Skip to content

chore(deps): update npm minor/patch () - #653

Merged
scttbnsn merged 1 commit into
dev/v1.6from
renovate/npm-minor-patch
Aug 4, 2026
Merged

chore(deps): update npm minor/patch ()#653
scttbnsn merged 1 commit into
dev/v1.6from
renovate/npm-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.5.52.5.6 age confidence
postcss (source) 8.5.238.5.25 age confidence
vite (source) 8.1.58.2.0 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.6

Compare Source

Patch Changes
  • #​11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

  • #​11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

     .example {
       value: outer(
         1,
         /* comment */
         nested(
    -      first,
    -      second
    -    )
    +        first,
    +        second
    +      )
       );
     }
  • #​11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #​9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

  • #​10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #​10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

  • #​11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #​11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

  • #​10533 5809875 Thanks @​Mokto! - Fixed #​10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

  • #​11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@&#8203;const ...} or {@&#8203;debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

  • #​10858 6d18204 Thanks @​ruidosujeira! - Fixed #​10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

  • #​11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

    The following statements are now reported:

    type AsyncCallback = () => Promise<void>;
    declare const callback: AsyncCallback;
    callback();
    
    [1, 2, 3].map(async (value) => value);
  • #​10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

    function unresolvedReturnType(): MissingType {
      return "value" as const;
    }
  • #​11071 15047a2 Thanks @​dyc3! - The HTML parser now accepts mixed-case doctype declarations.

  • #​11030 cc90e65 Thanks @​marschattha! - The rdjson reporter now populates the severity field of each diagnostic (ERROR, WARNING, or INFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.

  • #​11009 2c36626 Thanks @​ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.

  • #​11056 903b177 Thanks @​dyc3! - Added support for Svelte declaration tags using let and const. Biome can now parse, format, and lint bindings declared in these tags.

  • #​11045 89c27c6 Thanks @​ematipico! - Improved the performance of Biome formatter up to ~7% across the board.

  • #​9806 781d68d Thanks @​dyc3! - Added the nursery rule noJsRestrictedProperties, which ports ESLint's no-restricted-properties rule. Biome now flags restricted member access and object destructuring, and biome migrate eslint preserves the rule's options.

postcss/postcss (postcss)

v8.5.25

Compare Source

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

v8.5.24

Compare Source

  • Preserve the BOM after the processing (by @​hdimer).
vitejs/vite (vite)

v8.2.0

Compare Source

Features
Bug Fixes
  • bundledDev: print build errors to the terminal when an HMR update fails (#​23024) (41c4658)
  • deps: update all non-major dependencies (#​23069) (4c07b74)
  • hmr: preserve environment snapshot during server restart (#​22992) (b1186c3)
  • importAnalysis: interop imports injected into optimized dep files by plugins (#​23029) (8c2a87d)
  • module-runner: keep stack trace interception working when Object.prototype is frozen (#​23073) (599c5b0)
  • server: strip base in indexHtml module graph lookup (#​22932) (fa005d1)
  • support resolving top-level input option with plugins (#​23101) (41df81a)
Documentation
Tests

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel

vercel Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
drydock-website Ready Ready Preview Aug 3, 2026 4:43am
drydockdemo-website Ready Ready Preview Aug 3, 2026 4:43am

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
@scttbnsn
scttbnsn merged commit 91951fb into dev/v1.6 Aug 4, 2026
25 checks passed
@scttbnsn
scttbnsn deleted the renovate/npm-minor-patch branch August 4, 2026 18:34
scttbnsn added a commit that referenced this pull request Aug 4, 2026
## Summary

rc.12 release prep: renames `[Unreleased]` to `[1.6.0-rc.12] —
2026-08-04` and rolls the release identity forward across README (badge
+ highlights), site config/content, quickstart tag matrix, demo mocks,
API docs, the updates highlights page, and the identity/changelog-link
tests. Adds the routine dependency-maintenance rollup (#653, #654, #655,
#656, #664) and the Crowdin sync note (#665) to the changelog entry.

Version files stay at `1.6.0` (base version, set at rc.1 — the
release-cut workflow validates base version, full-tag changelog
heading).

## rc.12 contents

- 🔒 #659 security pins: brace-expansion 5.0.9 (app/ui/e2e), ip-address
10.3.1 (app runtime), fast-uri 4.1.2 (app/ui)
- 🐛 #604 maturity badge/gate threshold agreement + surfaced publish-date
auth failures
- 🐛 #605 agent-mismatch grace during component (re)registration (display
only, admission fail-closed)
- 🐛 #636 WS log streams accept anonymous-auth sessions
- 🐛 #637 explicit 501 for agent containers without controller lifecycle
transport

After merge: dev→main wholesale-tree sync, then dispatch
`release-cut.yml --ref main -f release_tag=v1.6.0-rc.12`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Changelog

🔧 **Changed**
- Updated release identity from `1.6.0-rc.11` to `1.6.0-rc.12` across
documentation, site content, quickstart materials, API examples, demo
mocks, and tests.
- Added `v1.6.0-rc.12` release highlights dated August 4, 2026.
- Updated changelog links and release metadata expectations.
- Kept version files at `1.6.0`.

🔒 **Security**
- Added security dependency updates for `#653`, `#654`, `#655`, `#656`,
and `#664`.
- Added the Crowdin synchronization note for `#665`.
- Documented security dependency pins from `#659`.

✨ **Added**
- Maturity badge and publish-date authentication updates from `#604`.
- Agent-mismatch grace during component registration from `#605`.
- Anonymous authentication support for WebSocket log streams from
`#636`.
- Explicit `501` responses when agent containers lack controller
lifecycle transport from `#637`.

## Concerns

- Verify all `1.6.0-rc.11` references are intentionally replaced or
retained.
- Verify the August 4, 2026 release date matches the release workflow.
- Run changelog and release-identity tests after the updates.
- Confirm the planned `dev` to `main` sync and release-cut workflow
occur after merge.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
scttbnsn added a commit that referenced this pull request Aug 5, 2026
Wholesale-tree sync ahead of the v1.6.0-rc.12 cut: the head commit's
tree is `origin/dev/v1.6`'s tree verbatim (`630c64ec`), parented on
main's current head (`67f23419`). Squash-merging makes main
tree-identical to `dev/v1.6`, satisfying the release-cut drift guard
(`git diff --quiet origin/main origin/dev/v1.6`).

Brings in since rc.11: #659 security pins, #662/#660/#661/#663 runtime
fixes (#636/#604/#605/#637), #664 guard floor, #653#656 deps, #665
Crowdin, #666 rc.12 prep.

After merge: dispatch `release-cut.yml --ref main -f
release_tag=v1.6.0-rc.12`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Changelog

- 🔒 Updated dependency security pins and security-version tests.
- ✨ Added anonymous-authenticated WebSocket log streams with IP-based
rate limits.
- ✨ Added agent component-registration state tracking.
- 🔧 Downgraded selected update blockers during agent registration.
- 🔧 Added controller-Docker transport detection.
- 🐛 Added HTTP `501` responses for unsupported agent lifecycle actions.
- 🐛 Fixed maturity filtering to use per-container thresholds.
- 🐛 Changed Docker publish-date lookup failures to warning logs.
- 🔧 Updated dependency versions, release metadata, documentation, mocks,
and changelog links from `v1.6.0-rc.11` to `v1.6.0-rc.12`.
- ✨ Added release highlights for `v1.6.0-rc.12`.

## Concerns

- Fix the French `containerLogs.stderr` value if `"sdterr"` is not
intentional.
- Verify the release date `August 4, 2026`.
- Dispatch the release-cut workflow for `main` with
`release_tag=v1.6.0-rc.12` after merging.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant