fix(deps): update all non-major dependencies for npm #412

renovate · 2025-12-04T03:03:49Z

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.3.8` → `2.3.10`
@cloudflare/vitest-pool-workers (source)	`0.10.11` → `0.11.1`
@tailwindcss/vite (source)	`4.1.17` → `4.1.18`
@tanstack/react-query (source)	`5.90.11` → `5.90.16`
@tanstack/react-router (source)	`1.139.12` → `1.144.0`
@tanstack/react-router-devtools (source)	`1.139.12` → `1.144.0`
@tanstack/router-plugin (source)	`1.139.12` → `1.145.2`
@typespec/compiler (source)	`1.6.0` → `1.7.1`
@typespec/http	`1.6.0` → `1.7.0`
@typespec/openapi (source)	`1.6.0` → `1.7.0`
@typespec/openapi3 (source)	`1.6.0` → `1.7.0`
@typespec/rest (source)	`0.76.0` → `0.77.0`
orval	`7.17.0` → `7.17.2`
pnpm (source)	`10.24.0` → `10.27.0`
react (source)	`19.2.0` → `19.2.3`
react-dom (source)	`19.2.0` → `19.2.3`
tailwindcss (source)	`4.1.17` → `4.1.18`
vite (source)	`7.2.6` → `7.3.0`
wrangler (source)	`4.51.0` → `4.54.0`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.3.10`

Compare Source

Patch Changes

#8417 c3a2557 Thanks @taga3s! - Fixed #7809: noRedeclare no longer reports redeclarations for infer type in conditional types.
#8477 90e8684 Thanks @dyc3! - Fixed #8475: fixed a regression in how noExtraNonNullAssertion flags extra non-null assertions
#8479 250b519 Thanks @dyc3! - Fixed #8473: The semantic model now indexes typescript constructor method definitions, and no longer panics if you use one (a regression in 2.3.9).
#8448 2af85c1 Thanks @mdevils! - Improved handling of defineProps() macro in Vue components. The noVueReservedKeys rule now avoids false positives in non-setup scripts.
#8420 42033b0 Thanks @vsn4ik! - Fixed the nursery rule noLeakedRender.

The biome migrate eslint command now correctly detects the rule react/jsx-no-leaked-render in your eslint configurations.
#8426 285d932 Thanks @anthonyshew! - Added a Turborepo domain and a new "noUndeclaredEnvVars" rule in it for warning users of unsafe environment variable usage in Turborepos.
#8410 a21db74 Thanks @ematipico! - Fixed #2988 where Biome couldn't handle properly characters that contain multiple code points when running in stdin mode.
#8372 b352ee4 Thanks @Netail! - Added the nursery rule noAmbiguousAnchorText, which disallows ambiguous anchor descriptions.

Invalid

<a>learn more</a>

`v2.3.9`

Compare Source

Patch Changes

#8232 84c9e08 Thanks @ruidosujeira! - Added the nursery rule noScriptUrl.

This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.
```
<a href="javascript:alert('XSS')">Click me</a>
```
#8341 343dc4d Thanks @arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

Invalid

await "value";

const createValue = () => "value";
await createValue();

Caution

This is a first iteration of the rule, and does not yet detect generic "thenable" values.

#8034 e7e0f6c Thanks @Netail! - Added the nursery rule useRegexpExec. Enforce RegExp#exec over String#match if no global flag is provided.
#8137 d407efb Thanks @denbezrukov! - Reduced the internal memory used by the Biome formatter.
#8281 30b046f Thanks @tylersayshi! - Added the rule useRequiredScripts, which enforces presence of configurable entries in the scripts section of package.json files.

#8290 d74c8bd Thanks @dyc3! - The HTML formatter has been updated to match Prettier 3.7's behavior for handling <iframe>'s allow attribute.

- <iframe allow="layout-animations 'none'; unoptimized-images 'none'; oversized-images 'none'; sync-script 'none'; sync-xhr 'none'; unsized-media 'none';"></iframe>
+ <iframe
+ 	allow="
+ 		layout-animations 'none';
+ 		unoptimized-images 'none';
+ 		oversized-images 'none';
+ 		sync-script 'none';
+ 		sync-xhr 'none';
+ 		unsized-media 'none';
+ 	"
+ ></iframe>

#8302 d1d5014 Thanks @mlafeldt! - Fixed #8109: return statements in Astro frontmatter no longer trigger "Illegal return statement" errors when using experimentalFullSupportEnabled.
#8346 f3aee1a Thanks @arendjr! - Fixed #8292: Implement tracking
of types of TypeScript constructor parameter properties.

This resolves certain false negatives in noFloatingPromises and other typed
rules.

Example

class AsyncClass {
  async returnsPromise() {
    return "value";
  }
}

class ShouldBeReported {
  constructor(public field: AsyncClass) {}
  //          ^^^^^^^^^^^^----------------- Parameter property declaration

  async shouldBeReported() {
    // `noFloatingPromises` will now report the following usage:
    this.field.returnsPromise();
  }
}

#8326 153e3c6 Thanks @ematipico! - Improved the rule noBiomeFirstException. The rule can now inspect if extended configurations already contain the catch-all ** inside files.includes and, if so, the rule suggests removing ** from the user configuration.
#8433 397547a Thanks @dyc3! - Fixed #7920: The CSS parser, with Tailwind directives enabled, will no longer error when you use things like prefix(tw) in @import at rules.
#8378 cc2a62e Thanks @Bertie690! - Clarify diagnostic message for lint/style/useUnifiedTypeSignatures

The rule's diagnostic message now clearly states that multiple similar overload signatures are hard to read & maintain, as opposed to overload signatures in general.
#8296 9d3ef10 Thanks @dyc3! - biome rage now shows if you have experimental HTML full support enabled.
#8414 09acf2a Thanks @Bertie690! - Updated the documentation & diagnostic message for lint/nursery/noProto, mentioning the reasons for its longstanding deprecation and why more modern alternatives are preferred.

Notably, the rule clearly states that using __proto__ inside object literal definitions is still allowed, being a standard way to set the prototype of a newly created object.
#8445 c3df0e0 Thanks @tt-a1i! - Fix --changed and --staged flags throwing "No such file or directory" error when a file has been deleted or renamed in the working directory. The CLI now filters out files that no longer exist before processing.
#8459 b17d12b Thanks @ruidosujeira! - Fix #8435: resolved false positive in noUnusedVariables for generic type parameters in construct signature type members (new <T>(): T).
#8439 a78774b Thanks @tt-a1i! - Fixed #8011: useConsistentCurlyBraces no longer suggests removing curly braces from JSX expression children containing characters that would cause parsing issues or semantic changes when converted to plain JSX text ({, }, <, >, &).
#8436 a392c06 Thanks @ruidosujeira! - Fixed #8429. Formatter, linter, and assist settings now correctly inherit from global configuration when not explicitly specified in overrides.

Before this fix, when an override specified only one feature (e.g., only linter), other features would be incorrectly disabled instead of inheriting from global settings.

Example configuration that now works correctly:
```
{
  "formatter": { "enabled": true },
  "overrides": [
    {
      "includes": ["*.vue"],
      "linter": { "enabled": false }
    }
  ]
}
```
After this fix, .vue files will have the linter disabled (as specified in the override) but the formatter enabled (inherited from global settings).
#8411 9f1b3b0 Thanks @rriski! - Properly handle name, type_arguments, and attributes slots for JsxOpeningElement and JsxSelfClosingElement GritQL patterns.

The following biome search commands no longer throw errors:
```
biome search 'JsxOpeningElement(name = $elem_name) where { $elem_name <: "div" }'
biome search 'JsxSelfClosingElement(name = $elem_name) where { $elem_name <: "div" }'
```
#8441 cf37d0d Thanks @tt-a1i! - Fixed #6577: noUselessUndefined no longer reports () => undefined in arrow function expression bodies. Previously, the rule would flag this pattern and suggest replacing it with () => {}, which conflicts with the noEmptyBlockStatements rule.
#8444 8caa7a0 Thanks @tt-a1i! - Fix noUnknownMediaFeatureName false positive for prefers-reduced-transparency media feature. The feature name was misspelled as prefers-reduded-transparency in the keywords list.
#8443 c3fa5a1 Thanks @tt-a1i! - Fix useGenericFontNames false positive when a CSS variable is used as the last value in font-family or font. The rule now correctly ignores cases like font-family: "Noto Serif", var(--serif) and font: 1em Arial, var(--fallback).
#8281 30b046f Thanks @tylersayshi! - Fixed noDuplicateDependencies incorrectly triggering on files like _package.json.
#8315 c7915c4 Thanks @hirokiokada77! - Fixed #5213: The noDoneCallback rule no longer flags false positives when a method is called on a regular variable bound to identifiers such as before, after, beforeEach, and afterEach.
#8398 204844f Thanks @Bertie690! - The default value of the ignoreRestSiblings option for noUnusedVariables'
has been reverted to its prior value of true after an internal refactor accidentally changed it.

The diagnostic message has also been tweaked for readability.
#8242 9694e37 Thanks @dyc3! - Fixed bugs in the HTML parser so that it will flag invalid shorthand syntaxes instead of silently accepting them. For example, <Foo : foo="5" /> is now invalid because there is a space after the :.
#8297 efa694c Thanks @Yonom! - Added support for negative value utilities in useSortedClasses. Negative value utilities such as -ml-2 or -top-4 are now recognized and sorted correctly alongside their positive counterparts.
```
// Now detected as unsorted:
<div class="-ml-2 p-4 -mt-1" />
// Suggested fix:
<div class="-mt-1 -ml-2 p-4" />
```
#8335 3710702 Thanks @dibashthapa! - Added the new nursery rule useDestructuring. This rule helps to encourage destructuring from arrays and objects.

For example, the following code triggers because the variable name x matches the property foo.x, making it ideal for object destructuring syntax.
```
var x = foo.x;
```
#8383 59b2f9a Thanks @ematipico! - Fixed #7927: noExtraNonNullAssertion incorrectly flagged separate non-null assertions on both sides of an assignment.

The rule now correctly distinguishes between nested non-null assertions (still flagged) and separate non-null assertions on different sides of an assignment (allowed).

Examples

Valid (now allowed)

arr[0]! ^= arr[1]!;

Invalid (still flagged)

arr[0]!! ^= arr[1];
arr[0] ^= arr[1]!!;

#8401 382786b Thanks @Bertie690! - useExhaustiveDependencies now correctly validates custom hooks whose dependency arrays come before their callbacks.

Previously, a logical error caused the rule to be unable to detect dependency arrays placed before hook callbacks, producing spurious errors and blocking further diagnostics.

{
  "linter": {
    "rules": {
      "correctness": {
        "useExhaustiveDependencies": {
          "level": "error",
          "options": {
            "hooks": [
              {
                "name": "doSomething",
                "closureIndex": 2,
                "dependenciesIndex": 0
              }
            ]
          }
        }
      }
    }
  }
}

function component() {
  let thing = 5;
  // The rule will now correctly recognize `thing` as being specified
  // instead of erroring due to "missing" dependency arrays
  doSomething([thing], "blah", () => {
    console.log(thing);
  });
}

The rule documentation & diagnostic messages have also been reworked for improved clarity.

#8365 8f36051 Thanks @JacquesLeupin! - Fixed #8360: GritQL plugins defined in child configurations with extends: "//" now work correctly.
#8306 8de2774 Thanks @dibashthapa! - Fixed #8288: Fixed the issue with false positive errors

This new change will ignore attribute and only show diagnostics for JSX Expressions

For example

Valid:
```
<Something checked={isOpen && items.length} />
```
Invalid:
```
const Component = () => {
  return isOpen && items.length;
};
```
#8356 f9673fc Thanks @ematipico! - Fixed #7917, where Biome removed the styles contained in a <style lang="scss">, when experimentalFullSupportEnabled is enabled.
#8371 d71924e Thanks @ematipico! - Fixed #7343, where Biome failed to resolve extended configurations from parent directories using relative paths.
#8404 6a221f9 Thanks @fireairforce! - Fixed #7826, where a class member named async will not cause the parse error.
#8249 893e36c Thanks @cormacrelf! - Addressed #7538. Reduced the
volume of logging from the LSP server.

Use biome clean to remove large logs.

#8303 db2c65b Thanks @hirokiokada77! - Fixed #8300: noUnusedImports now detects JSDoc tags on object properties.

import type LinkOnObjectProperty from "mod";

const testLinkOnObjectProperty = {
	/**
	 * {@&#8203;link LinkOnObjectProperty}
	 */
	property: 0,
};

#8328 9cf2332 Thanks @Netail! - Corrected rule source reference. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#8403 c96dcf2 Thanks @dyc3! - Fixed #8340: noUnknownProperty will no longer flag anything in @plugin when the parser option tailwindDirectives is enabled
#8284 4976d1b Thanks @denbezrukov! - Improved the performance of the Biome Formatter by enabling the internal source maps only when needed.
#8260 a226b28 Thanks @ho991217! - Fixed biome-vscode#817: Biome now updates documents when the textDocument/didSave notification is received.
#8183 b064786 Thanks @hornta! - Fixed #8179: The useConsistentArrowReturn rule now correctly handles multiline expressions in its autofix when the style option is set to "always".

Previously, the autofix would incorrectly place a newline after the return keyword, causing unexpected behavior.

Example:
```
const foo = (l) => l.split("\n");
```
Now correctly autofixes to:
```
const foo = (l) => {
-   return
-   l.split('\n');
+   return l.split('\n');
}
```
#8382 7409cba Thanks @fireairforce! - Fixed #8338: Ignored the noUnknownTypeSelector check when the root selector is used under View Transition pseudo-elements.

Example
```
::view-transition-old(root),
::view-transition-new(root) {
  z-index: 1;
}
```
#7513 e039f3b Thanks @AsherDe! - Added the nursery rule noVueSetupPropsReactivityLoss.

This new rule disallows usages that cause the reactivity of props passed to the setup function to be lost.

Invalid code example:
```
export default {
  setup({ count }) {
    // `count` is no longer reactive here.
    return () => h("div", count);
  },
};
```

cloudflare/workers-sdk (@cloudflare/vitest-pool-workers)

`v0.11.1`

Compare Source

Patch Changes

Updated dependencies [ae1ad22, 171cfd9, 428ae9e, 737c0f4, c0e249e, 472cf72, 3853200]:
- miniflare@4.20251217.0
- wrangler@4.56.0

`v0.11.0`

Compare Source

Minor Changes

#11533 8d9003e Thanks @petebacondarwin! - Add support for ctx.exports

It is now possible to access ctx.exports properties for the main (SELF) worker.
- Integration tests: in the SELF worker the ctx.exports object now contains the expected stubs to the exported entry-points.
- Unit tests: the object returned from createExecutionContext() has exports property that exposes the exports of the SELF worker.
Due to the dynamic nature of Vitest the integration relies upon guessing what the exports of the main Worker are by statically analyzing the Worker source using esbuild. In cases where it is not possible to infer the exports (for example, a wildcard re-export of a virtual module) it is possible to declare these in the vitest-pool-workers config via the additionalExports setting.

Patch Changes

Updated dependencies [59534ba, 7e80340]:
- miniflare@4.20251202.0
- wrangler@4.52.1

`v0.10.12`

Compare Source

Patch Changes

Updated dependencies [2b4813b, abe49d8, b154de2, f29e699, 5ee3780, 6e63b57, 71ab562, 76f0540, 2342d2f, 5e937c1, 9a1de61, 6b38532, e4ddbc2, 2aec2b4, 695fa25, 504e258, 5a873bb, d25f7e2, 1cfae2d, e7b690b, 1d685cb, edf896d, 2b4813b, c47ad11, a977701, 9eaa9e2]:
- miniflare@4.20251128.0
- wrangler@4.52.0

tailwindlabs/tailwindcss (@tailwindcss/vite)

`v4.1.18`

Compare Source

Fixed

Ensure validation of source(…) happens relative to the file it is in (#19274)
Include filename and line numbers in CSS parse errors (#19282)
Skip comments in Ruby files when checking for class names (#19243)
Skip over arbitrary property utilities with a top-level ! in the value (#19243)
Support environment API in @tailwindcss/vite (#18970)
Preserve case of theme keys from JS configs and plugins (#19337)
Write source maps correctly on the CLI when using --watch (#19373)
Handle special defaults (like ringColor.DEFAULT) in JS configs (#19348)
Improve backwards compatibility for content theme key from JS configs (#19381)
Upgrade: Handle future and experimental config keys (#19344)
Try to canonicalize any arbitrary utility to a bare value (#19379)
Validate candidates similarly to Oxide (#19397)
Canonicalization: combine text-* and leading-* classes (#19396)
Correctly handle duplicate CLI arguments (#19416)
Don’t emit color-mix fallback rules inside @keyframes (#19419)
CLI: Don't hang when output is /dev/stdout (#19421)

TanStack/query (@tanstack/react-query)

`v5.90.16`

Compare Source

Patch Changes

fix(react-query): allow retryOnMount when throwOnError is function (#9338)
Updated dependencies [7f47906]:
- @tanstack/query-core@5.90.16

`v5.90.15`

Compare Source

Patch Changes

Updated dependencies [fccef79]:
- @tanstack/query-core@5.90.15

`v5.90.14`

Patch Changes

Updated dependencies [d576092]:
- @tanstack/query-core@5.90.14

`v5.90.13`

Patch Changes

Updated dependencies [4a0a78a]:
- @tanstack/query-core@5.90.13

`v5.90.12`

Compare Source

Patch Changes

Updated dependencies [72d8ac5]:
- @tanstack/query-core@5.90.12

TanStack/router (@tanstack/react-router)

`v1.144.0`

Compare Source

Version 1.144.0 - 12/27/25, 2:58 PM

Changes

Feat

RawStream (#6231) (680671c) by Manuel Schiller

Packages

@tanstack/router-core @1.144.0
@tanstack/start-client-core @1.144.0
@tanstack/start-server-core @1.144.0
@tanstack/solid-router @1.144.0
@tanstack/react-router @1.144.0
@tanstack/vue-router @1.144.0
@tanstack/solid-router-ssr-query @1.144.0
@tanstack/react-router-ssr-query @1.144.0
@tanstack/vue-router-ssr-query @1.144.0
@tanstack/router-ssr-query-core @1.144.0
@tanstack/zod-adapter @1.144.0
@tanstack/valibot-adapter @1.144.0
@tanstack/arktype-adapter @1.144.0
@tanstack/router-devtools @1.144.0
@tanstack/solid-router-devtools @1.144.0
@tanstack/react-router-devtools @1.144.0
@tanstack/vue-router-devtools @1.144.0
@tanstack/router-devtools-core @1.144.0
@tanstack/router-generator @1.144.0
@tanstack/router-cli @1.144.0
@tanstack/router-plugin @1.144.0
@tanstack/router-vite-plugin @1.144.0
@tanstack/solid-start @1.144.0
@tanstack/solid-start-client @1.144.0
@tanstack/solid-start-server @1.144.0
@tanstack/vue-start @1.144.0
@tanstack/vue-start-client @1.144.0
@tanstack/vue-start-server @1.144.0
@tanstack/start-storage-context @1.144.0
[@tanstack/react-start](https://redire

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot requested a review from a team December 4, 2025 03:03

renovate bot force-pushed the renovate/npm-all-minor-patch branch 10 times, most recently from f0c6340 to 1c9a324 Compare December 11, 2025 12:44

renovate bot force-pushed the renovate/npm-all-minor-patch branch 11 times, most recently from 2d6a45f to 170b22b Compare December 18, 2025 14:12

renovate bot force-pushed the renovate/npm-all-minor-patch branch 8 times, most recently from 0f2bcce to 419440e Compare December 23, 2025 04:31

renovate bot force-pushed the renovate/npm-all-minor-patch branch 12 times, most recently from b8521b8 to 47f8355 Compare December 30, 2025 05:59

renovate bot force-pushed the renovate/npm-all-minor-patch branch from 47f8355 to 0a06ac7 Compare December 30, 2025 15:09

fix(deps): update all non-major dependencies for npm

4543d83

renovate bot force-pushed the renovate/npm-all-minor-patch branch from 0a06ac7 to 4543d83 Compare December 30, 2025 22:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update all non-major dependencies for npm #412

fix(deps): update all non-major dependencies for npm #412

Uh oh!

renovate bot commented Dec 4, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

fix(deps): update all non-major dependencies for npm #412

Are you sure you want to change the base?

fix(deps): update all non-major dependencies for npm #412

Uh oh!

Conversation

renovate bot commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Invalid

Patch Changes

Invalid

Caution

Example

Examples

Valid (now allowed)

Invalid (still flagged)

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Fixed

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Changes

Feat

Packages

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Dec 4, 2025 •

edited

Loading