Skip to content

chore(deps): bump the js-deps group with 8 updates - #13

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-deps-34bc062307
Closed

chore(deps): bump the js-deps group with 8 updates#13
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-deps-34bc062307

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the js-deps group with 8 updates:

Package From To
@biomejs/biome 2.5.10 2.5.11
@types/node 26.2.0 26.4.0
@types/react-dom 19.2.4 19.2.5
lucide-react 1.33.0 1.37.0
react-router 8.3.0 8.3.1
react-router-dom 7.18.2 7.18.3
@astrojs/mdx 7.0.7 7.0.8
astro 7.2.4 7.2.9

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

  • #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

Updates @types/node from 26.2.0 to 26.4.0

Commits

Updates @types/react-dom from 19.2.4 to 19.2.5

Commits

Updates lucide-react from 1.33.0 to 1.37.0

Release notes

Sourced from lucide-react's releases.

Version 1.37.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.35.0...1.37.0

Version 1.36.0

What's Changed

... (truncated)

Commits

Updates react-router from 8.3.0 to 8.3.1

Release notes

Sourced from react-router's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from react-router's changelog.

v8.3.1

Patch Changes

  • Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)
  • Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)
  • Improve route matching performance for long paths (#15417)
  • Improve validation of action request origins (#15419)
  • Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)
  • Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)
  • Add additional URL validation on client side navigations/redirects (#15445)
Commits
  • da2a0f0 Release v8.3.1 (#15368)
  • 917e6fd fix(fog-of-war): don't cache aborted lazy route discoveries as discovered (#1...
  • 2e0bf72 Validate client-side navigation targets (#15445)
  • f45d4ca Revert "fix: normalize control characters in relative URLs (#15416)" (#15442)
  • c091832 fix: validate schemeful action origins (#15419)
  • 308d206 fix: improve matching perf (#15417)
  • 36bdbeb fix: normalize control characters in relative URLs (#15416)
  • 801e2ae fix(react-router): re-enable manual scroll restoration after a bfcache restor...
  • 5e98140 fix: honor the relative option in useSubmit and fetcher.submit (#15400)
  • 5843d38 refactor(router): use definite assignment assertions in createDeferred (#15396)
  • Additional commits viewable in compare view

Updates react-router-dom from 7.18.2 to 7.18.3

Changelog

Sourced from react-router-dom's changelog.

v7.18.3

Patch Changes

Commits

Updates @astrojs/mdx from 7.0.7 to 7.0.8

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​7.0.8

Patch Changes

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

Changelog

Sourced from @​astrojs/mdx's changelog.

7.0.8

Patch Changes

  • #17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #17766 0762a83 Thanks @​HiDeoo! - Fixes Sätteri processor option types to accept all plugin entries supported by Sätteri v0.10.3.

Commits

Updates astro from 7.2.4 to 7.2.9

Release notes

Sourced from astro's releases.

astro@7.2.9

Patch Changes

astro@7.2.8

Patch Changes

astro@7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

astro@7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

astro@7.2.5

Patch Changes

  • #17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

... (truncated)

Changelog

Sourced from astro's changelog.

7.2.9

Patch Changes

7.2.8

Patch Changes

7.2.7

Patch Changes

  • #17415 55d38c8 Thanks @​iseraph-dev! - Deserializes each route once when loading the SSR manifest

  • #17772 023b48b Thanks @​matthewp! - Fixes route selection for normalized request paths in adapter and development request handling

  • #17819 633855b Thanks @​matthewp! - Updates generated and default Cloudflare compatibility_date values to match the installed runtime and requires Wrangler ^4.125.0

  • #17813 ae26d18 Thanks @​matthewp! - Fixes rewrite() and next(payload) for GET and HEAD requests with host-provided bodies

  • #17816 a0d2fe3 Thanks @​astro-factory! - Fixes the experimental svgOptimizer not generating unique per-file ID prefixes when using SVGO's prefixIds plugin

7.2.6

Patch Changes

  • #17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

7.2.5

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the js-deps group with 8 updates
45ead85 
Bumps the js-deps group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.10` | `2.5.11` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.4.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.33.0` | `1.37.0` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.0` | `8.3.1` |
| [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.2` | `7.18.3` |
| [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `7.0.7` | `7.0.8` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.2.4` | `7.2.9` |


Updates `@biomejs/biome` from 2.5.10 to 2.5.11
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.11/packages/@biomejs/biome)

Updates `@types/node` from 26.2.0 to 26.4.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `lucide-react` from 1.33.0 to 1.37.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.37.0/packages/lucide-react)

Updates `react-router` from 8.3.0 to 8.3.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.3.1/packages/react-router)

Updates `react-router-dom` from 7.18.2 to 7.18.3
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom)

Updates `@astrojs/mdx` from 7.0.7 to 7.0.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@7.0.8/packages/integrations/mdx)

Updates `astro` from 7.2.4 to 7.2.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.2.9/packages/astro)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-deps
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: js-deps
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-deps
- dependency-name: lucide-react
  dependency-version: 1.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: js-deps
- dependency-name: react-router
  dependency-version: 8.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-deps
- dependency-name: react-router-dom
  dependency-version: 7.18.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: js-deps
- dependency-name: "@astrojs/mdx"
  dependency-version: 7.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-deps
- dependency-name: astro
  dependency-version: 7.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: js-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026
@sonarqubecloud

sonarqubecloud Bot commented Sep 1, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 8, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/js-deps-34bc062307 branch September 8, 2026 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants