build(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the dev-dependencies group with 8 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.2	2.5.15
@semantic-release/changelog	6.0.3	7.0.0
@semantic-release/git	10.0.1	11.0.1
@types/node	26.1.0	26.6.4
semantic-release	25.0.5	25.0.9
typescript	6.0.3	7.0.2
vitest	4.1.10	5.0.3
yaml	2.9.0	2.9.1

Updates @biomejs/biome from 2.5.2 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @semantic-release/changelog from 6.0.3 to 7.0.0

Release notes

Sourced from @​semantic-release/changelog's releases.

v7.0.0

7.0.0 (2026-07-21)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

• Replaced xo with prettier with default configuration; following newly established convention
• Replaced nyc with c8 for code coverage
• Replaced lodash with lodash-es for proper esm support

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

v7.0.0-beta.1

7.0.0-beta.1 (2026-04-23)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b1044e1 chore(ci): update Node.js version requirements and test matrix configurations
• 0563e5d chore(deps): update to the latest semantic-release version (#417)
• e154214 feat: ES Module (#414)
• 15e48e4 chore(deps): update dependency sinon to v18.0.1 (#400)
• 1c48000 test: remove codecov (#399)
• 3be34e3 ci(action): update actions/setup-node action to v4.0.3 (#395)
• 854ffb6 ci(action): update actions/checkout action to v4.1.7 (#393)
• e7c79f8 chore(deps): update dependency nyc to v17 (#392)
• 171adfb ci(action): update actions/checkout action to v4.1.6 (#390)
• 13e3bf7 chore(deps): update dependency sinon to v18 (#389)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/changelog since your current version.

Updates @semantic-release/git from 10.0.1 to 11.0.1

Release notes

Sourced from @​semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

• deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

• ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

• update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

• ES Module (#526) (e523946), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b39d5c6 fix(deps): update dependency execa to v10 (#564)
• 9dd61f1 chore(deps): lock file maintenance (#470)
• c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
• b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
• d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
• 16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
• 8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
• e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
• 4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
• 7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/git since your current version.

Updates @types/node from 26.1.0 to 26.6.4

Commits

• See full diff in compare view

Updates semantic-release from 25.0.5 to 25.0.9

Release notes

Sourced from semantic-release's releases.

v25.0.9

25.0.9 (2026-08-05)

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#4283) (8d905a5)

v25.0.8

25.0.8 (2026-07-18)

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

25.0.7 (2026-07-13)

Bug Fixes

• argument Injection via repositoryUrl in package.json (#4245) (c46dbda)

v25.0.6

25.0.6 (2026-07-10)

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

Commits

• 8d905a5 fix: do not expose the authenticated repository URL in EGITNOPERMISSION error...
• e176eb7 ci(action): update github/codeql-action action to v4.37.6 (#4282)
• d27db1b chore(deps): update dependency js-yaml to v4.3.1 (#4279)
• 55beeac ci(action): update github/codeql-action action to v4.37.5 (#4277)
• 7bf348d chore(deps): update dependency nock to v14.0.17 (#4275)
• 2ec3ba2 chore(deps): update dependency mockserver-client to v7.5.0 (#4274)
• d3b7724 chore(deps): update npm to v12.0.2 (#4273)
• 514dc5f chore(deps): update dependency npm-run-all2 to v9.0.3 (#4271)
• f25b716 ci(action): update github/codeql-action action to v4.37.4 (#4270)
• 1114416 chore: remove 'next version' badge from README (#4265)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.10 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in vitest-dev/vitest#11343 (0b792)
• detect-async-leaks:
  • Ignore process.stdio handles  -  by @​AriPerkkio in vitest-dev/vitest#11333 (0fd6b)
• expect:
  • Fix toMatchObject with asymmetric matchers  -  by @​ShreeBohara, Claude Opus 5, @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)
• jsdom:
  • Fix Request with Blob body on jsdom 28+  -  by @​harshit-d3v in vitest-dev/vitest#11295 (d1c3e)
• reporter:
  • agent to respect --silent  -  by @​Raj4478 and @​AriPerkkio in vitest-dev/vitest#11271 (5b95e)
• reporters:
  • Handle concurrent createReport calls  -  by @​7rulnik in vitest-dev/vitest#11278 (e8e55)
  • hanging-process to use ESM entrypoint  -  by @​AriPerkkio in vitest-dev/vitest#11316 (4e91e)
• spy:
  • Fix stack overflow when spying Set.prototype.add  -  by @​fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

• 33cadea chore: release v5.0.3 (#11409)
• 346d389 fix(vm): don't reuse scripts across vite environments (#11395)
• f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
• 062c75d chore: fix standalone docs build, update exports maps (#11394)
• caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
• 50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
• 7c36748 fix(browser): ignore page crash while cancelling (#11386)
• 92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
• 38f9885 fix(cache): revalidate imports of cached modules (#11381)
• b24585f fix: don't retry when test.fails expectedly failed (#11219)
• Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

Commits

• 1440ecd 2.9.1
• c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
• d11ce77 fix: Limit recursive merge aliases (#713)
• c5f49f4 chore: Update docs-slate
• See full diff in compare view