build(deps-dev): bump the npm-tooling group with 3 updates

[dependabot]

Bumps the npm-tooling group with 3 updates: @biomejs/biome, @types/node and webpack.

Updates @biomejs/biome from 2.5.0 to 2.5.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

• #10757 6232fcd Thanks @​PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

... (truncated)

Commits

• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• ffe7d33 chore: revert
• 564d660 chore: revert
• 0abf1a5 ci: release (#10627)
• 23814f1 chore(biome_configuration): add allowTrailingCommas to json-schema to make VS...
• a0f197e chore: dead and old links (#10668)
• See full diff in compare view

Updates @types/node from 26.0.0 to 26.1.0

Commits

• See full diff in compare view

Updates webpack from 5.107.2 to 5.108.4

Release notes

Sourced from webpack's releases.

v5.108.4

Patch Changes

• Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @​alexander-akait in #21324)

• Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @​alexander-akait in #21324)

• Resolve HTML asset URLs against the document <base href>. (by @​alexander-akait in #21329)

• Add HTML integration tests: generateError output, ignored src, null-char parse. (by @​aryanraj45 in #21328)

• Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @​alexander-akait in #21332)

• Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @​alexander-akait in #21323)

• Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @​alexander-akait in #21331)

• Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @​hai-x in #21326)

• Default output.globalObject to globalThis for universal targets. (by @​alexander-akait in #21314)

• Pass through new URL(...) directory references instead of resolving them. (by @​alexander-akait in #21312)

v5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

v5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

v5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

v5.108.0

Minor Changes

• Treat top-level await and import.meta as ES module markers, matching Node.js syntax detection so no explicit module type is needed. (by @​alexander-akait in #21218)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.108.4

Patch Changes

• Speed up non-CSS-Modules parsing by not building unused selector AST nodes. (by @​alexander-akait in #21324)

• Speed up non-CSS-Modules CSS parsing by dropping value tokens nothing reads. (by @​alexander-akait in #21324)

• Resolve HTML asset URLs against the document <base href>. (by @​alexander-akait in #21329)

• Add HTML integration tests: generateError output, ignored src, null-char parse. (by @​aryanraj45 in #21328)

• Reduce CPU and memory overhead of HTML and CSS parsing and code generation. (by @​alexander-akait in #21332)

• Reduce HTML parser memory and CPU by skipping unused AST nodes. (by @​alexander-akait in #21323)

• Reduce HTML parser memory by storing the AST in struct-of-arrays form. (by @​alexander-akait in #21331)

• Key the provided-exports cache on a lazy barrel's still-lazy re-export targets. (by @​hai-x in #21326)

• Default output.globalObject to globalThis for universal targets. (by @​alexander-akait in #21314)

• Pass through new URL(...) directory references instead of resolving them. (by @​alexander-akait in #21312)

5.108.3

Patch Changes

• Speed up CSS parsing and reduce CSS AST node memory. (by @​alexander-akait in #21285)

• Fix HMR codegen crash for harmony accept with unresolved imports. (by @​xiaoxiaojx in #21302)

• Match harmony accept dependencies by module reference so HMR codegen handles imports without a module or chunk id. (by @​alexander-akait in #21303)

5.108.2

Patch Changes

• Fix lazy barrel deferral of ungrouped side-effect imports. (by @​hai-x in #21291)

• Respect the node: prefix for node.js core modules used as externals. (by @​alexander-akait in #21286)

5.108.1

Patch Changes

• Fix invalid property access for escaped namespace imports with multi-character mangled export names. (by @​xiaoxiaojx in #21280)

• Add frames to ProfilingPlugin TracingStartedInBrowser event so the trace loads in Chrome DevTools. (by @​alexander-akait in #21269)

... (truncated)

Commits

• bb9ccfd chore(release): new release (#21319)
• 7639066 fix: invalidate provided-exports cache with lazy barrel (#21326)
• ae28c54 perf: reduce CPU and memory overhead of the HTML and CSS pipelines (#21332)
• e6fb547 perf: re-encode the HTML AST as struct-of-arrays behind a path-based visitor ...
• 5ce1c22 fix(html): resolve asset URLs against <base href> (#21329)
• 0e43c4a test(html): cover generateError, ignored-source, and null-character parse pat...
• cebd793 refactor: build export-presence guards from a lazy boolean formula (#21320)
• c2628cf fix: don't resolve new URL() directory references as modules (#21312)
• 00d8b2f perf: speed up non-CSS-Modules CSS parsing by skipping unused AST work (#21324)
• f7a3f6d perf: reduce HTML parser memory and CPU with parser-level skip options (#21323)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions