ci: bump the development-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the development-dependencies group with 5 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.11	2.5.13
@opentelemetry/exporter-metrics-otlp-grpc	0.221.0	0.222.0
@opentelemetry/exporter-trace-otlp-grpc	0.221.0	0.222.0
@opentelemetry/context-async-hooks	2.10.0	2.11.0
vite	8.2.2	8.3.0

Updates @biomejs/biome from 2.5.11 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Updates @opentelemetry/exporter-metrics-otlp-grpc from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/exporter-metrics-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

• fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
• fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
• fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
• fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

  • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

    Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

• feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @​pichlermarc

🐛 Bug Fixes

• fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
• fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

• docs(sdk-logs): mark logger configuration as experimental #6996 @​LarryHu0217
• docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @​vedantchalke36

🏠 Internal

• refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna

Commits

• 0b72a81 chore: prepare next release (#7044)
• a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
• f41805e chore: prepare next release (#7042)
• b85eb28 chore(instrumentation-http): fix lint errors (#7039)
• 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
• 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
• e086dec Merge commit from fork
• 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
• d0ce753 chore: add @​maryliag to maintainers (#7024)
• 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
• Additional commits viewable in compare view

Updates @opentelemetry/exporter-trace-otlp-grpc from 0.221.0 to 0.222.0

Release notes

Sourced from @​opentelemetry/exporter-trace-otlp-grpc's releases.

experimental/v0.222.0

0.222.0

💥 Breaking Changes

• fix(sdk-node)!: fail-fast on Propagator creation from config file #6930 @​trentm
• fix(sdk-node)!: fail-fast on MeterProvider creation from config file #6954 @​trentm
• fix(sdk-node)!: fail-fast on TracerProvider creation from config file #6962 @​trentm
• fix(sdk-node)!: fail-fast on Resource creation from config file #6989 @​trentm

  • This also breaks some usage of startNodeSDK() for environment-based config, i.e. when not using a config file. For example with OTEL_NODE_RESOURCE_DETECTORS=all, it results in an error message and a no-op SDK. (This does not impact users of new NodeSDK() -- the currently recommended mechanism to start an SDK using this package.)

    Could not create OpenTelemetry SDK from configuration, SDK will not be setup: unknown ExperimentalResourceDetector name in configuration: "container"

🚀 Features

• feat(sdk-logs): deprecate SdkLogRecord in favor of ReadWriteLogRecord #6939 @​pichlermarc

🐛 Bug Fixes

• fix(instrumentation-http): redact sensitive query parameters on incoming (server) spans; add redactedQueryParamsServer config option @​dyladan
• fix(sdk-node): support headers_list when creating OTLP exporters from declarative configuration #6953 @​JacksonWeber

📚 Documentation

• docs(sdk-logs): mark logger configuration as experimental #6996 @​LarryHu0217
• docs(configuration): document the ConfigModel suffix naming convention for exported types #6612 @​vedantchalke36

🏠 Internal

• refactor(sampler-jaeger-remote): remove axios dependency and use fetch to get the sampler configuration from Jaeger API #6963 @​david-luna

Commits

• 0b72a81 chore: prepare next release (#7044)
• a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
• f41805e chore: prepare next release (#7042)
• b85eb28 chore(instrumentation-http): fix lint errors (#7039)
• 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
• 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
• e086dec Merge commit from fork
• 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
• d0ce753 chore: add @​maryliag to maintainers (#7024)
• 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
• Additional commits viewable in compare view

Updates @opentelemetry/context-async-hooks from 2.10.0 to 2.11.0

Release notes

Sourced from @​opentelemetry/context-async-hooks's releases.

v2.11.0

2.11.0

🚀 Features

• feat(context-async-hooks): implement attach() on AsyncLocalStorageContextManager #6845 @​pichlermarc
  • On Node.js 25.9+, delegates to AsyncLocalStorage.withScope() returning a native RunScope. On older Node.js, falls back to enterWith() with a manual disposable wrapper.
• feat(sdk-trace): allow configuring the force flush timeout per call #6929 @​LarryHu0217

🐛 Bug Fixes

• fix(sdk-metrics): ignore Infinity in exponential histograms #7015 @​mwear

🏠 Internal

• perf(sdk-metrics): reuse a single DataView for exponential histogram bit reads #6998 @​mwear
• chore(ci): run documentation tests on a weekly schedule #6920 @​LarryHu0217
• feat(ci): support pre-releases and major version bumps in the release workflow #6768 @​pichlermarc
• chore(resources): Ensure that multiple uses of serviceInstanceIdDetector.detect() return the same value for service.instance.id

Changelog

Sourced from @​opentelemetry/context-async-hooks's changelog.

2.11.0

🚀 Features

• feat(context-async-hooks): implement attach() on AsyncLocalStorageContextManager #6845 @​pichlermarc
  • On Node.js 25.9+, delegates to AsyncLocalStorage.withScope() returning a native RunScope. On older Node.js, falls back to enterWith() with a manual disposable wrapper.
• feat(sdk-trace): allow configuring the force flush timeout per call #6929 @​LarryHu0217

🐛 Bug Fixes

• fix(sdk-trace-base): avoid a Webpack self-reference error in CommonJS output #6981 @​sansynx
• fix(sdk-metrics): ignore Infinity in exponential histograms #7015 @​mwear

🏠 Internal

• perf(sdk-metrics): reuse a single DataView for exponential histogram bit reads #6998 @​mwear
• chore(ci): run documentation tests on a weekly schedule #6920 @​LarryHu0217
• feat(ci): support pre-releases and major version bumps in the release workflow #6768 @​pichlermarc
• chore(resources): Ensure that multiple uses of serviceInstanceIdDetector.detect() return the same value for service.instance.id

Commits

• 0b72a81 chore: prepare next release (#7044)
• a9c5338 ci: roll prerelease changelog into one final release changelog (#7045)
• f41805e chore: prepare next release (#7042)
• b85eb28 chore(instrumentation-http): fix lint errors (#7039)
• 3f92530 ci: support pre-releases and major version bumps in release workflow (#7035)
• 82a5831 docs(otlp-exporter-base): document HTTP exporter options (#6735)
• e086dec Merge commit from fork
• 59dac70 chore(deps): update jamesives/github-pages-deploy-action action to v4.9.0 (#7...
• d0ce753 chore: add @​maryliag to maintainers (#7024)
• 03469a1 chore(deps): update open-telemetry/shared-workflows action to v0.10.0 (#7032)
• Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)
• delete unused PluginContainerOptions (#23382) (ee64401)
• use oxfmt sortImports (#23319) (97ad042)

... (truncated)

Commits

• 95e8923 release: v7.3.1
• 9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
• acf7e05 release: v7.3.0
• cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
• 317b3b2 release: v7.2.7
• 721f163 fix: plugin shortcut support (#21211)
• bda5dbb release: v7.2.6
• 3aa7527 release: v7.2.5
• 72e398a fix(deps): update all non-major dependencies (#21175)
• 3765f7b fix: shortcuts not rebound after server restart (#21166)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

🟡 Changes recommended

The new optional peer ranges unnecessarily exclude previously supported OpenTelemetry 0.221 installations.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates five development dependencies and refreshes the pnpm lockfile.

Changes:

• Updates Biome and Vite.
• Updates OpenTelemetry context and gRPC exporter packages.
• Refreshes transitive dependency resolutions.

File summaries

File	Description
package.json	Updates Biome.
examples/05-browser/package.json	Updates Vite.
packages/core/package.json	Updates OpenTelemetry async hooks.
packages/mcp/package.json	Updates OpenTelemetry async hooks.
packages/agentserver/package.json	Updates gRPC exporters and peer ranges.
pnpm-lock.yaml	Records updated dependency graph.

Review details

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.