chore(deps): update devdependencies (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@actions/cache (source)	^4.0.2 → ^6.0.0
@actions/core (source)	^1.11.1 → ^3.0.0
@actions/exec (source)	^1.1.1 → ^3.0.0
@actions/http-client (source)	2.2.3 → 4.0.1
@actions/io (source)	^1.1.3 → ^3.0.0
@actions/tool-cache (source)	^2.0.2 → ^4.0.0
@babel/core (source)	^7.26.9 → ^8.0.0
@babel/preset-typescript (source)	^7.27.1 → ^8.0.0
@biomejs/biome (source)	^1.9.4 → ^2.0.0
@octokit/openapi-types (source)	^25.0.0 → ^28.0.0
@octokit/plugin-paginate-rest	^13.0.0 → ^15.0.0
@octokit/plugin-rest-endpoint-methods	^16.0.0 → ^18.0.0
@octokit/types	^14.0.0 → ^17.0.0
@pnpm/patching.apply-patch (source)	^1000.0.7 → ^1100.0.0
@types/jest (source)	^29.5.14 → ^30.0.0
@types/node (source)	^22.13.8 → ^26.0.0
admina	^1.0.1 → ^2.0.0
cross-env	7.0.3 → 10.1.0
cspell (source)	^9.0.0 → ^10.0.0
eslint-config-atomic	^1.22.1 → ^2.0.0
jest (source)	^29.7.0 → ^30.0.0
npm-check-updates	^19.3.1 → ^23.0.0
npm-run-all2	^8.0.4 → ^9.0.0
p-timeout	^6.1.4 → ^7.0.0
typescript (source)	^5.8.2 → ^7.0.0
vite (source)	^7.3.1 → ^8.0.0

---

Release Notes

actions/toolkit (@​actions/cache)

v6.2.0

• Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
• Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

• Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

• Bump dependency versions (#​2393):
  • @actions/core to ^3.0.1
  • @actions/http-client to ^4.0.1
  • @actions/io to ^3.0.2
  • @azure/core-rest-pipeline to ^1.23.0
  • @azure/storage-blob to ^12.31.0
  • semver to ^7.7.4

v6.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v5.0.5

• Bump @actions/glob to 0.5.1

v5.0.4

• Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

• Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
• Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2 → whatwg-url@5 → tr46@0.0.3 that used the deprecated punycode module

v5.0.0

• Remove @azure/ms-rest-js dependency #​2197
  • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
• Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
• Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
• Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
• Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
• Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
• Add support for Node.js 24 #​2110
• Add node-fetch override to resolve audit vulnerabilities #​2110

actions/toolkit (@​actions/core)

v3.0.1

• Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

• Bump @actions/http-client to 3.0.2

v2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #​2199

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

actions/toolkit (@​actions/exec)

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/io dependency from ^1.0.1 to ^2.0.0

actions/toolkit (@​actions/http-client)

v4.0.1

• Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

• Bump undici from 5.28.5 to 6.23.0

v3.0.1

• Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

• Add support for Node 24 #​2110

actions/toolkit (@​actions/io)

v3.0.2

• Fix: update lock file version

v3.0.1

• Fix: export @actions/io/lib/io-util

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Ensures consistent behavior for paths on Node 24 with Windows

actions/toolkit (@​actions/tool-cache)

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

3.0.1

• Bump @actions/http-client to 3.0.2

3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

2.0.2

• Update @actions/core to v1.11.1 #​1872
• Remove dependency on uuid package #​1824, #​1842

2.0.1

• Update to v2.0.1 of @actions/http-client #​1087

2.0.0

• Update to v2.0.0 of @actions/http-client
• The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
  This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.

1.7.2

• Update lockfileVersion to v2 in package-lock.json #​1025

1.7.1

• Fallback to os-releases file to get linux version
• Update to latest @​actions/io verison

1.7.0

• Allow arbirtary headers when downloading tools to the tc
• Export isExplicitVersion and evaluateVersions functions
• Force overwrite on default when extracted compressed files

1.6.1

• Update @​actions/core version

1.6.0

• Add extractXar function to extract XAR files

1.3.5

• Check if tool path exists before executing
• Make extract functions quiet by default

1.3.4

• Update the http-client to 1.0.8 which had a security fix

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3

• Update downloadTool to only retry 500s and 408 and 429

1.3.2

• Update downloadTool with better error handling and retries

1.3.1

• Increase http-client min version

1.3.0

• Uses @​actions/http-client

1.2.0

• Overload downloadTool to accept destination path
• Fix extractTar on Windows
• Add "types" to package.json

1.1.2

• Use zip and unzip from PATH
• Support custom flags for extractTar

1.0.0

• Initial release

v3.0.1

• Bump @actions/http-client to 3.0.2

v3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

babel/babel (@​babel/core)

v8.0.1

Compare Source

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #​18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0

Compare Source

👓 Spec Compliance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #​18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #​18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #​18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #​18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #​18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #​18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

biomejs/biome (@​biomejs/biome)

v2.5.9

Compare Source

Patch Changes

• #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #​11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #​11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #​11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #​10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #​11333 715e0cd Thanks @​kkkhs! - Fixed #​11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #​11343 9b98211 Thanks @​johncarmack1984! - Fixed #​11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #​11220 3e8c488 Thanks @​santichausis! - Fixed #​9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>
    export function greet() {
      console.log("Hello!");
    }
  </script>
  
  <script>
    greet();
  </script>

• #​11300 36430eb Thanks @​dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

  - <marquee behavior="alternate"> This text will bounce </marquee>
  + <marquee behavior="alternate">This text will bounce</marquee>

• #​11299 6559e6c Thanks @​jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

  For example, <Component client:only /> triggers the rule.

• #​11365 7529811 Thanks @​MHJahanbakhsh! - Fixed #​11229: The useGenericFontNames rule now treats math as a valid generic font family.

• #​11346 674f5f4 Thanks @​Jayllyz! - Fixed #​11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

  function factory() {
    const useColors = true; // no longer reported
    const useStore = createStore({ count: 0 }); // no longer reported
    const useData = () => useState(null); // still reported
    return useColors;
  }

• #​11334 c87c46a Thanks @​zkasuran! - Fixed #​11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).

• #​11364 13853b1 Thanks @​ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.

• #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

• #​11325 67c3bf0 Thanks @​dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

   <a-long-long-long-element
  -  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
  +  >foo bar foo bar foo bar foo bar foo bar foo
  +  bar</a-long-long-long-element
   >

• #​11367 fe5b5d4 Thanks @​ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.

• #​11316 17e48d6 Thanks @​wanxiankai! - Fixed #​11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.

• #​11254 d25d113 Thanks @​dyc3! - Fixed #​11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.

• #​11221 85aac73 Thanks @​freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.

  const value = input as SomeType;

• #​11314 7ffb677 Thanks @​ematipico! - Fixed #​11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.

• #​11356 6cd3263 Thanks @​johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).

• #​11318 76059e9 Thanks @​johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).

• #​11357 faa2074 Thanks @​johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).

• #​11344 f34e15c Thanks @​johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).

• #​11324 2f5d452 Thanks @​dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.

    <div>
  -   before<meter value=".5"></meter>
  -   after
  +   before<meter value=".5"></meter
  +   >after
    </div>

• #​11312 e65f07e Thanks @​xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.

  <button />

• #​11364 13853b1 Thanks @​ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

• #​11301 610ee28 Thanks @​dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

  - <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
  + <video src="brave.webm">
  +   <track kind="subtitles" src="brave.en.vtt">
  + </video>

v2.5.8

Compare Source

Patch Changes

• #​10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #​11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #​11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #​11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #​11250: useAwait no longer reports async functions that contain an await using declaration.

• #​11143 6be7be1 Thanks @​vznh! - Fixed #​11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #​11234 caefe39 Thanks @​subotac! - Fixed #​11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #​11285 bca1f73 Thanks @​denbezrukov! - Fixed #​11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

• #​11080 af16a0b Thanks @​dyc3! - HTML style attribute values are now parsed as CSS. All Biome CSS lint rules are applied to the style attributes.

• #​11195 6a85588 Thanks @​dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.

  Now the following snippet is correctly parsed:

  <p>{{ a: true }}</p>
  <div class={{ active: isActive }}></div>

• #​11173 481d008 Thanks @​Austin1serb! - Fixed #​10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.

• #​11187 23c0369 Thanks @​ematipico! - Added the nursery rule noInvalidPropertyInitValue, which reports an @property whose initial-value does not match its syntax descriptor. For example, the following declaration triggers the rule because red is not a <length>:

  @property --size {
    syntax: "<length>";
    inherits: false;
    initial-value: red;
  }

• #​11272 73896e6 Thanks @​ematipico! - Improved the diagnostic emitted by noRootType.

• #​11240 bd0b68d Thanks @​ematipico! - Fixed #​11223: Improved the
  performance of noMisusedPromises
  when analyzing async class methods that call other methods through this.

• #​11172 4a0bc5c Thanks @​saberoueslati! - Fixed #​10806: noUselessFragments no longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.

• #​11227 4d603b0 Thanks @​saberoueslati! - Fixed #​11178: noUndeclaredVariables no longer reports Vue's built-in instance properties, such as $slots and $attrs, in template expressions or $event in inline event-handler expressions. The instance properties are still reported inside <script setup>, where they are not defined.

• #​11187 23c0369 Thanks @​ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

v2.5.7

Compare Source

Patch Changes

• #​10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #​11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #​10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #​11184 135f476 Thanks @​subotac! - Fixed #​11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #​8239 a519f9d Thanks @​cormacrelf! - Fixed #​8233, where Biome CLI in
  stdin mode didn't work correctly when handling files in projects with nested
  configurations. For example, with the following structure,
  --stdin-file-path=subdirectory/... would not use the nested configuration in
  subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but
  that path is ignored and therefore not formatted or fixed.

• #​11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

  type Mapper<T> = () => T;
  declare function map<T>(mapper: Mapper<T>): T;
  
  map(() => 42) || flag;

• #​11138 8c2c6bd Thanks @​ematipico! - Fixed #​11087: noUnnecessaryConditions no longer reports optional chains and nullish coalescing whose receiver can be nullish.

  For example, the optional chain and fallback in the following code are no longer reported:

  declare const usage: { range: { startDate: string } } | null;
  const startDate = usage?.range.startDate ?? "N/A";

• #​11118 9c16840 Thanks @​subotac! - Fixed #​11098: The HTML formatter now preserves the configured trailing newline when a file ends with a comment.

  -<!-- trailing comment -->
  \ No newline at end of file
  +<!-- trailing comment -->

• #​11201 0e80610 Thanks @​Bishwas-py! - Fixed #​11182: suppression comments for noPositiveTabindex now suppress the rule in HTML files when the attributes of the element span multiple lines.

• #​11079 607afd2 Thanks @​dyc3! - The HTML formatter now lays out the srcset attribute of <img> and <source> as the list of candidates it is. Runs of whitespace between candidates collapse, and once the list no longer fits on one line each candidate goes on its own line with the descriptors aligned:

  - <img srcset="/visual@0.5.png  400w, /visual.png 805w, /visual@2x.png 1610w, /visual@3x.png 2415w" />
  + <img
  +   srcset="
  +     /visual@0.5.png  400w,
  +     /visual.png      805w,
  +     /visual@2x.png  1610w,
  +     /visual@3x.png  2415w
  +   "
  + />

• #​11156 fed72c7 Thanks @​saberoueslati! - Fixed #​11129: noUnusedVariables no longer reports Vue bindings as unused when they are assigned through automatically unwrapped template refs.

• #​11124 d890b39 Thanks @​denbezrukov! - Fixed CSS formatting of line comments between a declaration colon and value to preserve their source indentation.

   .test {
     background:
  -  /////// foo
  -  // bar
  +        /////// foo
  +        // bar
       radial-gradient(circle, #​000, transparent);
   }

• [#​11113](https://redirect.github.com/biomejs/biome/pul

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.