chore(deps): update all dependencies - #523

v0.70.1

Bug Fixes

• #​4974 Preserve non-TypeSpec service.yaml versions when updating an existing manifest. Versions the emitter no longer produces are now kept when they are not TypeSpec-generated (for example legacy swagger-only versions migrated from readme.md), while stale source: typespec versions the emitter no longer produces are still removed. This makes re-running the emitter idempotent for manifests that carry historical versions.

v2.5.6

Compare Source

Patch Changes

• #​11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #​11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #​11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #​9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #​10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #​10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #​11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #​11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #​10533 5809875 Thanks @​Mokto! - Fixed #​10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #​11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #​10858 6d18204 Thanks @​ruidosujeira! - Fixed #​10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #​11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  
  [1, 2, 3].map(async (value) => value);

• #​10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

  function unresolvedReturnType(): MissingType {
    return "value" as const;
  }

• #​11071 15047a2 Thanks @​dyc3! - The HTML parser now accepts mixed-case doctype declarations.

• #​11030 cc90e65 Thanks @​marschattha! - The rdjson reporter now populates the severity field of each diagnostic (ERROR, WARNING, or INFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.

• #​11009 2c36626 Thanks @​ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.

• #​11056 903b177 Thanks @​dyc3! - Added support for Svelte declaration tags using let and const. Biome can now parse, format, and lint bindings declared in these tags.

• #​11045 89c27c6 Thanks @​ematipico! - Improved the performance of Biome formatter up to ~7% across the board.

• #​9806 781d68d Thanks @​dyc3! - Added the nursery rule noJsRestrictedProperties, which ports ESLint's no-restricted-properties rule. Biome now flags restricted member access and object destructuring, and biome migrate eslint preserves the rule's options.

v2.5.5

Compare Source

Patch Changes

• #​10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

  declare const value: 1n | 2n;
  switch (value) {
    case 1n:
      break;
  }

• #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

  type Recursive = Recursive;
  declare const value: Recursive;
  
  String(value);
  value || "fallback";

• #​10977 0bf7486 Thanks @​ematipico! - Fixed #​10922: the action useSortedAttributes no longer triggers for HTML instructions.

• #​10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

• #​10983 edc0ed7 Thanks @​ayaangazali! - Fixed #​10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

  Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

• #​10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

  - A:HOVER { COLOR: INITIAL; }
  + A:hover { color: initial; }
  - @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
  + @keyframes :GLOBAL KeepFrames { from { color: RED; } }
  - @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
  + @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

• #​10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

  -a { color: /* before */ /* after */ red !important; }
  +a { color: /* before */ red /* after */ !important; }

• #​10993 b7a9694 Thanks @​denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.

  -.before > /* comment */ .after {}
  +.before /* comment */ > .after {}

  It now also keeps selectors with escaped newlines in attribute values inline when they fit.

  -div
  -  span[foo="bar\
  +div span[foo="bar\
   value"] {}

• #​10978 8ebafe1 Thanks @​ematipico! - Fixed #​10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".

• #​10901 68c10e6 Thanks @​Socialpranker! - Fixed #​10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

  This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.

• #​10936 7df46f5 Thanks @​ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.

• #​10941 f787725 Thanks @​siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.

• #​10969 72d309b Thanks @​ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.

• e62f6b6 Thanks @​ematipico! - Fixed #​10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.

• #​10931 899c60d Thanks @​ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.

• #​10904 ceee4f4 Thanks @​qzwxsaedc! - Fixed #​10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:

  import type Types from "./types";
  
  declare function parse(): Types.Result<string>;
  const result = parse();
  if (!result.success) {
  }

• #​10962 f0a67f2 Thanks @​ematipico! - Biome no longer removes embedded styles and scripts in HTML files.

• #​11000 5039a1e Thanks @​ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.

• #​10957 cf263c4 Thanks @​dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.

• #​10992 4bf9b21 Thanks @​ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

  For example, the following callback is now reported.

  declare function consume(...args: [number, () => void]): void;
  const prefix: [number] = [1];
  
  consume(...prefix, async () => {});

• #​10915 b3b12b3 Thanks @​Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

  The rule provides an unsafe fix that flips the operator.

  // Invalid
  !foo === bar;
  !foo !== bar;
  
  // Valid
  foo !== bar;
  foo === bar;

• #​10970 bd1038b Thanks @​ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:

  declare function consume(kind: "async", callback: () => Promise<void>): void;
  declare function consume(kind: "sync", callback: () => void): void;
  consume("sync", async () => {});

• #​10933 48a4abb Thanks @​ematipico! - Fixed useArrayFind to recognize bigint zero indexes.

• #​10931 899c60d Thanks @​ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.

• #​10969 72d309b Thanks @​ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.

• #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:

  declare const value: unknown;
  
  async function consume() {
    await value;
  }

v2.5.6

Compare Source

v2.5.5

Compare Source

v4.1.1

Compare Source

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v4.1.0...v4.1.1

v4.1.0

Compare Source

v4.0.1

Compare Source

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

What's Changed

• fix: normalize scheme to lowercase (RFC 3986 §6.2.2.1) by @​spokodev in #​182
• chore: update depedabot setting by @​climba03003 in #​179
• chore: replace http with https in urls by @​Fdawgs in #​184
• chore: bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​186

New Contributors

• @​spokodev made their first contribution in #​182
• @​climba03003 made their first contribution in #​179

Full Changelog: fastify/fast-uri@v4.0.0...v4.0.1

v4.0.0

Compare Source

What's Changed

• refactor(types): migrate from tsd to tstyche by @​Tony133 in #​172
• ci(ci): add node 26 to test matrices by @​Fdawgs in #​173
• chore: removed types deprecated by @​Tony133 in #​174
• fix: escape bug by @​zekth in #​181

Full Changelog: fastify/fast-uri@v3.1.2...v4.0.0

v30.0.1

Compare Source

v30.0.0

Compare Source

v0.56.0

Compare Source

Breaking Changes

• Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#​5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:
  • all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;
  • all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;
  • the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.
• Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.
• Removes the deprecated IMirrorModel and IWorkerContext worker API types.

New Features and APIs

• Adds editor.doubleClickSelectsBlock.
• Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.
• Adds offWhenInlineCompletions to QuickSuggestionsValue.
• Adds model and provider option support to inline completion providers.
• Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.
• Adds advanced-external and advanced-wasm diff algorithms.
• Exposes typed native LSP client and transport APIs.

Fixes

• Treats Markdown returned by language servers as untrusted (#​5280).
• Updates the editor core to the version used by 0.56.0-dev-20260625.

v26.7.0: 2026-08-05, Version 26.7.0 (Current), @​aduh95

Compare Source

Notable Changes

• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #​63949
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [c1e4f7365e] - (SEMVER-MINOR) lib: add perfetto support (Chengzhong Wu) #​64565
• [11c2f9c642] - (SEMVER-MINOR) module: implement Symbol.dispose in ModuleHooks (Remco Haszing) #​63928
• [a646319f61] - (SEMVER-MINOR) test_runner: add support for --test-coverage-include-all (avivkeller) #​64830

Commits

• [a2d3f891d3] - async_hooks: use validateBoolean for trackPromises (Soul Lee) #​64731
• [d7266cdd99] - benchmark: fix calibrate-n option handling (Luan Muniz) #​64146
• [2e64293e3f] - buffer: use Clamp conversion in Blob slice (Donghoon Kang) #​64739
• [5fda0958bd] - buffer: validate copyArrayBuffer offsets against buffer length (Ilia Alshanetsky) #​63904
• [5298db40f9] - build: run perfetto build and test on GHA (Chengzhong Wu) #​64721
• [e3eac7cef9] - build: fix v8_use_perfetto source scraping (Chengzhong Wu) #​64721
• [ab5f076d7f] - build: bump rustc requirement to >=1.86 (Renegade334) #​64543
• [df608e061f] - (SEMVER-MINOR) build: perfetto-sdk (Chengzhong Wu) #​64565
• [74928adc46] - build,tools: fix shared library cross-compile (Kirill Saied) #​63963
• [58717685a1] - (SEMVER-MINOR) crypto: support loading private keys through STORE loaders (Filip Skokan) #​63949
• [58d13b6f3d] - crypto: preserve OpenSSL errors from KDF failures (Filip Skokan) #​64776
• [478a719cb5] - crypto: fix Argon2 bypassing FIPS mode (Filip Skokan) #​64776
• [44b940ee8c] - crypto: update root certificates to NSS 3.125 (Node.js GitHub Bot) #​64746
• [fde85237c7] - crypto: clarify missing cipher error (Filip Skokan) #​64852
• [c604d8846d] - crypto: reuse X509 issuer result (Filip Skokan) #​64852
• [c68c7d0112] - crypto: validate key generation options (Filip Skokan) #​64852
• [c36bb1d017] - crypto: fix Argon2 validation errors (Filip Skokan) #​64852
• [f61408bb27] - crypto: handle XOF output allocation failure (Filip Skokan) #​64851
• [2b4053d046] - crypto: initialize KeyObjectData mutex eagerly (Filip Skokan) #​64851
• [4b7b2adf44] - crypto: handle DH operation failures (Filip Skokan) #​64851
• [12170c3753] - crypto: use user-facing error for output encoding changes (Archkon) #​64692
• [474f06d550] - debugger: preserve overlapping CDP request state (Trivikram Kamat) #​64467
• [718cbe9497] - deps: upgrade npm to 11.19.0 (npm team) #​64883
• [657c6154b3] - deps: update ngtcp2 to 1.25.0 (Node.js GitHub Bot) #​64944
• [75a1fbeff9] - deps: update nghttp3 to 1.18.0 (Node.js GitHub Bot) #​64943
• [07d7cb7cd8] - deps: update minimatch to 10.2.6 (Node.js GitHub Bot) #​64945
• [f7d56359f1] - deps: update simdjson to 4.6.6 (Node.js GitHub Bot) #​64942
• [8b06457cfb] - deps: update acorn to 8.18.0 (Node.js GitHub Bot) #​64941
• [5919d01525] - deps: update googletest to 1b6f64d (Node.js GitHub Bot) #​64940
• [4a87ad6cff] - deps: update nghttp2 to 1.70.0 (Node.js GitHub Bot) #​64939
• [c96d76a7c8] - deps: update zlib to 1.3.2.1-motley-42c2f19 (Node.js GitHub Bot) #​64744
• [2b59984c0f] - deps: V8: backport 5177b10 (avivkeller) #​64631
• [b839af91da] - deps: update ada to 4.0.0 (Node.js GitHub Bot) #​64790
• [70dedef942] - deps: update sqlite to 3.53.4 (Node.js GitHub Bot) #​64745
• [7bc4c171f5] - deps: update Rust crates for V8 14.6.202.34-node.26 (Renegade334) #​64543
• [308c6b2ac3] - deps: V8: backport 7d9b7e0 (Manish Goregaokar) #​64543
• [8eeae28e88] - deps: V8: backport c4d06ba (liujiahui) #​63731
• [bbd6fc58c4] - diagnostics_channel: grow native channel storage (Stephen Belanger) #​64497
• [ce8b292955] - doc: fix grammar and punctuation in dgram documentation (Kamal Rawal) #​64957
• [1a413a60cf] - doc: fix grammar and editorial issues in addons documentation (Kamal Rawal) #​64952
• [63fbd59e64] - doc: formalize fn/name as part of TestOptions API (Christopher Hiller) #​64946
• [b263b0bca1] - doc: remove references to ca/crl as per-context QuicSession options (René) #​64769
• [f37de14b27] - doc: fix typo in maintaining-dependencies.md (greenhead) #​64896
• [16cb77cdc8] - doc: add RafaelGSS as last security release stewards (Rafael Gonzaga) #​64843
• [335c28cd17] - doc: fix typos in documentation (greenhead) #​64900
• [d4bed8ca39] - doc: fix missing references in doc type map (Tim Perry) #​64872
• [e71d09d5f1] - doc: improve TestContext hook descriptions (Kamal Rawal) #​64899
• [7089bd9ae4] - doc: add missing float32/float64 FFI type names (Soul Lee) #​64874
• [8d3ae0830e] - doc: document stream.isDestroyed() (YspritanHyzygy) #​64789
• [a757e62af7] - doc: add contributing detail for git Signed-off-by trailer (Mike McCready) #​64862
• [3e840f43ed] - doc: mark config-file as release candidate (Marco Ippolito) #​64516
• [70cd5df810] - doc: fix duplicated word in test snapshot docs (Kamal Rawal) #​64837
• [d5f36c7adc] - doc: remove obsolete cctest node.gyp instructions (Soul Lee) #​64814
• [a0bf29ea09] - doc: report proper return type on url.format (Brian Muenzenmeyer) #​64806
• [e655e42085] - doc: use ffi.suffix for library paths in examples (Junsoo Ha) #​64805
• [e0f0830dbc] - doc: document --permission-audit audit mode behavior (Adrián Estrada) #​64791
• [efbede6de0] - doc: clarify tlsSocket.authorized on resumption (soreavis) #​64584
• [db95655c4a] - doc: stabilize --disable-warning (Jean Michelet) #​64742
• [a8367200be] - doc: add MDN links for explicit resource management in fs (lluisemper) #​59557
• [1c09165c2e] - doc: mention constructor check in deepStrictEqual (Sumit Kumar Das) #​62010
• [29709324e0] - doc: update technical priorities (Jacob Smith) #​64505
• [522a28e648] - doc: deprecation add more codemod (Augustin Mauroy) #​63175
• [c40aaa6539] - doc: run license-builder (Node.js GitHub Bot) #​63918
• [428e9bc50f] - ffi: fix crash in refCallback and unrefCallback (Trivikram

✂ Note

PR body was truncated to here.