Skip to content

fix(deps): update npm-non-major (patch) - #736

Merged
setchy merged 1 commit into
mainfrom
renovate/patch-npm-non-major
Aug 31, 2026
Merged

fix(deps): update npm-non-major (patch)#736
setchy merged 1 commit into
mainfrom
renovate/patch-npm-non-major

Conversation

@renovate

@renovate renovate Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.5.10 → 2.5.11 age confidence
@biomejs/biome (source) 2.5.10 → 2.5.11 age confidence
astro (source) 7.2.4 → 7.2.9 age confidence
marked (source) 18.0.10 → 18.0.11 age confidence
sharp (source, changelog) 0.35.3 → 0.35.4 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.11

Compare Source

Patch Changes

  • #​11499 9743d0c Thanks @​scs0209! - Fixed #​11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

  • #​11437 88f805e Thanks @​Princesseuh! - Fixed #​9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

    {options.map(() =>
  <div />
  <div />
)}

  • #​11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

  • #​11507 e2fc036 Thanks @​dyc3! - Fixed #​11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

  • #​11398 afc4615 Thanks @​dyc3! - Fixed #​11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

  • #​11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

    The refactor enabling these fixes also improves the performance of the rule.

  • #​11458 a7cd286 Thanks @​dyc3! - Fixed #​11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

  • #​11515 382b15d Thanks @​dyc3! - Fixed #​11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

  • #​11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

    const result = computed(() => list.find((item) => item.label === "a"));

    Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

  • #​11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

  • #​11407 6ef52b0 Thanks @​1678092075! - Fixed #​11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

  • #​11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

    For example, the following snippet triggers the rule:

    <div set:html={content} />

  • #​11462 18883b7 Thanks @​dyc3! - Fixed #​10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

  • #​11476 3270ca4 Thanks @​dyc3! - Fixed #​10330: Vue interpolation delimiters now stay attached to whitespace-sensitive element boundaries and adjacent inline siblings, wrapping their expression when needed to fit the configured line width. Interpolations followed by text now also converge after one formatting pass.

    -<v-btn v-if="store.state.user" variant="text" to="/my-rooms"
-  >{{ $t("nav.my-rooms") }}</v-btn
->
+<v-btn v-if="store.state.user" variant="text" to="/my-rooms">{{
+  $t("nav.my-rooms")
+}}</v-btn>

  • #​11191 3e5367f Thanks @​ematipico! - Added the nursery rule noUndeclaredCustomProperties, which reports references to custom properties that are not defined in available CSS, static HTML-like style attributes, or JSX string style attributes.

    For example, the following snippet triggers the rule:

    a { color: var(--undefined-color); }

  • #​11435 7754894 Thanks @​levrik! - Fixed: Variables and imports used as custom Vue directives are no longer reported as unused.

    For example:

    <script setup>
const vHighlight = {
  mounted: (element) => {
    element.style.color = "red";
  },
};
</script>

<template>
  <p v-highlight>Hello</p>
</template>

  • #​11501 e6acded Thanks @​aminya! - Improved the performance of useArraySortCompare by skipping type inference for calls to unrelated methods.

  • #​11467 66b282c Thanks @​dyc3! - Fixed #​11464: Biome now parses parenthesized object literals returned from arrow functions when they contain a conditional expression and a nested arrow function.

  • #​11456 db9aa2a Thanks @​dyc3! - Fixed #​10278: Marked the fix for noThisInStatic as unsafe by default.

  • #​11502 652aedb Thanks @​levrik! - noGlobalAssign no longer reports assignments to a Vue <script setup> binding from a template expression, when the binding's name happens to match a built-in global (e.g. open, parent, top).

    For example, this no longer triggers a diagnostic:

    <script setup>
const open = defineModel();
</script>

<template>
  <button @click="open = !open">Toggle</button>
</template>
withastro/astro (astro)

v7.2.9

Compare Source

Patch Changes

v7.2.8

Compare Source

Patch Changes

v7.2.7

Compare Source

Patch Changes

v7.2.6

Compare Source

Patch Changes
  • #​17812 29af6da Thanks @​matthewp! - Fixes a bug where new FetchState(request) could fail in development when server dependencies were optimized

v7.2.5

Compare Source

Patch Changes

  • #​17758 5f419e2 Thanks @​astro-factory! - Fixes a bug where experimental_getFontFileURL() rejected valid font URLs when using the Cloudflare adapter

  • #​17416 493796b Thanks @​iseraph-dev! - Skips no-op pathname writes when normalizing SSR request URLs

  • #​17712 bd374b7 Thanks @​fkatsuhiro! - Updates deprecation messages target from Astro 7 to 8

  • #​17719 dac1768 Thanks @​astrobot-houston! - Fixes session ID validation to reject non-UUID cookie values before using them as storage keys

  • #​17770 84eb7e7 Thanks @​astro-factory! - Fixes --mode, --site, --base, --out-dir, --verbose, --silent, and --open flags being silently dropped when using astro dev --background or astro preview --background

  • #​17713 d035290 Thanks @​wakqasahmed! - Fixes content-modules.mjs not removing entries for deleted or renamed content files, which could cause Vite to attempt to resolve non-existent modules

    As part of this fix, #moduleImports is now fully rebuilt from deferredRender entries before every write, so a module import added only through the public addModuleImport() API without a corresponding deferredRender entry in the store will no longer be preserved across writes.

  • #​17743 adc750f Thanks @​contactjawad! - Fixes Astro.preferredLocale and Astro.preferredLocaleList ignoring Accept-Language quality values when they are absent or 0. An entry without an explicit q= now correctly counts as quality 1.0 (per RFC 7231) and an entry with q=0 is treated as not acceptable, so the highest-quality locale is selected regardless of header order.

  • #​17757 660991c Thanks @​astro-factory! - Fixes build errors showing wrong file location, missing line:col, and misleading hints when a plugin error (e.g. from MDX) is wrapped by Vite's build error

  • #​17783 60b14ff Thanks @​matthewp! - Fixes a type error when passing an image from a content collection image() schema to a component or <Image />. The schema returned by image() was missing the apng format, so it no longer matched the type of an imported image.

  • #​17664 d483125 Thanks @​astrobot-houston! - Fixes an issue where Astro CSP support didn't correctly handle cases "unsafe-inline" resource. Now when "unsafe-inline", Astro won't emit hashes for the directive specified.

  • #​17810 0fc5f65 Thanks @​florian-lefebvre! - Fixes a regression in the content collections that could cause images to not be resolved

  • #​17781 aa33b44 Thanks @​matthewp! - Fixes memoryCache() storing responses that set cookies through Astro.cookies or Astro.session

  • #​17787 6661fbe Thanks @​astro-factory! - Fixes server:defer crashing the dev server with "undefined is not a function" when a deferred component imports from astro:i18n

  • #​17750 dd0e3ac Thanks @​dobrodob! - Fixes a regression where transition:persist stopped working for <audio> and <video> elements.

  • #​17774 fe1d16d Thanks @​astro-factory! - Adds support for importing .apng files as image metadata for use with standard <img> elements. Astro's image components reject APNG files to avoid removing their animation

  • #​17799 8797754 Thanks @​astro-factory! - Fixes i18n fallbackType: "rewrite" returning 500 instead of 404 when the fallback locale also has no matching static path for a prerendered dynamic route

  • #​17741 99d3d3d Thanks @​ericswpark! - Bumps the Astro compiler to the latest version. Changelog.

  • #​17782 3578d45 Thanks @​Princesseuh! - Improves the performance of the Astro CLI in local by enabling Node's module compilation cache.

  • #​17705 2043e4f Thanks @​astrobot-houston! - Fixes incremental builds serving cached HTML that references stale CSS filenames after a stylesheet-only edit

  • #​17754 3d50dfd Thanks @​astro-factory! - Fixes the dev server refusing to start in Docker containers after a restart due to PID reuse in the lock file check

  • #​17769 bbda94d Thanks @​astro-factory! - Fixes a build failure when defining vite.environments.ssr in the Astro config. User-provided environment config for ssr, prerender, or client is now properly deep-merged with Astro's internal environment settings instead of silently breaking the server entry naming.

  • #​17776 0874da8 Thanks @​astro-factory! - Fixes the glob() content loader failing to load files with colons in their names (e.g., Guide: Architecture.md)

  • Updated dependencies [0762a83, 0c99615]:

markedjs/marked (marked)

v18.0.11

Compare Source

Bug Fixes
lovell/sharp (sharp)

v0.35.4

Compare Source

:::note[Dependency versions]
https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3
:::

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested review from afonsojramos and setchy as code owners August 31, 2026 00:35
@renovate renovate Bot added the dependency Dependency updates label Aug 31, 2026
@netlify

netlify Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for gitify ready!

Name Link
🔨 Latest commit ef498a8
🔍 Latest deploy log https://app.netlify.com/projects/gitify/deploys/6a94cc6afd54d5000893c35d
😎 Deploy Preview https://deploy-preview-736--gitify.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@setchy
setchy merged commit 13f9ba8 into main Aug 31, 2026
12 checks passed
@setchy
setchy deleted the renovate/patch-npm-non-major branch August 31, 2026 01:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@setchy setchy Awaiting requested review from setchy setchy is a code owner
@afonsojramos afonsojramos Awaiting requested review from afonsojramos afonsojramos is a code owner

Assignees

No one assigned

Labels

dependency Dependency updates

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@setchy