Skip to content

chore(deps): update devdependencies (major) - #485

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies
Open

chore(deps): update devdependencies (major)#485
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/major-devdependencies

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@actions/cache (source) ^4.0.2 → ^6.0.0 age confidence
@actions/core (source) ^1.11.1 → ^3.0.0 age confidence
@actions/exec (source) ^1.1.1 → ^3.0.0 age confidence
@actions/http-client (source) 2.2.3 → 4.0.1 age confidence
@actions/io (source) ^1.1.3 → ^3.0.0 age confidence
@actions/tool-cache (source) ^2.0.2 → ^4.0.0 age confidence
@babel/core (source) ^7.26.9 → ^8.0.0 age confidence
@babel/preset-typescript (source) ^7.27.1 → ^8.0.0 age confidence
@biomejs/biome (source) ^1.9.4 → ^2.0.0 age confidence
@octokit/openapi-types (source) ^25.0.0 → ^29.0.0 age confidence
@octokit/plugin-paginate-rest ^13.0.0 → ^15.0.0 age confidence
@octokit/plugin-rest-endpoint-methods ^16.0.0 → ^18.0.0 age confidence
@octokit/types ^14.0.0 → ^18.0.0 age confidence
@pnpm/patching.apply-patch (source) ^1000.0.7 → ^1100.0.0 age confidence
@types/jest (source) ^29.5.14 → ^30.0.0 age confidence
@types/node (source) ^22.13.8 → ^26.0.0 age confidence
admina ^1.0.1 → ^2.0.0 age confidence
cross-env 7.0.3 → 10.1.0 age confidence
cspell (source) ^9.0.0 → ^10.0.0 age confidence
eslint-config-atomic ^1.22.1 → ^2.0.0 age confidence
jest (source) ^29.7.0 → ^30.0.0 age confidence
npm-check-updates ^19.3.1 → ^23.0.0 age confidence
npm-run-all2 ^8.0.4 → ^9.0.0 age confidence
p-timeout ^6.1.4 → ^7.0.0 age confidence
typescript (source) ^5.8.2 → ^7.0.0 age confidence
vite (source) ^7.3.1 → ^8.0.0 age confidence

Release Notes

actions/toolkit (@​actions/cache)

v6.2.0

  • Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
  • Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

  • Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

  • Bump dependency versions (#​2393):
    • @actions/core to ^3.0.1
    • @actions/http-client to ^4.0.1
    • @actions/io to ^3.0.2
    • @azure/core-rest-pipeline to ^1.23.0
    • @azure/storage-blob to ^12.31.0
    • semver to ^7.7.4

v6.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v5.0.5

  • Bump @actions/glob to 0.5.1

v5.0.4

  • Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

  • Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
  • Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2 → whatwg-url@5 → tr46@0.0.3 that used the deprecated punycode module

v5.0.0

  • Remove @azure/ms-rest-js dependency #​2197
    • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
  • Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
  • Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
  • Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
  • Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
  • Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
  • Add support for Node.js 24 #​2110
  • Add node-fetch override to resolve audit vulnerabilities #​2110
actions/toolkit (@​actions/core)

v3.0.1

  • Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

  • Bump @actions/http-client to 3.0.2

v2.0.1

v2.0.0

actions/toolkit (@​actions/exec)

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

actions/toolkit (@​actions/http-client)

v4.0.1

  • Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

  • Bump undici from 5.28.5 to 6.23.0

v3.0.1

  • Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

actions/toolkit (@​actions/io)

v3.0.2

  • Fix: update lock file version

v3.0.1

  • Fix: export @actions/io/lib/io-util

v3.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

  • Add support for Node 24 #​2110
  • Ensures consistent behavior for paths on Node 24 with Windows
actions/toolkit (@​actions/tool-cache)

v4.0.0

  • Breaking change: Package is now ESM-only
    • CommonJS consumers must use dynamic import() instead of require()
3.0.1
  • Bump @actions/http-client to 3.0.2
3.0.0
  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
2.0.2
2.0.1
  • Update to v2.0.1 of @actions/http-client #​1087
2.0.0
  • Update to v2.0.0 of @actions/http-client
  • The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
    This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.
1.7.2
  • Update lockfileVersion to v2 in package-lock.json #​1025
1.7.1
1.7.0
1.6.1
1.6.0
1.3.5
1.3.4

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3
1.3.2
1.3.1
1.3.0
1.2.0
1.1.2
1.0.0
  • Initial release

v3.0.1

  • Bump @actions/http-client to 3.0.2

v3.0.0

  • Update to v2.0.1 of @actions/core
  • Update to v2.0.0 of @actions/exec
  • Update to v3.0.1 of @actions/http-client
  • Update to v2.0.0 of @actions/io
babel/babel (@​babel/core)

v8.0.6

Compare Source

👓 Spec Compliance
  • babel-helper-validator-identifier, babel-parser
🐛 Bug Fix
  • babel-parser
  • babel-helper-string-parser, babel-parser
🏠 Internal
  • babel-code-frame, babel-core, babel-generator, babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-parser, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-regenerator, babel-plugin-transform-typescript, babel-preset-env, babel-traverse, babel-types
  • babel-parser
  • babel-core
  • babel-build-external-helpers, babel-cli, babel-code-frame, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-globals, babel-helper-string-parser, babel-helper-transform-fixture-test-runner, babel-helper-validator-identifier, babel-node, babel-parser, babel-plugin-transform-async-generator-functions, babel-plugin-transform-runtime, babel-register, babel-runtime-corejs3, babel-traverse
🏃‍♀️ Performance
  • babel-helper-compilation-targets, babel-helper-transform-fixture-test-runner

v8.0.5

Compare Source

👓 Spec Compliance
🐛 Bug Fix
📝 Documentation
🏠 Internal
  • babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • babel-node
  • babel-types
🏃‍♀️ Performance

v8.0.1

Compare Source

💥 Breaking Change
  • babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone

v8.0.0

Compare Source

👓 Spec Compliance
💥 Breaking Change
  • babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • babel-parser
🐛 Bug Fix
  • babel-generator
  • babel-plugin-transform-modules-systemjs
📝 Documentation
🏠 Internal
🏃‍♀️ Performance
biomejs/biome (@​biomejs/biome)

v2.5.14

Compare Source

Patch Changes

  • #​9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

    // Invalid: return in finally callback
Promise.resolve(1).finally(() => { return 2 })

// Valid: no return in finally callback
Promise.resolve(1).finally(() => { console.log(2) })

    Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

  • #​11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

    <!-- Invalid: leftover debugging tag -->
{@debug user}

    The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

  • #​11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

  • #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

  • #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​7771: Grit plugins that use sequential no longer panic when Biome processes files.

  • #​11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

  • #​11461 22e9966 Thanks @​FoundDream! - Fixed #​11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

     const value = `
      ${
        condition
          ? "yes"
          : "no"
-}
+     }
 `;

  • #​11766 c2542c6 Thanks @​dyc3! - Fixed #​11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

  • #​11790 17d0ff0 Thanks @​ematipico! - Fixed #​10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

  • #​11777 7ee3a6c Thanks @​ematipico! - Fixed #​7573: added the requireExplicitCase option to useExhaustiveSwitchCases. When set to true, the rule reports missing cases even when the switch has a default clause, so you can keep a runtime fallback while checking that every value in the union has its own case. The option defaults to false.

  • #​11751 d37f24b Thanks @​ematipico! - Fixed #​8347: the fix from useConsistentArrowReturn now parenthesizes returned expressions that begin with object literals before removing the arrow function body braces, preventing invalid output for expressions such as object property access.

  • #​11784 46e8912 Thanks @​dyc3! - Fixed #​11782: noUndeclaredCustomProperties could hang while checking stylesheets imported by JavaScript modules with many shared dependencies.

  • #​11731 1534885 Thanks @​ematipico! - Fixed #​7984: The fix from useSimplifiedLogicExpression now preserves line breaks in multiline conditions with line comments, preventing the right-hand side condition from being commented out.

  • #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​7304: the HTML formatter now preserves authored segment breaks between CJK characters, and next to CJK punctuation, instead of replacing them with spaces.

     <div lang="zh-Hant-TW">
-  這個段落是那麼長， 在一行寫不行。
+  這個段落是那麼長，
+  在一行寫不行。
 </div>

  • #​11749 ff992a1 Thanks @​ematipico! - Fixed #​11747: formatting and checking large parenthesized object expressions no longer exhibit quadratic slowdowns.

  • #​11736 1dd1fc4 Thanks @​dyc3! - Fixed #​8177: code actions no longer modify the wrong part of Vue, Svelte, or Astro files when experimental full HTML support is disabled.

  • #​11743 3835945 Thanks @​santichausis! - Fixed #​10247: biome check --write/biome lint --write now correctly writes fixes for code inside an HTML attribute expression (for example a Svelte onclick={...} handler, or a mustache expression like {count}), instead of silently reporting the diagnostic as fixable and applying nothing.

    For example, running biome lint --write --unsafe for useBlockStatements (an unsafe fix) on this Svelte component used to leave the file unchanged:

    <button onclick={() => { if (open) close(); }}>Close</button>

  • #​11740 8ea8b4a Thanks @​dyc3! - Fixed #​11453: useConsistentTestIt now updates imports alongside calls, preserving the original export through an alias. The rule ignores locally declared functions and withholds fixes when the preferred name would conflict with another binding or global reference.

  • #​11355 27177ca Thanks @​dyc3! - Fixed the HTML formatter incorrectly applying native HTML element formatting to PascalCase component names such as <Ul> and <Body> in Vue, Svelte, and Astro files.

    -<Body>
-  <div>content</div>
-</Body>
+<Body><div>content</div></Body>

  • #​11355 27177ca Thanks @​dyc3! - Fixed the HTML formatter incorrectly applying SVG block formatting to unknown elements whose names matched SVG element names.

    -<foreignobject>
-  <div>content</div>
-</foreignobject>
+<foreignobject><div>content</div></foreignobject>

  • #​11741 fc69047 Thanks @​dyc3! - Fixed #​8893: useImportExtensions no longer suggests adding .ts to .jsx imports when a colocated .d.ts file provides type declarations.

  • #​11642 c87341c Thanks @​dyc3! - Added the nursery rule useConsistentFunctionStyle, which requires a consistent style for defining functions.

    By default, the rule reports the following declaration because it requires a function expression assigned to a variable:

    function greet() {
    return "Hello";
}

  • #​11770 ddfd622 Thanks @​dyc3! - Fixed #​8980: suppression comments targeting the entire assist category are now respected, including biome-ignore-all assist when running check.

  • #​11792 7a4b895 Thanks @​dyc3! - Fixed dashed utility base names in the Tailwind parser, including border-bs, font-features, and scrollbar-thumb. Classes such as min-inline-[12rem] now preserve the complete base name and parse the arbitrary value separately.

  • #​11739 1fc17e3 Thanks @​Netail! - The rule useIncludes now also reports lastIndexOf() comparisons and some() calls with a strict-equality callback.

    arr.lastIndexOf(x) !== -1

arr.some(item => item === x)

  • #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​6888. GritQL plugins can now use contains on import-clause metavariables such as $clause in import $clause from "module" patterns.

  • #​11790 17d0ff0 Thanks @​ematipico! - Fixed #​11786: useAnchorContent now reports anchors without accessible content in HTML, Astro, Vue, and Svelte even when they have an aria-label, aria-labelledby, or title attribute, matching JSX behavior.

  • #​11651 a9c4aa0 Thanks @​saberoueslati! - Added the new nursery rule noVueUndeclaredDirectives, which reports custom Vue directives that are not declared by a <script setup> binding, the component's directives option, or the rule's globals option. Closes #​11478.

    <template>
  <!-- v-highlight is not declared anywhere -->
  <div v-highlight></div>
</template>

    Aliased named imports in single-file components are now tracked under their local name, so noUndeclaredVariables recognizes vHighlight in import { highlight as vHighlight } from "./directives".

  • #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​7795. The noJsxLiterals rule now ignores surrounding whitespace when matching literals against allowedStrings.

  • #​11780 99c7049 Thanks @​ematipico! - Fixed false positives in useExhaustiveSwitchCases when numeric cases use different spellings of the same value. For example, case 0x1 now covers the numeric literal type 1.

  • #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7880: noUselessStringConcat no longer reports literal concatenations split across multiple lines when a numeric literal ends the chain.

  • #​11355 27177ca Thanks @​dyc3! - Improved performance of the HTML formatter for documents that contain many HTML-native or SVG-native tags.

  • #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7949: useReadonlyClassProperties now reports static class properties that are never reassigned.

  • #​11751 d37f24b Thanks @​ematipico! - Fixed #​7644: useImportExtensions now resolves path aliases declared by referenced TypeScript project configurations.

  • #​11791 f88793c Thanks @​dyc3! - Fixed a false positive in useTailwindShorthandClasses for strings in conditional tests, such as cn(m === "w-2 h-2" ? "bg-red-800" : "bg-red-400").

  • #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7783: noNoninteractiveElementInteractions no longer reports event handlers on native <dialog> elements.

  • #​11733 7030068 Thanks @​dyc3! - Fixed #​11730: useExhaustiveSwitchCases reports missing cases when iterating over a class property with for...of.

  • #​11717 2107dae Thanks @​ternaus! - Fixed #​11716: the noUnknownAttribute rule now accepts fullscreen event handlers, the credentialless iframe property, and the SVG maskType property when the React dependency range allows React 19.3 or later. The credentialless and maskType properties are restricted to <iframe> and <mask> elements, respectively.

  • #​11737 b7e3559 Thanks @​dyc3! - Fixed #​11692: noFloatingPromises now detects unhandled promises returned through generic method signatures, including Playwright fixtures.

  • #​11780 99c7049 Thanks @​ematipico! - Fixed #​7747: useExhaustiveSwitchCases now reports missing cases for literal unions derived from const tuples with (typeof values)[number] and objects with keyof typeof object.

    Other type-aware rules, including noFloatingPromises and noUselessTypeConversion, also recognize supported indexed-access results.

  • #​11724 a9a5e9a Thanks @​dyc3! - Fixed redundant parentheses around binary and

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies label Sep 5, 2026
@renovate
renovate Bot enabled auto-merge (squash) September 5, 2026 06:14
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 15 times, most recently from 9c90a2e to ea96bf1 Compare September 12, 2026 03:09
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch 10 times, most recently from d78fc22 to 25648e2 Compare September 19, 2026 01:48
@renovate
renovate Bot force-pushed the renovate/major-devdependencies branch from 25648e2 to 272b822 Compare September 20, 2026 13:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants