Bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: @bufbuild/protobuf, @node-rs/xxhash, @biomejs/biome and ts-proto.

Updates @bufbuild/protobuf from 2.12.1 to 2.14.1

Release notes

Sourced from @​bufbuild/protobuf's releases.

v2.14.1

What's Changed

This release deprecates configureTextEncoding() from @bufbuild/protobuf/wire. If you run @bufbuild/protobuf in an environment that does not provide the Text Encoding API, please migrate to a polyfill that installs TextEncoder (with the methods encode and optionally encodeInto) and TextDecoder (with the fatal: true constructor argument and the decode method) on globalThis instead. Please see #1517 for the rationale.

• Apply import_extension only to relative import paths by @​timostamm in bufbuild/protobuf-es#1515
• Stop sharing the text encoding implementation via globalThis by @​timostamm in bufbuild/protobuf-es#1517

Full Changelog: bufbuild/protobuf-es@v2.14.0...v2.14.1

v2.14.0

What's Changed

This is a performance release of protobuf-es. We've made substantial improvements to the runtime, while also reducing bundle size by 5%. Here are the results from our benchmarks (compared against v2.13.0):

fixture	toBinary	fromBinary	toJson	fromJson
general	4.66x	1.46x	2.29x	1.67x
scalar	2.91x	1.96x	1.74x	1.64x
repeated-scalar	4.37x	1.53x	3.06x	1.65x
map-scalar	4.43x	1.44x	2.42x	2.28x
repeated-message	5.27x	1.89x	1.71x	1.63x
map-message	5.21x	1.95x	1.81x	1.66x
user-tiny	1.44x	1.99x	1.49x	1.50x
user-normal	5.24x	1.99x	2.33x	2.03x

Individual changes are below:

• Add benchmarks by @​ajeetdsouza in bufbuild/protobuf-es#1474
• Optimize BinaryWriter with a growable buffer by @​jlucaso1 in bufbuild/protobuf-es#1108
• Use Set to check for WKTs by @​ajeetdsouza in bufbuild/protobuf-es#1475
• Cache DataView in BinaryWriter by @​ajeetdsouza in bufbuild/protobuf-es#1483
• Use native String.prototype.isWellFormed() when available by @​ajeetdsouza in bufbuild/protobuf-es#1479
• Drop support for Node.js 20 by @​timostamm in bufbuild/protobuf-es#1488
• Use native toBase64 / fromBase64 when available by @​ajeetdsouza in bufbuild/protobuf-es#1477
• Avoid allocations in varint64 by @​ajeetdsouza in bufbuild/protobuf-es#1498
• Compile descriptors to closure trees by @​ajeetdsouza in bufbuild/protobuf-es#1491
• Reserve bytes for lenPrefix in strings / fork-join by @​ajeetdsouza in bufbuild/protobuf-es#1490
• Fix byte size estimate in base64 fallback by @​ajeetdsouza in bufbuild/protobuf-es#1504
• Define descriptor toString instead of assigning it by @​ltrouton in bufbuild/protobuf-es#1507
• Use setFromBase64 instead of fromBase64 by @​ajeetdsouza in bufbuild/protobuf-es#1508
• Compile and cache create() function by @​ajeetdsouza in bufbuild/protobuf-es#1499
• Add ASCII fast paths by @​ajeetdsouza in bufbuild/protobuf-es#1509

... (truncated)

Commits

• 09c98f1 Release 2.14.1 (#1518)
• a24d613 Stop sharing the text encoding implementation via globalThis (#1517)
• 04297e7 Release v2.14.0 (#1514)
• 8c0b7e0 Add ASCII fast paths (#1509)
• 2455a10 Compile and cache create() function (#1499)
• 7b528c2 Use setFromBase64 instead of fromBase64 (#1508)
• e9adad5 Define descriptor toString instead of assigning it (#1507)
• 9466211 Fix byte size estimate in base64 fallback (#1504)
• 7e3e019 Reserve bytes for lenPrefix in strings / fork-join (#1490)
• 23a2f6f Compile descriptors to closure trees (#1491)
• Additional commits viewable in compare view

Updates @node-rs/xxhash from 1.7.6 to 1.7.7

Commits

• 3b28965 chore(release): publish
• 64b9227 chore(deps): lock file maintenance (#1182)
• b0ea4a0 perf(argon2): simdutf8, crate PHC decode, argon2-rust 1.1 (#1189)
• 2b8b617 feat(argon2): switch backend to argon2-rust (#1188)
• 05156db chore(deps): update rust crate jsonwebtoken to v11 (#1177)
• 1933745 chore: upgrade all npm deps (#1187)
• 317e00e chore(deps): update cross-platform-actions/action action to v1.4.0 (#1185)
• 284ee70 chore(deps): update dependency oxfmt to ^0.63.0 (#1186)
• 54d5564 chore(deps): update dependency oxfmt to ^0.62.0 (#1183)
• 23aad38 chore(deps): update yarn to v4.18.0 (#1180)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​node-rs/xxhash since your current version.

Updates @biomejs/biome from 2.5.2 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• Additional commits viewable in compare view

Updates ts-proto from 2.12.0 to 2.12.1

Release notes

Sourced from ts-proto's releases.

v2.12.1

2.12.1 (2026-08-20)

Bug Fixes

• avoid prototype pollution in generated toJSON for proto json… (#1268) (d0ac4c4)
• avoid prototype pollution when decoding JSON maps (#1267) (2b387b7)
• bound recursion depth in generated message decode (#1269) (18071eb)
• escape proto2 string field defaults in generated code (#1270) (bd34278)

Changelog

Sourced from ts-proto's changelog.

2.12.1 (2026-08-20)

Bug Fixes

• avoid prototype pollution in generated toJSON for proto json… (#1268) (d0ac4c4)
• avoid prototype pollution when decoding JSON maps (#1267) (2b387b7)
• bound recursion depth in generated message decode (#1269) (18071eb)
• escape proto2 string field defaults in generated code (#1270) (bd34278)

Commits

• 83838df chore(release): 2.12.1 [skip ci]
• d0ac4c4 fix: avoid prototype pollution in generated toJSON for proto json… (#1268)
• 18071eb fix: bound recursion depth in generated message decode (#1269)
• bd34278 fix: escape proto2 string field defaults in generated code (#1270)
• 2b387b7 fix: avoid prototype pollution when decoding JSON maps (#1267)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.