Update frontend dependencies (dev) by renovate[bot] · Pull Request #4016 · DefGuard/defguard

renovate · 2026-11-07T04:53:03Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@biomejs/biome (source)	`2.5.15` → `2.6.4`	devDependencies	minor	`2.6.6` (+1)
@eslint/compat (source)	`^1.4.1` → `1.4.1`	devDependencies	pin
@eslint/eslintrc	`^3.3.7` → `3.3.7`	devDependencies	pin
@eslint/js (source)	`^9.39.5` → `9.39.5`	devDependencies	pin
@inlang/paraglide-js (source)	`2.20.1` → `2.29.3`	devDependencies	minor
@inlang/paraglide-js (source)	`2.29.1` → `2.29.3`	dependencies	patch
@prettier/plugin-oxc (source)	`^0.0.4` → `0.0.4`	devDependencies	pin
@tanstack/devtools-vite (source)	`^0.8.5` → `0.8.5`	devDependencies	pin
@tanstack/react-devtools (source)	`^0.10.13` → `0.10.13`	devDependencies	pin
@tanstack/react-query (source)	`5.104.5` → `5.105.0`	dependencies	minor	`5.107.1` (+6)
@tanstack/react-query-devtools (source)	`^5.104.5` → `5.104.5`	devDependencies	pin
@tanstack/react-router (source)	`1.170.45` → `1.170.46`	dependencies	patch
@tanstack/react-router-devtools (source)	`^1.167.2` → `1.167.2`	devDependencies	pin
@tanstack/react-virtual (source)	`3.14.21` → `3.14.24`	dependencies	patch	`3.14.26` (+1)
@tanstack/router-plugin (source)	`^1.168.47` → `1.168.47`	devDependencies	pin
@testing-library/jest-dom	`^6.10.0` → `6.10.0`	devDependencies	pin
@testing-library/react	`^16.3.3` → `16.3.3`	devDependencies	pin
@testing-library/user-event	`^14.6.8` → `14.6.8`	devDependencies	pin
@types/byte-size (source)	`^8.1.2` → `8.1.2`	devDependencies	pin
@types/humanize-duration (source)	`^3.27.4` → `3.27.4`	devDependencies	pin
@types/lodash (source)	`4.17.26` → `4.17.27`	dependencies	patch
@types/lodash-es (source)	`^4.17.12` → `4.17.12`	devDependencies	pin
@types/node (source)	`^26.6.5` → `26.6.5`	devDependencies	pin
@types/node (source)	`^22.20.5` → `22.20.5`	devDependencies	pin
@types/qs (source)	`^6.15.1` → `6.15.1`	devDependencies	pin
@types/react (source)	`^19.3.0` → `19.3.0`	devDependencies	pin
@types/react-dom (source)	`^19.3.0` → `19.3.0`	devDependencies	pin
@types/totp-generator	`^0.0.8` → `0.0.8`	devDependencies	pin
@typescript-eslint/eslint-plugin (source)	`^8.72.0` → `8.72.0`	devDependencies	pin
@typescript-eslint/parser (source)	`^8.72.0` → `8.72.0`	devDependencies	pin
@vitejs/plugin-react (source)	`^6.1.2` → `6.1.2`	devDependencies	pin
@vitest/ui (source)	`4.1.9` → `4.1.12`	devDependencies	patch
autoprefixer	`^10.6.1` → `10.6.1`	devDependencies	pin
axios (source)	`1.20.0` → `1.21.0`	dependencies	minor
bowser	`2.14.1` → `2.15.0`	dependencies	minor
eslint (source)	`^9.39.5` → `9.39.5`	devDependencies	pin
eslint-config-prettier	`^10.1.8` → `10.1.8`	devDependencies	pin
eslint-plugin-import	`^2.32.0` → `2.32.0`	devDependencies	pin
eslint-plugin-prettier	`^5.5.7` → `5.5.7`	devDependencies	pin
eslint-plugin-simple-import-sort	`^12.1.1` → `12.1.1`	devDependencies	pin
globals	`^17.13.0` → `17.13.0`	devDependencies	pin
isbot (source)	`5.1.42` → `5.2.2`	pnpm-workspace.overrides	minor
jsdom	`^29.1.1` → `29.1.1`	devDependencies	pin
motion	`14.4.0` → `14.9.0`	dependencies	minor	`14.10.1` (+2)
pnpm (source)	`12.3.4` → `12.17.0`	packageManager	minor	`12.18.0`
prettier (source)	`^3.9.10` → `3.9.10`	devDependencies	pin
qs	`6.16.1` → `6.17.1`	dependencies	minor
radashi (source)	`12.9.6` → `12.9.8`	dependencies	patch
sass	`^1.105.2` → `1.105.2`	devDependencies	pin
sharp (source, changelog)	`^0.35.5` → `0.35.5`	devDependencies	pin
stylelint (source)	`^17.16.0` → `17.16.0`	devDependencies	pin
stylelint-config-standard-scss	`^17.0.0` → `17.0.0`	devDependencies	pin
stylelint-scss	`^7.3.0` → `7.3.0`	devDependencies	pin
typescript (source)	`~6.0.3` → `6.0.3`	devDependencies	pin
vite (source)	`^8.3.4` → `8.3.4`	devDependencies	pin
vite-plugin-image-optimizer	`^2.0.3` → `2.0.3`	devDependencies	pin
vitest (source)	`4.1.11` → `4.1.12`	devDependencies	patch
zustand	`5.0.15` → `5.0.16`	dependencies	patch	`5.1.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

biomejs/biome (@biomejs/biome)

`v2.6.4`

Compare Source

Patch Changes

#12261 19fbfb2 Thanks @dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.
```
console.log("abc ", "def");
```
#12469 cd716d3 Thanks @dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.
```
const items = array.flat(2);
```
#12470 92c9e81 Thanks @dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.
```
let foo = null;
```
#12483 9bd3527 Thanks @dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.
```
function add(item) {
  return items.push(item);
}
```
#12477 a384892 Thanks @dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.
```
const foo = (bar => (bar ? bar.baz : baz))(getBar());
```
#12447 0a963e4 Thanks @dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.
```
function findRoot(node) {
    if (node.parent) {
        return findRoot(node.parent);
    }
    return node;
}
```
#12554 2eddda9 Thanks @dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.
```
<script>
export default {
  data() {
    return { total: this.doubled };
  },
  computed: {
    doubled() {
      return 2;
    },
  },
};
</script>
```
#12586 824df15 Thanks @dyc3! - Added the nursery rule noVueDeprecatedDeleteSet, which reports calls to the $set and $delete functions, Vue.set and Vue.delete, and set and del imported from vue. Vue 3 removed these functions, so calling them throws an error.
```
<script>
export default {
  mounted() {
    this.$set(this.user, "name", "Alice");
  },
};
</script>
```
#12648 6fc1a51 Thanks @dyc3! - Added the nursery rule noVueDeprecatedRouterLinkTagProp, which disallows the tag prop on RouterLink. Vue Router 4 ignores this prop, so the link still renders as an <a> element.
```
<template>
  <RouterLink tag="li" to="/">Home</RouterLink>
</template>
```
#12631 de1188f Thanks @dyc3! - Added the new nursery rule noVueDeprecatedScopeAttribute, which reports the scope attribute on <template> elements in Vue files. Vue no longer supports this attribute, so use v-slot to receive slot props instead.
```
<template>
  <ListComponent>
    <template scope="props">{{ props.title }}</template>
  </ListComponent>
</template>
```
#12562 5d7553b Thanks @dyc3! - Added the new nursery rule noVueMultipleSlotArgs, which disallows passing more than one argument to a Vue slot from a render function. Slot content written in a template receives only the first argument.
```
<script>
export default {
  render() {
    return this.$slots.default(item, index); // reported
  },
};
</script>
```
#12513 2e520d8 Thanks @dyc3! - Added the nursery rule noVueMutatingProps, which reports code that changes the props of a Vue component, in the script or in the template. Props belong to the parent component, so the child should emit an event or copy the value instead.
```
<script setup>
const props = defineProps({ items: Array });

props.items.push("new item");
</script>
```
#12567 144b786 Thanks @dyc3! - Added the nursery rule noVueSideEffectsInComputed, which reports Vue computed properties that change state. Vue decides when to run a computed property, so changes made inside one happen at unpredictable times.
```
<script setup>
import { computed, ref } from "vue";

const items = ref([]);
// `reverse()` changes `items.value` in place.
const reversedItems = computed(() => items.value.reverse());
</script>
```
#12603 861b288 Thanks @dyc3! - Added the new nursery rule noVueUnusedRefs, which reports template refs in Vue components that nothing reads through $refs, useTemplateRef(), or a variable of the same name in <script setup>. The rule needs html.experimentalFullSupportEnabled to be true.
```
<template>
  <input ref="input" />
</template>
```
#12285 68770e0 Thanks @dyc3! - Added the new nursery rule noYamlBooleanKeys, which disallows boolean values as keys in YAML. For example, the following key is a boolean instead of text, so it is reported:
```
true: enabled
```
#12338 f46411b Thanks @dyc3! - Added the nursery rule useSvelteEventDispatcherTypes, which reports createEventDispatcher() calls that don't declare the types of their events in Svelte components written in TypeScript.

The rule accepts a call that declares its events:
```
<script lang="ts">
  import { createEventDispatcher } from "svelte";

  const dispatch = createEventDispatcher<{ save: string }>();
</script>
```
#12615 ade9845 Thanks @dyc3! - Added the nursery rule useVueDefineOptions, which reports the default export of a plain <script> block in Vue components that also use <script setup>, and suggests setting those options with defineOptions() instead.
```
<script>
export default { name: "MyComponent" }; // reported
</script>

<script setup>
const props = defineProps(["title"]);
</script>
```
#12514 e74b4dc Thanks @dyc3! - Added the nursery rule useVueDefinePropsDestructuring, which requires destructuring the props returned by defineProps() in Vue <script setup> blocks. It also reports withDefaults(), because destructured props can set their default values directly.
```
<script setup lang="ts">
const props = defineProps<{ foo?: string }>();
</script>
```
#12559 94985ba Thanks @dyc3! - Added the nursery rule useVueTemplateRef, which requires useTemplateRef() instead of ref() or shallowRef() to access elements of the template in <script setup>.
```
<template>
  <input ref="input" />
</template>

<script setup>
import { ref } from "vue";

const input = ref(); // reported
</script>
```
#12512 6be5078 Thanks @dyc3! - Added the nursery rule useVueTypedProps, which reports Vue props declared without a type, in the props option, defineProps(), or defineModel(). Without a type, Vue accepts any value for the prop and can't warn when a component receives the wrong kind of value.
```
<script setup>
defineProps(["title"]);
</script>
```
#12653 f307633 Thanks @dyc3! - Added the nursery rule useVueVModel, which reports a prop binding on a Vue component paired with an update: listener that only writes the new value back, and suggests v-model instead.
```
<template>
  <MyComponent :title="title" @update:title="title = $event" />
</template>
```
#12591 a810209 Thanks @dyc3! - Added the nursery rule useVueValidDefineEmits, which enforces valid usage of Vue's defineEmits macro in <script setup>.

For example, the following code is now reported, because defineEmits declares its events with both a type and an argument:
```
<script setup lang="ts">
const emit = defineEmits<(e: "notify") => void>(["submit"]);
</script>
```
#12614 9308110 Thanks @dyc3! - Added the nursery rule useVueValidDefineProps, which reports defineProps() calls that Vue can't compile or that declare props incorrectly. For example, it reports a component that calls defineProps() twice, or whose defineProps() argument uses a variable declared in <script setup>:
```
<script setup>
const definition = { msg: String };
defineProps(definition);
</script>
```
#12570 222a230 Thanks @dyc3! - Added the nursery rule useVueValidVIs, which reports v-is directives that have an argument or modifiers, have no value, or are used on a component instead of a native HTML element.

For example, the following v-is directive has no value:
```
<template>
  <tr v-is></tr>
</template>
```
#12521 4010bb7 Thanks @dyc3! - Added the nursery rule useVueValidVMemo, which reports invalid v-memo directives in Vue templates. A v-memo directive must have an array value, can't have an argument or modifiers, and doesn't work inside an element with v-for.

For example, the following value is an object instead of an array:
```
<template>
  <div v-memo="{ id }"></div>
</template>
```
#12597 aff42a7 Thanks @dyc3! - Added the nursery rule useVueValidVModel, which reports v-model directives that Vue can't use: on unsupported elements or file inputs, with an argument or unknown modifier on a native element, without a value, or with a value that can't be assigned to.

For example, the following v-model directives are invalid:
```
<template>
  <div v-model="foo"></div>
  <input v-model="foo + bar" />
</template>
```
#12569 3058597 Thanks @dyc3! - Added the new nursery rule useVueValidVShow, which reports v-show directives that have an argument, a modifier, or no value, or that are placed on a <template> element.
```
<template v-show="isVisible"><div></div></template>
```
#12525 e2e5a36 Thanks @dyc3! - Added the nursery rule useVueValidVSlot, which reports misplaced, duplicated, or malformed v-slot directives in Vue templates.

For example, the rule reports two <template> elements that fill the same slot:
```
<MyComponent>
  <template #header>First title</template>
  <template #header>Second title</template>
</MyComponent>
```
#12472 efd16bd Thanks @dyc3! - Added the new nursery rule useWhileLoopCondition, which reports loops such as while (true) and for (;;) that start with an if statement containing only a break, and moves that condition into the while statement.
```
while (true) {
  if (!hasMore()) {
    break;
  } // reported
  processNext();
}
```
#12640 167bb00 Thanks @latin-1! - Updated useSortedProperties to follow stylelint-config-recess-order 7.9.0, adding sorting support for scroll-behavior, anchor positioning, multi-column layout, and other properties known to Biome.
#12719 40a82b0 Thanks @dyc3! - Improved the performance of the linter. Biome now spends less time setting up the enabled rules for each file it analyzes.
#12722 f074730 Thanks @dyc3! - Improved the performance of biome lint by about 1% to 3% on large projects, most noticeably with Biome's default rules and with rules that track variables or unreachable code.
#12501 90a4d74 Thanks @ematipico! - Fixed #12466: the Biome daemon used more memory with every biome check --use-server run. The daemon now reuses the data that it stores for each file and project, and it keeps syntax trees only for the files that it read most recently.
#12501 90a4d74 Thanks @ematipico! - Fixed biomejs/biome-vscode#923: when a file open in the editor changed on disk, the language server replaced the editor's text with the text on disk. Biome now keeps the editor's text of open files until they are closed, so diagnostics, code actions and formatting stay at the right positions.

#12652 59ff42a Thanks @kurovskyiii! - Fixed #12651: an imported name that the other module exports as both a type and a value now resolves to the type in type annotations, so noBaseToString no longer reports slug below as an object.

// rule-slug.ts
export type RuleSlug = string;
export const RuleSlug = { create: (text: string): RuleSlug => text } as const;

// main.ts
import { RuleSlug } from "./rule-slug";
export const label = (slug: RuleSlug): string => `rule ${slug}`;

[#12678](https://redirect.github.com/biomejs/biome/pull

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

Branch creation
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Update frontend dependencies

85b1949

renovate Bot added dependencies Pull requests that update a dependency file renovate labels Nov 7, 2026

renovate Bot requested a review from a team November 7, 2026 04:53

Navigation Menu

Repository navigation

Update frontend dependencies (dev) - #4016

Update frontend dependencies (dev)#4016
renovate[bot] wants to merge 1 commit into
devfrom
renovate/dev-frontend-dependencies

renovate Bot commented Nov 7, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Nov 7, 2026

Release Notes

v2.6.4

Patch Changes

Configuration

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v2.6.4`