chore(deps-dev): bump the dev-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the dev-dependencies group with 10 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.6	2.5.15
@types/node	25.9.5	25.9.9
esbuild	0.28.1	0.28.2
gitnexus	1.6.9	1.6.12
turbo	2.10.8	2.11.7
vitest	4.1.10	4.1.11
concurrently	9.2.4	9.2.5
electron	42.8.0	42.11.12
vite	7.3.6	7.3.7
@types/vscode	1.120.0	1.140.0

Updates @biomejs/biome from 2.5.6 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @types/node from 25.9.5 to 25.9.9

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates gitnexus from 1.6.9 to 1.6.12

Changelog

Sourced from gitnexus's changelog.

[1.6.12] - 2026-09-12

Added

• Configurable index artifact storage — GITNEXUS_STORAGE_PATH writes one repository's index artifacts (graph data, metadata, parse caches, locks, branch indexes) to a caller-selected absolute directory, and GITNEXUS_STORAGE_ROOT gives several repositories one shared external root with an isolated <repo-basename>-<canonical-path-hash>/ slot each. GITNEXUS_STORAGE_PATH wins when both are set. Opt-in: unset, GitNexus still writes to <repo>/.gitnexus/ (#3060)
• Generation-time content retention tiers — GITNEXUS_CONTENT_RETENTION=full|symbol|none chooses how much source-derived text is persisted: full file and symbol text, symbol snippets only, or structural graph data with no source bodies. Graph-oriented CLI, MCP and UI workflows are unchanged; CLI, MCP, the HTTP API and the web UI now say so explicitly when retention or a missing checkout hides file text. Storage and retention compatibility metadata is persisted, so an index is rebuilt when those semantics change (#3060)
• Objective-C is a supported language — vendored tree-sitter-objc grammar with a deterministic provider covering interfaces, implementations, categories, methods, properties and header classification (#3179)
• analyze --skip-fts / GITNEXUS_SKIP_FTS=1 — explicit FTS opt-out that skips extension loading and keyword-search indexes; the flag and the env var are one mode, so toggling the discriminator alone no longer forces a same-commit rebuild (#3205, #3263)
• gitnexus embeddings fills an existing index in place — long HTTP embedding jobs are resumable: every successful batch is durable, reruns skip vectors whose content hash still matches, endpoint timeouts retry under GITNEXUS_EMBEDDING_RETRY_TIMEOUTS, and the structural graph is not rebuilt (#3065)
• Staleness reports diverged and unknown instead of fresh — checkStaleness / checkStalenessAsync return an additive status (current, behind, diverged, unknown) so a rev-list failure on a pruned branch-pinned clone stops reading as an up-to-date index (#3257)
• Serve API exposes branch and index freshness — GET /api/repos and GET /api/repo return the indexed branch, lastCommit, and how far behind the working tree is; POST /api/analyze honors branch (#3232, #3199)

Fixed

• Parse-cache chunk whose durable generation could not be reset is retired, instead of leaving a stale generation reachable through the coherence gate (#3271)
• Stale file-lock reclamation is guarded, closing the lock-recovery failure paths (#3234)
• LadybugDB checkpoint race in the pool adapter, with @ladybugdb/core pinned to 0.18.3 (#3189)
• MCP rejects unknown tool arguments and honors depth (#3267)
• Deleted files map to indexed symbol ranges on incremental analyze (#3269)
• Metadata-only diff files are retained by the parser (#3251); stable cache packs stay parallel (#3194)
• Embedding sync fails closed on foreign identity and vector-width drift (#3260)
• Dart — @name is anchored so a constructor initializer stops minting a second symbol (#3224)
• Zig — callable-value references are modeled and their absence is no longer reported as exact (#3219); cross-file static gates resolve (#3185); tree-sitter-zig is vendored so npm i -g no longer warns on peers (#3180)
• Go — test siblings resolve and package discovery is tighter (#3191)
• TypeScript — tsconfig paths aliases resolve on Windows (#3203)
• Ruby — gem requires are guarded with dependency metadata (#3096)
• COBOL — copybook directories are preferred so COPY EXTERNAL does not hit vendor decoys (#3240)
• Python — group detects function-local imports (#3254)
• NestJS GraphQL contracts extract on real indexes (#3227); Spring constructor-to-bean injection edges persist to the schema (#3239)
• Derived graph flows exclude guessed call edges (#3193), and fallback guesses are labeled while export visibility is preserved (#3190)
• doctor distinguishes vector capability from repository index state (#3228)
• CI looks up fork prebuild PRs by head owner and branch (#3236)

Performance

• MCP tools/list no longer spawns one git process per repo — the registry is read directly (#3259)
• Scope resolution stops re-scanning the ParsedFile store once per language (#3211) and avoids quadratic config-walk queues (#3237)
• Parse dispatch — cache packs batch into one dispatch round, the round's memory bound is tightened, and the worker-pool override is unclamped (#3196, #3200)
• File locking probes this process's own start time once (#3222)

Chore / Dependencies

• Benchmark and skill-evolution harness — evolution runs against historical PRs, bounded packed-scheduler primitives with offline replay, provider-native usage recorded at the gateway, and offline benchmarks against a scripted provider (#2785, #3206, #3207, #3220, #3235)
• Docs — FTS closed as an optimization target with measured evidence, edit-loop numbers corrected with an FTS per-index breakdown, RepoCloud one-click deploy button (#3208, #3209, #3212)
• Dependency bumps across gitnexus (hono, ignore, joi, express-rate-limit, @types/node), gitnexus-web (@langchain/langgraph, react-i18next, @types/react, @vitejs/plugin-react, @testing-library/user-event), and GitHub Actions (softprops/action-gh-release, docker/setup-qemu-action) (#3164, #3165, #3214, #3215, #3231, #3233, #3243–#3249, #3265)

[1.6.11] - 2026-09-04

Added

... (truncated)

Commits

• c4ecf39 chore: release v1.6.12 (#3272)
• 79543c8 feat(storage): add configurable index storage and content retention tiers (#3...
• a8736a0 fix(lbug): checkpoint race in pool-adapter.ts + pin @​ladybugdb/core to 0.18.3...
• ceaff27 fix(parse-cache): retire a chunk whose durable generation could not be reset ...
• 3f5ca8c fix(storage): guard stale file-lock reclamation (#3234)
• 1f64bec fix(mcp): reject unknown tool arguments and honor depth (#3267)
• 68eca0c fix: map deleted files to indexed symbol ranges (#3269)
• 75cc8dd chore(deps)(deps): bump ignore from 7.0.8 to 7.0.9 in /gitnexus (#3265)
• 68c4200 fix(dart): anchor @​name so a constructor initializer stops minting a … (#3224)
• af2d9ae refactor(fts): share skip-FTS helpers and capability defaults (#3263)
• Additional commits viewable in compare view

Updates turbo from 2.10.8 to 2.11.7

Release notes

Sourced from turbo's releases.

Turborepo v2.11.7

What's Changed

Changelog

• chore: Release Turborepo 2.11.6 by @​github-actions[bot] in vercel/turborepo#14352
• fix: Pass SDKROOT through to repository tasks by @​anthonyshew in vercel/turborepo#14353
• chore: Update with-vite-module-federation example by @​vercel-gh-bot-5[bot] in vercel/turborepo#14349
• fix: Ignore Vercel OIDC token rotation in .env.local cache inputs by @​anthonyshew in vercel/turborepo#14356

Full Changelog: vercel/turborepo@v2.11.6...v2.11.7

Turborepo v2.11.6

What's Changed

Changelog

• chore: Release Turborepo 2.11.5 by @​github-actions[bot] in vercel/turborepo#14329
• fix: Upgrade standalone turbo on installer reruns by @​anthonyshew in vercel/turborepo#14330
• test: Deflake OpenTelemetry and PTY shutdown tests by @​anthonyshew in vercel/turborepo#14331
• docs: Document standalone turbo installation by @​anthonyshew in vercel/turborepo#14332
• ci: Install standalone turbo on Windows with PowerShell by @​anthonyshew in vercel/turborepo#14334
• fix: Keep Yarn patch resolutions with npm protocol selectors in prune by @​anthonyshew in vercel/turborepo#14337
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in vercel/turborepo#14264
• ci: Resolve latest turbo release with workflow token by @​anthonyshew in vercel/turborepo#14339
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in vercel/turborepo#14335
• fix: Match production MFE negative lookaheads locally by @​kitfoster in vercel/turborepo#13496
• docs: Add missing system environment variables and run flags by @​BABTUNA in vercel/turborepo#13811
• fix: Normalize task inputs consistently for affected detection and hashing by @​anthonyshew in vercel/turborepo#14341
• feat: Add task tags with configuration inheritance by @​anthonyshew in vercel/turborepo#14342
• fix: Upgrade brace-expansion to latest compatible releases by @​anthonyshew in vercel/turborepo#14347
• docs: Point security.txt to Vercel HackerOne program by @​swarnava in vercel/turborepo#14346
• test: Deflake untracked scan-scope assertions by @​anthonyshew in vercel/turborepo#14348
• feat: Expose task and package tags in query by @​anthonyshew in vercel/turborepo#14343
• feat: Filter query tasks and packages by tags by @​anthonyshew in vercel/turborepo#14344
• feat: Filter tasks by tags in the CLI by @​anthonyshew in vercel/turborepo#14345
• fix: Complete task query metadata for non-script entrypoints by @​anthonyshew in vercel/turborepo#14350
• fix: Infer single-package mode for query commands by @​anthonyshew in vercel/turborepo#14351

New Contributors

• @​swarnava made their first contribution in vercel/turborepo#14346

Full Changelog: vercel/turborepo@v2.11.5...v2.11.6

Turborepo v2.11.5

What's Changed

Changelog

... (truncated)

Commits

• 547747f publish 2.11.7 to registry
• 3ce82f5 fix: Ignore Vercel OIDC token rotation in .env.local cache inputs (#14356)
• 8cc3cce chore: Update with-vite-module-federation example (#14349)
• 41387de fix: Pass SDKROOT through to repository tasks (#14353)
• 3a2072c chore: Release Turborepo 2.11.6 (#14352)
• 90718d1 fix: Infer single-package mode for query commands (#14351)
• a409ce5 fix: Complete task query metadata for non-script entrypoints (#14350)
• bc7c148 feat: Filter tasks by tags in the CLI (#14345)
• 49d1607 feat: Filter query tasks and packages by tags (#14344)
• fba5351 feat: Expose task and package tags in query (#14343)
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates concurrently from 9.2.4 to 9.2.5

Release notes

Sourced from concurrently's releases.

v9.2.5

What's Changed

• deps: update shell-quote to 1.12.0 by @​Abicodexi and @​Mayvis in open-cli-tools/concurrently#622

Full Changelog: open-cli-tools/concurrently@v9.2.4...v9.2.5

Commits

• 4fb52e2 9.2.5
• dac54d0 deps: update shell-quote to 1.12.0 (#622)
• See full diff in compare view

Updates electron from 42.8.0 to 42.11.12

Release notes

Sourced from electron's releases.

electron v42.11.12

Release Notes for v42.11.12

Fixes

• Fixed a renderer crash when a ResizeObserver loop-limit error handler modified layout. #54610 (Also in 43, 44, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, fontconfig, Skia, V8 and WebRTC. #54668
• Backported fixes from upstream ANGLE, Chromium, Skia, V8 and WebRTC. #54659

electron v42.11.11

Release Notes for v42.11.11

Fixes

• Fixed a crash on launch on macOS when the system refused to register the app for sleep/wake notifications. #54598

electron v42.11.10

Release Notes for v42.11.10

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn and V8. #54565

electron v42.11.9

Release Notes for v42.11.9

Fixes

• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54310 (Also in 43, 44, 45)
• Fixed fs.rmSync failing to remove read-only files on Windows. #54257 (Also in 43, 44, 45)
• Fixed pointerLock permission requests from some iframes reporting the parent frame. #54466 (Also in 43, 44, 45)
• Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54332 (Also in 43, 44, 45)
• Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. #54236
• Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. #54239 (Also in 43, 44, 45)

electron v42.11.8

Release Notes for v42.11.8

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, PDFium and V8. #54223

electron v42.11.7

Release Notes for v42.11.7

Fixes

... (truncated)

Commits

• 4e29e96 test: wait for stable focus before checking openExternal removes focus (#54693)
• 8c5c5c9 chore: cherry-pick 0728ae248ac5 from chromium (#54610)
• 578ad15 test: run WebContentsView focusOnNavigation and shell.openExternal specs seri...
• 0f9d126 chore: cherry-pick 44 changes from angle, chromium, dawn, fontconfig, skia, v...
• 36396e3 chore: cherry-pick 8 changes from angle, chromium, skia, v8 and webrtc (#54659)
• 55c04c0 test: listen for both singleton exits before either can happen (#54600)
• 5dd0cdd build: update PGO profiles (#54641)
• 69a6987 chore: cherry-pick 69403d85b78b from chromium (#54598)
• 38a9fa2 chore: cherry-pick 27 changes from angle, chromium, dawn and v8 (#54565)
• 3ce66d2 test: run pointer lock permission spec serially (#54580)
• Additional commits viewable in compare view

Updates vite from 7.3.6 to 7.3.7

Release notes

Sourced from vite's releases.

v7.3.7

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.7 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (a0a3339)
• html: filename passed to transformIndexHtml should not include queries (#23653) (8d479f9)
• server: store ids to safeModulePaths rather than URLs (#23656) (f0d76c7)

Commits

• 284f6b5 release: v7.3.7
• f0d76c7 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• a0a3339 fix(deps): update launch-editor to v2.14.2 (#23654)
• 8d479f9 fix(html): filename passed to transformIndexHtml should not include queries (...
• See full diff in compare view

Updates @types/vscode from 1.120.0 to 1.140.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions