - `"none"`: it disables all Biome rules, or disable all rules of a group. You can enable recommended rules: ```json { "linter": { "rules": { "preset": "recommended" } } } ``` You can enable **all rules** at once: ```json5 { linter: { rules: { preset: "all", // enables all rules }, }, } ``` Or enable all rules for a group: ```json5 { linter: { rules: { style: { preset: "all", // enables all rules in the style group }, }, }, } ``` This new option, however, doesn't affect how nursery rules work. Nursery rules must be enabled singularly, due to their nature. This new option is meant to replace `recommended`, so make sure to run the `migrate` command. - [#10022](https://redirect.github.com/biomejs/biome/pull/10022) [`3422d71`](https://redirect.github.com/biomejs/biome/commit/3422d71bc5e9d7f07fd4e7509566427e1591d760) Thanks [@Netail](https://redirect.github.com/Netail)! - Added the HTML lint rule [`noNoninteractiveElementToInteractiveRole`](https://biomejs.dev/linter/rules/no-noninteractive-element-to-interactive-role/), which enforces that interactive ARIA roles are not assigned to non-interactive HTML elements. **Invalid**: ```html <h1 role="checkbox"></h1> ``` - [#8396](https://redirect.github.com/biomejs/biome/pull/8396) [`13785fc`](https://redirect.github.com/biomejs/biome/commit/13785fc8f4be068eccff84a8ad90ac8530d5c992) Thanks [@apple-yagi](https://redirect.github.com/apple-yagi)! - Biome now supports pnpm catalogs (default and named) when resolving dependencies for linting. This behavior is opt-in and requires setting `javascript.resolver.experimentalPnpmCatalogs` to `true`. - [#10028](https://redirect.github.com/biomejs/biome/pull/10028) [`1009414`](https://redirect.github.com/biomejs/biome/commit/100941409f3ec5e6653e92b2cfbb4100df1becb0) Thanks [@Netail](https://redirect.github.com/Netail)! - Added the HTML lint rule [`noInteractiveElementToNoninteractiveRole`](https://biomejs.dev/linter/rules/no-interactive-element-to-noninteractive-role/), which enforces that non-interactive ARIA roles are not assigned to interactive HTML elements. **Invalid**: ```html <input role="img" /> ``` - [#9853](https://redirect.github.com/biomejs/biome/pull/9853) [`816302f`](https://redirect.github.com/biomejs/biome/commit/816302f8c8c9862585c283fce22ffd1817dedf9f) Thanks [@Netail](https://redirect.github.com/Netail)! - Added the new assist action [`useSortedSelectionSet`](https://biomejs.dev/assist/actions/use-sorted-selection-set/), which sorts GraphQL selection sets alphabetically, e.g. `name, age, id` becomes `age, id, name`. **Invalid**: ```graphql query { name age id } ``` - [#10074](https://redirect.github.com/biomejs/biome/pull/10074) [`9c7c6eb`](https://redirect.github.com/biomejs/biome/commit/9c7c6eb99f6880aa87ae0e7aff357e978361c4a3) Thanks [@georgephillips](https://redirect.github.com/georgephillips)! - Added a `kind` field to the `ImportMatcher` used by the [`organizeImports`](https://biomejs.dev/assist/actions/organize-imports/) assist action. The new field selects imports by their syntactic kind and currently supports `bare` (matching side-effect imports such as `import "polyfill"`) with optional `!` negation (`!bare`). The matcher composes with the existing `type` and `source` fields, so users can express patterns such as "only bare imports that import a CSS file" (`{ "kind": "bare", "source": "**/*.css" }`). For example, with the following configuration: ```json { "assist": { "actions": { "source": { "organizeImports": { "level": "on", "options": { "sortBareImports": true, "groups": [ { "kind": "!bare" }, ":BLANK_LINE:", { "kind": "bare" } ] } } } } } } ``` ...the following code: ```ts import "./register-my-component"; import { render } from "react-dom"; import "./polyfill"; import { Button } from "@/components/Button"; ``` ...is organized as: ```ts import { render } from "react-dom"; import { Button } from "@/components/Button"; import "./polyfill"; import "./register-my-component"; ``` - [#9171](https://redirect.github.com/biomejs/biome/pull/9171) [`ce65710`](https://redirect.github.com/biomejs/biome/commit/ce65710f591eb2676df6833e9cd00e310981692b) Thanks [@chocky335](https://redirect.github.com/chocky335)! - Added `includes` option for plugin file scoping. Plugins can now be configured with glob patterns to restrict which files they run on. Use negated globs for exclusions. ```json { "plugins": [ "global-plugin.grit", { "path": "scoped-plugin.grit", "includes": ["src/**/*.ts", "!**/*.test.ts"] } ] } ``` - [#9617](https://redirect.github.com/biomejs/biome/pull/9617) [`dcb99ef`](https://redirect.github.com/biomejs/biome/commit/dcb99ef0305d8431af40b526c449316bb8a70efa) Thanks [@faizkhairi](https://redirect.github.com/faizkhairi)! - Ported [`useAriaActivedescendantWithTabindex`](https://biomejs.dev/linter/rules/use-aria-activedescendant-with-tabindex/) a11y rule to HTML. - [#9496](https://redirect.github.com/biomejs/biome/pull/9496) [`1dfb829`](https://redirect.github.com/biomejs/biome/commit/1dfb8291a0a2340e7c9220f9126317a7490ec466) Thanks [@aviraldua93](https://redirect.github.com/aviraldua93)! - Added HTML support for the [`noAriaHiddenOnFocusable`](https://biomejs.dev/linter/rules/no-aria-hidden-on-focusable/) accessibility lint rule, which enforces that `aria-hidden="true"` is not set on focusable elements. Focusable elements include native interactive elements (`<button>`, `<input>`, `<select>`, `<textarea>`), elements with `href` (`<a>`, `<area>`), elements with `tabindex >= 0`, and editing hosts (`contenteditable`). Includes an unsafe fix to remove the `aria-hidden` attribute. ```html  <button aria-hidden="true">Submit</button>  <div aria-hidden="true">decorative content</div> ``` - [#9792](https://redirect.github.com/biomejs/biome/pull/9792) [`f516854`](https://redirect.github.com/biomejs/biome/commit/f51685404f015a5c6f0fc87b9070ac5d9f0a7b6b) Thanks [@Maximiliano-Zeballos](https://redirect.github.com/Maximiliano-Zeballos)! - Added the [`useSemanticElements`](https://biomejs.dev/linter/rules/use-semantic-elements/) lint rule for HTML. The rule now detects the use of `role` attributes in HTML elements and suggests using semantic elements instead. For example, the following code is now flagged: ```html <div role="navigation"></div> ``` The rule suggests using `<nav>` instead. - [#9761](https://redirect.github.com/biomejs/biome/pull/9761) [`cbbb7d5`](https://redirect.github.com/biomejs/biome/commit/cbbb7d5bf21d8fb6db275da7adcc03c034538635) Thanks [@Maximiliano-Zeballos](https://redirect.github.com/Maximiliano-Zeballos)! - Ported the [`useValidAriaProps`](https://biomejs.dev/linter/rules/use-valid-aria-props/) lint rule to HTML. This rule checks that all `aria-*` attributes used in HTML elements are valid ARIA attributes as defined by the WAI-ARIA specification. - [#9928](https://redirect.github.com/biomejs/biome/pull/9928) [`aa82576`](https://redirect.github.com/biomejs/biome/commit/aa82576ff66e03924e07729051ac9bfc59cd5aa1) Thanks [@aviraldua93](https://redirect.github.com/aviraldua93)! - Ported [`useValidAriaValues`](https://biomejs.dev/linter/rules/use-valid-aria-values/) to HTML. Biome now validates static `aria-*` attribute values in HTML elements against WAI-ARIA types, catching invalid values such as `aria-hidden="yes"`. - [#10562](https://redirect.github.com/biomejs/biome/pull/10562) [`6642895`](https://redirect.github.com/biomejs/biome/commit/66428957e6ca393a802f365b8e643438f19a3039) Thanks [@ematipico](https://redirect.github.com/ematipico)! - Promoted 73 nursery rules to stable groups. Four rules were renamed as part of the promotion: - `noFloatingClasses` is now [`noUnusedInstantiation`](https://biomejs.dev/linter/rules/no-unused-instantiation/), because the rule checks any discarded `new` expression, not only classes. - `noMultiStr` is now [`noMultilineString`](https://biomejs.dev/linter/rules/no-multiline-string/). - `useFind` is now [`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/). - `useSpread` is now [`useSpreadOverApply`](https://biomejs.dev/linter/rules/use-spread-over-apply/), because the rule enforces spread call arguments over `Function.apply()`, not array or object spread. ##### Correctness Promoted the following rules to the `correctness` group: - [`noBeforeInteractiveScriptOutsideDocument`](https://biomejs.dev/linter/rules/no-before-interactive-script-outside-document/) - [`noUnusedInstantiation`](https://biomejs.dev/linter/rules/no-unused-instantiation/) - [`useInlineScriptId`](https://biomejs.dev/linter/rules/use-inline-script-id/) (recommended, Next.js domain) - [`noVueVIfWithVFor`](https://biomejs. > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (in timezone America/New_York) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/CodesWhat/drydock).   🔧 Changed - Bumped `@biomejs/biome` from `2.4.16` to `2.5.2` - Bumped `@types/node` from `25.7.0` to `25.9.4` - Bumped `lefthook` from `2.1.6` to `2.1.9` - Bumped `vitest` from `4.1.7` to `4.1.9` - Updated `vite` override from `8.0.16` to `8.1.3` - Updated `biome.json` `$schema` URL to `2.5.2` - Expanded `biome.json` `files.includes` from a compact form into a multi-line include list with additional explicit negated entries for docs/public/logo-related assets - Verify Biome 2.5.2 doesn’t cause unexpected formatter/linter churn in CI - Confirm the updated Biome `files.includes` exclusions still target only the intended assets (avoids accidentally linting/formatting new files) - Validate the `vite` override bump to `8.1.3` remains compatible with the repo’s build/test/dev scripts  --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: scttbnsn <80784472+scttbnsn@users.noreply.github.com>

`.planning/` is in `.gitignore` and CLAUDE.md describes it as local-only canonical detail, but three files under it were force-added at some point and have been publishing on every push to both `main` and `dev/v1.6`: - `.planning/ROADMAP.md` (1825 lines) - `.planning/roadmap/current-tracker.md` - `.planning/v1.6.0-MILESTONE-AUDIT.md` The published copies were stale on top of that, so anyone reading the roadmap off GitHub got an out-of-date one. Nothing depends on them being committed. `release-precut-check.mjs` already treats the tracker as optional (ENOENT prints a warning and returns), and `release-cut.yml` documents it as "gitignored — invisible to this runner, which is why it is a local gate, not a job here". The tooling was written for the untracked state all along. `git rm --cached` leaves every local copy in place. ## The guard `git add -f` on an ignored path is silent after the fact — the file stops appearing as untracked, `git status` goes quiet, and it ships from then on. That's how this happened and there was nothing to catch it. `scripts/tracked-ignored-files.test.mjs` asserts the set of tracked-but-gitignored files equals a known allowlist. The eight self-signed test certificates are on it with a note on why they're committed; anything else that becomes tracked-and-ignored fails the `scripts-test` step with the command to fix it. Verified failing on a re-added `.planning/ROADMAP.md` and passing once removed.  ## Changelog - 🗑️ Removed three stale `.planning/` documents from Git tracking (`.planning/ROADMAP.md`, `.planning/roadmap/current-tracker.md`, `.planning/v1.6.0-MILESTONE-AUDIT.md`) while retaining them locally. - ✨ Added `scripts/tracked-ignored-files.test.mjs` to make `scripts-test` fail when the repo tracks any files that are gitignored. - 🔧 Refined the tracked-ignored guard to evaluate only repository-committed `.gitignore` rules (excluding clone-local and global Git exclude config) and allowlisted eight committed test certificates. - 🔒 Security ⚠️ Updated `postcss` overrides to `8.5.22` across the root and four workspaces (`package.json`, `app/package.json`, `apps/demo/package.json`, `ui/package.json`) to address a reported path-traversal vulnerability and satisfy the `osv-scanner` check. ## Concerns - Ensure any newly introduced tracked-but-gitignored files are resolved via index removal and/or repo ignore/tracking updates (not by expanding the allowlist).

…ckfile (#594) ## What was happening Renovate bumped `ui/package.json` and `apps/web/package.json` and never wrote either lockfile, so `npm ci` rejected both branches: ``` npm error code EUSAGE `npm ci` can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. ``` Every workflow that installs those workspaces died at its own install step — Test & Coverage, Playwright, Cucumber, and the site build — so **one bad lockfile read as four unrelated CI failures**, each minutes into a job, with an error that never names Renovate. A census of the last 200 runs: 46 failures, **40 of them on `renovate/*` branches**, and 24 of the 46 were this single bug. `app/`, `e2e/` and `apps/demo/` were updated correctly in the same sweep, which is why it read as flake. ``` renovate/npm-minor-patch-ui ui/package.json ← no lockfile renovate/npm-minor-patch-appsweb apps/web/package.json ← no lockfile renovate/npm-minor-patch-e2e e2e/package.json e2e/package-lock.json ← fine renovate/npm-minor-patch-app app/package.json app/package-lock.json ← fine ``` ## `skipInstalls: false` `skipInstalls` is Renovate's fast path: patch the lockfile directly and skip the install when it believes it can. That is what silently no-opped. Turning it off costs a real npm install per update and is correct every time. **This diagnosis is inferred.** Renovate reported no artifact-update problem in either PR body or on the dependency dashboard, and its run logs are behind the Mend portal. Config validated against the live `renovate-schema.json` — `skipInstalls` accepts `boolean|null`, no unknown keys. ## The guard, which does not depend on that being right `scripts/lockfile-sync.test.mjs` reimplements the comparison `npm ci` makes — lockfile `packages[""]` against `package.json` — across every committed lockfile. It runs in the pre-push hook and as the first CI step after the root install, **before any workspace install**, and names the drifted packages: ``` npm ci will fail with EUSAGE in these workspaces: ui dependencies.vue: package.json=3.5.40 lockfile=3.5.39 Regenerate each one with `npm install --package-lock-only` in that directory and commit the result. ``` Roots come from `git ls-files -- '*package-lock.json'`, so a seventh workspace is covered the day its lockfile lands — no list to keep current. Verified in both directions, and all six current roots are checked. ## Already unblocked I regenerated both lockfiles and pushed them to the bot branches. #485 and #510 are green for the first time in days — `npm ci` in `apps/web` now succeeds and pulls `lefthook@2.1.10`, the bumped version. Those hand-fixes would be overwritten on Renovate's next run; this PR is what makes it stop happening.  ## Changelog - ✨ Added `scripts/lockfile-sync.test.mjs` to detect dependency drift between tracked `package.json` and `package-lock.json` files. - 🔧 Changed Renovate to disable `skipInstalls`, ensuring dependency updates regenerate lockfiles. - 🔧 Changed pre-push and CI checks to run lockfile consistency validation. - 🔧 Regenerated the `ui` and `apps/web` lockfiles. ## Concerns - Verify all contributors have Node.js and Git available when running the new check. - Confirm lockfile discovery and dependency comparisons support every workspace layout.

Automated sync from Crowdin. Review wording, then merge.  ✨ Added - Added locale strings for **Global update mode** (title/description/options + failure errors) in `configView` across multiple languages. - Added locale strings for **Sync Across Devices** (title/label/description + failure errors) in `configView.appearance`. - Added/expanded container update workflow i18n: preview-only/dry-run labels/tooltips/conditions, overridden/revert/revert-all and skipped-entry messaging, `noSkippedEntries`, `updateInsight`, and a full structured `updateStatus` (title/buttons/summary/conditions/actions). - Added new list-view UI strings for audit, notifications, security, registries, servers, triggers, and watchers (including `rules.container-unhealthy`, notification bell/template controls, scanner runtime tool messaging, and various `card` label groups). - Added `dashboardView.resizeWidget`. - Added shared UI strings for column picker + data table sorting labels (`sortBy`, ascending/descending). - Added localized `appShell.banners.legacyApiPathTitle` banner text variants using the `{total}` placeholder across supported locales. 🔧 Changed - Restructured locale JSON shapes where required (e.g., `registryLink` moved to an object form; `containerComponents.updateStatus` expanded/replaced from the prior smaller structure). - Improved/standardized copy in shared components and several view locales (e.g., sorting labels, “failed”/other remaining English -> localized text in some languages). 🗑️ Removed - Removed duplicated legacy `updateStatus.summary.pinned` entries after migrating to the larger `updateStatus` structure in multiple locale files. ⚠️ Concerns - Many newly added strings are still in English—review and ensure proper translations per locale. - Verify JSON key structure matches the consuming code (especially `containerComponents.updateStatus`, `dashboardView.resizeWidget`, and nested objects like `registryLink`). - Confirm interpolation placeholders remain intact and consistent (e.g., `{total}`, `{count}`) after restructuring. - Check for any accidental duplication/missing keys in large `updateStatus`/`updateInsight` blocks after the pinned-entry removal.  Co-authored-by: Crowdin Bot <support+bot@crowdin.com> Co-authored-by: Scott Benson <80784472+scttbnsn@users.noreply.github.com>

vercel · 2026-07-24T18:56:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
drydock-website	Ready	Preview, Comment	Jul 24, 2026 6:57pm
drydockdemo-website	Ready	Preview, Comment	Jul 24, 2026 6:57pm

coderabbitai · 2026-07-24T18:56:29Z

Important

Review skipped

Too many files!

This PR contains 145 files, which is 45 over the limit of 100.

To get a review, narrow the scope:
• coderabbit review --committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b82ba84a-4640-4b62-aa3e-a28266cb0635

📥 Commits

Reviewing files that changed from the base of the PR and between e4f4be2 and fd37530.

⛔ Files ignored due to path filters (6)

CHANGELOG.md is excluded by !CHANGELOG.md
app/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
apps/demo/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
apps/web/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json
ui/package-lock.json is excluded by !**/package-lock.json, !**/package-lock.json

📒 Files selected for processing (148)

.github/tests/branch-drift-guard.test.ts
.github/tests/e2e-playwright-workflow.test.ts
.github/tests/integration-branch-targets.test.ts
.github/workflows/ci-verify.yml
.github/workflows/e2e-playwright.yml
.github/workflows/i18n-crowdin.yml
.github/workflows/release-cut.yml
.planning/ROADMAP.md
.planning/roadmap/current-tracker.md
.planning/v1.6.0-MILESTONE-AUDIT.md
CONTRIBUTING.md
README.de.md
README.es.md
README.fr.md
README.md
README.pl.md
README.pt-BR.md
README.zh-CN.md
app/package.json
apps/demo/package.json
apps/web/package.json
docs/cucumber-reliability.md
e2e/playwright/auth.setup.ts
package.json
renovate.json
scripts/lockfile-sync.test.mjs
scripts/tracked-ignored-files.test.mjs
test/qa-compose.yml
ui/package.json
ui/src/locales/ar/appShell.json
ui/src/locales/ar/configView.json
ui/src/locales/ar/containerComponents.json
ui/src/locales/ar/containersView.json
ui/src/locales/ar/dashboardView.json
ui/src/locales/ar/listViews.json
ui/src/locales/ar/sharedComponents.json
ui/src/locales/de/appShell.json
ui/src/locales/de/configView.json
ui/src/locales/de/containerComponents.json
ui/src/locales/de/containersView.json
ui/src/locales/de/dashboardView.json
ui/src/locales/de/listViews.json
ui/src/locales/de/sharedComponents.json
ui/src/locales/es/agentsView.json
ui/src/locales/es/appShell.json
ui/src/locales/es/common.json
ui/src/locales/es/configView.json
ui/src/locales/es/containerComponents.json
ui/src/locales/es/containersView.json
ui/src/locales/es/dashboardView.json
ui/src/locales/es/listViews.json
ui/src/locales/es/notificationOutboxView.json
ui/src/locales/es/sharedComponents.json
ui/src/locales/fr/appShell.json
ui/src/locales/fr/configView.json
ui/src/locales/fr/containerComponents.json
ui/src/locales/fr/containersView.json
ui/src/locales/fr/dashboardView.json
ui/src/locales/fr/listViews.json
ui/src/locales/fr/sharedComponents.json
ui/src/locales/it/appShell.json
ui/src/locales/it/configView.json
ui/src/locales/it/containerComponents.json
ui/src/locales/it/containersView.json
ui/src/locales/it/dashboardView.json
ui/src/locales/it/listViews.json
ui/src/locales/it/sharedComponents.json
ui/src/locales/ja/appShell.json
ui/src/locales/ja/configView.json
ui/src/locales/ja/containerComponents.json
ui/src/locales/ja/containersView.json
ui/src/locales/ja/dashboardView.json
ui/src/locales/ja/listViews.json
ui/src/locales/ja/sharedComponents.json
ui/src/locales/ko/appShell.json
ui/src/locales/ko/configView.json
ui/src/locales/ko/containerComponents.json
ui/src/locales/ko/containersView.json
ui/src/locales/ko/dashboardView.json
ui/src/locales/ko/listViews.json
ui/src/locales/ko/sharedComponents.json
ui/src/locales/nl/appShell.json
ui/src/locales/nl/configView.json
ui/src/locales/nl/containerComponents.json
ui/src/locales/nl/containersView.json
ui/src/locales/nl/dashboardView.json
ui/src/locales/nl/listViews.json
ui/src/locales/nl/sharedComponents.json
ui/src/locales/pl/agentsView.json
ui/src/locales/pl/appShell.json
ui/src/locales/pl/configView.json
ui/src/locales/pl/containerComponents.json
ui/src/locales/pl/containersView.json
ui/src/locales/pl/dashboardView.json
ui/src/locales/pl/listViews.json
ui/src/locales/pl/sharedComponents.json
ui/src/locales/pt-BR/appShell.json
ui/src/locales/pt-BR/configView.json
ui/src/locales/pt-BR/containerComponents.json
ui/src/locales/pt-BR/containersView.json
ui/src/locales/pt-BR/dashboardView.json
ui/src/locales/pt-BR/listViews.json
ui/src/locales/pt-BR/sharedComponents.json
ui/src/locales/ru/agentsView.json
ui/src/locales/ru/appShell.json
ui/src/locales/ru/authView.json
ui/src/locales/ru/common.json
ui/src/locales/ru/configView.json
ui/src/locales/ru/containerComponents.json
ui/src/locales/ru/containersView.json
ui/src/locales/ru/dashboardView.json
ui/src/locales/ru/listViews.json
ui/src/locales/ru/sharedComponents.json
ui/src/locales/tr/appShell.json
ui/src/locales/tr/configView.json
ui/src/locales/tr/containerComponents.json
ui/src/locales/tr/containersView.json
ui/src/locales/tr/dashboardView.json
ui/src/locales/tr/listViews.json
ui/src/locales/tr/sharedComponents.json
ui/src/locales/uk/appShell.json
ui/src/locales/uk/configView.json
ui/src/locales/uk/containerComponents.json
ui/src/locales/uk/containersView.json
ui/src/locales/uk/dashboardView.json
ui/src/locales/uk/listViews.json
ui/src/locales/uk/sharedComponents.json
ui/src/locales/vi/appShell.json
ui/src/locales/vi/configView.json
ui/src/locales/vi/containerComponents.json
ui/src/locales/vi/containersView.json
ui/src/locales/vi/dashboardView.json
ui/src/locales/vi/listViews.json
ui/src/locales/vi/sharedComponents.json
ui/src/locales/zh-CN/appShell.json
ui/src/locales/zh-CN/configView.json
ui/src/locales/zh-CN/containerComponents.json
ui/src/locales/zh-CN/containersView.json
ui/src/locales/zh-CN/dashboardView.json
ui/src/locales/zh-CN/listViews.json
ui/src/locales/zh-CN/sharedComponents.json
ui/src/locales/zh-TW/appShell.json
ui/src/locales/zh-TW/configView.json
ui/src/locales/zh-TW/containerComponents.json
ui/src/locales/zh-TW/containersView.json
ui/src/locales/zh-TW/dashboardView.json
ui/src/locales/zh-TW/listViews.json
ui/src/locales/zh-TW/sharedComponents.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev/v1.6

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

biggest-littlest

Tree sync of already-reviewed dev/v1.6 content. Checks green.

ALARGECOMPANY

Second code-owner approval for the sync.

scttbnsn added 30 commits June 30, 2026 13:00

📝 docs(api): align v1.5.2 roadmap and parity

040d490

✨ feat(web): highlight self column header in compare tables

692bfc5

✨ feat(web): homepage FAQ section + FAQPage JSON-LD

aca76ee

✨ feat(web): add Discord community link to footer and README

ef34b94

- discord-icon.tsx: official Discord mark, mirrors github-icon API - site-config: discordUrl invite - footer: Discord social link between GitHub and Docs - README: Community section pointing to Discord + GitHub Issues

✅ test(web): tolerate wrapper attributes in the FAQ reveal assertion

c721ad7

scttbnsn and others added 18 commits July 21, 2026 09:29

🐛 fix(v1.6): remediate comprehensive review findings (#574)

392d09a

Closes every repository-actionable finding from the comprehensive v1.6 review, incorporates the superseded E2E correction from #573, and includes all follow-up review fixes and evidence hardening.

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners July 24, 2026 18:56

vercel Bot deployed to Preview – drydock-website July 24, 2026 18:57 View deployment

biggest-littlest approved these changes Jul 24, 2026

View reviewed changes

ALARGECOMPANY approved these changes Jul 24, 2026

View reviewed changes

scttbnsn merged commit 8b0a6ab into main Jul 24, 2026
28 checks passed

scttbnsn deleted the dev/v1.6 branch July 24, 2026 19:20

scttbnsn restored the dev/v1.6 branch July 24, 2026 19:23

This was referenced Jul 24, 2026

🔧 chore(i18n): sync translations from Crowdin #595

Closed

🐛 fix(ci): make pipefail dead-fallback handlers actually reachable #599

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

🔧 chore(sync): advance main to dev/v1.6#596

🔧 chore(sync): advance main to dev/v1.6#596
scttbnsn merged 188 commits into
mainfrom
dev/v1.6

scttbnsn commented Jul 24, 2026

Uh oh!

vercel Bot commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026

Review skipped

Uh oh!

biggest-littlest left a comment

Uh oh!

ALARGECOMPANY left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

scttbnsn commented Jul 24, 2026

Uh oh!

vercel Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 24, 2026

Review skipped

Uh oh!

biggest-littlest left a comment

Choose a reason for hiding this comment

Uh oh!

ALARGECOMPANY left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Jul 24, 2026 •

edited

Loading