Update dependencies (supersedes Dependabot PRs)

.github/actions/setup-node/action.yml

@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
     - name: Use Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v7
       with:
         cache: yarn
         node-version-file: .nvmrc

.github/workflows/changelog.yml

@@ -25,7 +25,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - run: node --test scripts/changelog.test.js

.yarnrc.yml

@@ -1,7 +1,14 @@
+approvedGitRepositories:
+  - "**"
+
 defaultSemverRangePrefix: ""
 
+enableScripts: true
+
 nmMode: hardlinks-global
 
 nodeLinker: node-modules
 
-yarnPath: .yarn/releases/yarn-4.12.0.cjs
+npmMinimalAgeGate: 0
+
+yarnPath: .yarn/releases/yarn-4.18.1.cjs

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.5/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",

changes/dependency-updates.internal.md

@@ -0,0 +1 @@
+- Update Yarn to 4.18.1, mocha to 12, Biome to 2.5.15, actions/setup-node to v7 and other development dependencies, resolving all open Dependabot security alerts. https://github.com/rescript-lang/rescript/pull/8890

package.json

@@ -95,11 +95,11 @@
     "@rescript/win32-x64": "workspace:packages/@rescript/win32-x64"
   },
   "devDependencies": {
-    "@biomejs/biome": "2.5.5",
+    "@biomejs/biome": "2.5.15",
     "@types/node": "^26.1.1",
     "@types/semver": "^7.7.0",
     "@yarnpkg/types": "^4.0.1",
-    "mocha": "11.7.6",
+    "mocha": "12.0.3",
     "semver": "^7.7.2",
     "typescript": "6.0.3"
   },
@@ -117,6 +117,6 @@
     "tests/commonjs_tests",
     "scripts/res"
   ],
-  "packageManager": "yarn@4.12.0",
+  "packageManager": "yarn@4.18.1",
   "preferUnplugged": true
 }

packages/dev-playground/package.json

@@ -16,8 +16,8 @@
   },
   "dependencies": {
     "@jridgewell/trace-mapping": "^0.3.31",
-    "@rescript/runtime": "12.3.0",
-    "rescript": "12.3.0",
+    "@rescript/runtime": "12.3.1",
+    "rescript": "12.3.1",
     "vite": "^8.0.14",
     "xote": "7.1.0"
   }

packages/dev-playground/src/styles.css

@@ -177,20 +177,6 @@ button {
     box-shadow 120ms ease;
 }
 
-.pane-separator:hover,
-.pane-separator:focus-visible,
-.workspace.is-resizing .pane-separator {
-  background: rgba(230, 72, 79, 0.14);
-}
-
-.pane-separator:hover::before,
-.pane-separator:focus-visible::before,
-.workspace.is-resizing .pane-separator::before {
-  background: var(--fire);
-  opacity: 0.9;
-  box-shadow: 0 0 8px rgba(230, 72, 79, 0.42);
-}
-
 .workspace.is-resizing {
   user-select: none;
 }
@@ -222,6 +208,20 @@ button {
   inset: 3px 0;
 }
 
+.pane-separator:hover,
+.pane-separator:focus-visible,
+.workspace.is-resizing .pane-separator {
+  background: rgba(230, 72, 79, 0.14);
+}
+
+.pane-separator:hover::before,
+.pane-separator:focus-visible::before,
+.workspace.is-resizing .pane-separator::before {
+  background: var(--fire);
+  opacity: 0.9;
+  box-shadow: 0 0 8px rgba(230, 72, 79, 0.42);
+}
+
 .column-header {
   min-height: 48px;
   display: flex;

packages/playground/package.json

@@ -16,7 +16,7 @@
   },
   "devDependencies": {
     "@rollup/plugin-node-resolve": "^16.0.0",
-    "h3": "2.0.1-rc.26",
+    "h3": "2.0.5",
     "rollup": "^4.32.0"
   }
 }

rewatch/testrepo/yarn.lock

@@ -2,7 +2,7 @@
 # Manual changes might be lost - proceed with caution!
 
 __metadata:
-  version: 8
+  version: 10
   cacheKey: 10c0
 
 "@rescript/belt@portal:../../packages/@rescript/belt::locator=testrepo%40workspace%3A.":

tests/belt_tests/package.json

@@ -4,7 +4,7 @@
   "type": "module",
   "dependencies": {
     "@rescript/belt": "workspace:^",
-    "mocha": "11.7.6",
+    "mocha": "12.0.3",
     "rescript": "workspace:^"
   }
 }

tests/tests/package.json

@@ -2,7 +2,7 @@
   "name": "rescript-tests",
   "private": true,
   "dependencies": {
-    "@babel/code-frame": "^7.29.7",
+    "@babel/code-frame": "^8.0.6",
     "@rescript/react": "workspace:^",
     "rescript": "workspace:^"
   },