Skip to content

Bump @biomejs/biome from 2.5.5 to 2.5.15 - #8722

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/biomejs/biome-2.5.15
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/biomejs/biome-2.5.15

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 3, 2026

Copy link
Copy Markdown
Contributor

Bumps @biomejs/biome from 2.5.5 to 2.5.15.

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
      return items;
    }
  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
      export let name;
    </script>
  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
      "linter": {
        "rules": {
          "nursery": {
            "useLogicalProperties": {
              "level": "warn",
              "options": {
                "direction": "rtl"
              }
            }
          }
        }
      }
    }
  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
      return items;
    }
  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
      export let name;
    </script>
  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
      "linter": {
        "rules": {
          "nursery": {
            "useLogicalProperties": {
              "level": "warn",
              "options": {
                "direction": "rtl"
              }
            }
          }
        }
      }
    }
  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";
  • #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) from 2.5.5 to 2.5.15.
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 3, 2026
@pkg-pr-new

pkg-pr-new Bot commented Oct 3, 2026

Copy link
Copy Markdown

Open in StackBlitz

rescript

npm i https://pkg.pr.new/rescript@8722

@rescript/belt

npm i https://pkg.pr.new/@rescript/belt@8722

@rescript/darwin-arm64

npm i https://pkg.pr.new/@rescript/darwin-arm64@8722

@rescript/darwin-x64

npm i https://pkg.pr.new/@rescript/darwin-x64@8722

@rescript/linux-arm64

npm i https://pkg.pr.new/@rescript/linux-arm64@8722

@rescript/linux-x64

npm i https://pkg.pr.new/@rescript/linux-x64@8722

@rescript/runtime

npm i https://pkg.pr.new/@rescript/runtime@8722

@rescript/win32-x64

npm i https://pkg.pr.new/@rescript/win32-x64@8722

commit: c640e04

@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown

cknitt added a commit that referenced this pull request Oct 18, 2026
* Bump actions/setup-node from 6 to 7

Moves the changelog workflow and the shared setup-node composite action to
actions/setup-node v7, the version the other workflows already use. v7
migrates the action to ESM and adds cache key outputs; its inputs are
unchanged. Dependabot does not scan composite actions under .github/actions,
so its PR (#8887) missed the composite action.

Area: ci
Output: unchanged
Tests: none, because CI runs both changed steps on this PR
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump @biomejs/biome from 2.5.5 to 2.5.15

Upgrades Biome, runs `biome migrate` (schema URL in biome.json), and moves
the dev playground's pane separator hover and resize rules below the
row-layout rules. Biome 2.5.15 reports noDescendingSpecificity for the old
order. The two rule groups set disjoint properties, so the cascade result is
the same. Supersedes Dependabot PR #8722.

Area: scripts playground
Output: unchanged
Tests: none, because `yarn check:all` is the check, and it reports no
 diagnostics with 2.5.15
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump rollup from 4.62.2 to 4.64.9

Refreshes the lockfile within the playground's existing `^4.32.0` range.
Dependabot PR #8721 proposed 4.63.5; 4.64.9 is the current latest.

Review: rollup now has an optional dependency on
@napi-rs/lzma-linux-x64-gnu. It comes from rollup#6467 (merged by the
rollup maintainer, released in 4.62.4), which fixes a glibc regression in
rollup's own native builds, and it is in rollup's package.json at the
4.64.9 tag.

Area: playground
Output: unchanged
Tests: none, because CI builds the playground bundle with rollup
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump source-map-js from 1.2.1 to 1.2.2

Refreshes the lockfile entry that postcss (via vite in the dev playground)
resolves. Supersedes Dependabot PR #8804.

Area: playground
Output: unchanged
Tests: none, because the change is a patch release of a dev-only transitive
 dependency
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump brace-expansion from 2.1.4 to 2.1.7

Refreshes the lockfile entry that minimatch (via mocha) resolves; 2.1.7 is
the newest release in the `^2.0.1` range. Supersedes Dependabot PR #8715.

Area: tests
Output: unchanged
Tests: none, because the mocha suites run in CI
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump js-yaml from 4.3.1 to 4.3.2

Refreshes the lockfile entry that mocha resolves; 4.3.2 is the newest
release in the `^4.1.0` range. Supersedes Dependabot PR #8651.

Area: tests
Output: unchanged
Tests: none, because the mocha suites run in CI
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump @types/semver from 7.7.1 to 7.8.0

Refreshes the lockfile within the root `^7.7.0` range. Supersedes
Dependabot PR #8552.

Area: scripts
Output: unchanged
Tests: none, because `yarn typecheck` passes with the new types
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Deduplicate picomatch in yarn.lock

Runs `yarn dedupe`, which resolves the `^4.0.2` and `^4.0.4` picomatch
ranges (rollup plugin utils, tinyglobby, vite) to the single 4.0.5 entry.
`yarn dedupe --check` now reports nothing to deduplicate.

Area: playground
Output: unchanged
Tests: none, because the change only merges lockfile entries within their
 declared ranges
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Add a changelog fragment for the dependency updates

Area: docs
Output: unchanged
Tests: none, because `yarn changelog:check` validates the fragment
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Bump minimatch from 9.0.5 to 9.0.9

Refreshes the lockfile entry that mocha and glob resolve within `^9.0.4`.
This fixes the open security alert for minimatch below 9.0.7, which no
Dependabot PR covers.

Area: tests
Output: unchanged
Tests: none, because the mocha suites run in CI
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Re-resolve node-gyp from 11.1.0 to 13.1.0

Yarn's built-in fsevents compatibility patch depends on `node-gyp@latest`,
which the lockfile had pinned at 11.1.0. Re-resolving the tag picks 13.1.0,
which drops make-fetch-happen and with it ip-address, sprintf-js, socks and
http-cache-semantics. This clears the open security alerts for those
packages (two of them have no patched release), which no Dependabot PR
covers.

Review: node-gyp only runs when fsevents (optional, macOS only) has to be
compiled from source, as fsevents ships a prebuilt binary. node-gyp 13
declares Node ^22.22.2 || ^24.15.0 || >=26; CI uses the latest Node 22, and
Yarn does not enforce engines of transitive dependencies.

Area: playground
Output: unchanged
Tests: none, because `yarn install --immutable` passes and no build step
 runs node-gyp on Linux
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

* Link the dependency updates changelog fragment to its PR

Area: docs
Output: unchanged
Tests: none, because `yarn changelog:check` validates the fragment
PR: #8890
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014eaBQ3wiTweSGaR2T2uxQX
Signed-off-by: Christoph Knittel <ck@cca.io>

---------

Signed-off-by: Christoph Knittel <ck@cca.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
@cknitt

cknitt commented Oct 20, 2026

Copy link
Copy Markdown
Member

@dependabot close

@cknitt

cknitt commented Oct 24, 2026

Copy link
Copy Markdown
Member

Superseded by #8890: master has @biomejs/biome 2.5.15.

@cknitt cknitt closed this Oct 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/biomejs/biome-2.5.15 branch October 24, 2026 06:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant