fix(deps): update non-major (npm)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@agentclientprotocol/sdk	1.4.0 → 1.5.0
@anthropic-ai/claude-agent-sdk	0.3.251 → 0.3.280
@biomejs/biome (source)	2.5.11 → 2.5.14
@npmcli/arborist (source)	10.0.2 → 10.0.3
@npmcli/config (source)	11.0.1 → 11.1.0
@types/node (source)	25.9.5 → 25.9.8
@types/node (source)	26.4.0 → 26.6.2
@types/react (source)	19.2.18 → 19.3.0
@types/react-dom (source)	19.2.5 → 19.3.0
electron	44.0.0 → 44.4.5
fast-check (source)	4.9.0 → 4.10.2
jszip	3.10.1 → 3.10.2
knip (source)	6.33.0 → 6.38.0
lefthook	2.1.12 → 2.1.14
mammoth	1.12.2 → 1.12.3
next (source)	16.3.3 → 16.3.6
npm (source)	12.0.2 → 12.1.0
playwright (source)	1.62.1 → 1.63.0
postcss (source)	8.5.26 → 8.5.28
posthog-js (source)	1.422.5 → 1.434.11
react (source)	19.2.8 → 19.3.0
react-dom (source)	19.2.8 → 19.3.0
react-router-dom (source)	7.18.3 → 7.18.4
turbo (source)	2.10.12 → 2.11.3
undici (source)	8.10.1 → 8.11.0
yaml (source)	2.9.0 → 2.9.1

---

Release Notes

agentclientprotocol/typescript-sdk (@​agentclientprotocol/sdk)

v1.5.0

Compare Source

Features

• update schemas to v1.22.0 and v2.0.0-alpha.4 (#​253) (a9f08bd)
• update schemas to v1.23.0 and v2.0.0-alpha.5 (#​255) (f7941e7)

anthropics/claude-agent-sdk-typescript (@​anthropic-ai/claude-agent-sdk)

v0.3.280

Compare Source

• Added optional fireReason to the task-notification SDKMessageOrigin; a local host's declared scheduled-task fire is honored only in a process it started with CLAUDE_CODE_HOST_SCHEDULED_RUN=1
• Added verbatimPrompts option: prompts are delivered as written — no @path expansion, no slash-command dispatch and, on current CLIs, no ambient attachments with the prompt (Claude Code 2.1.248+)
• Added _meta to mcpServerStatus() tool entries, carrying a tool's MCP Apps ui metadata so a host can find its ui:// resource
• Added readMcpResource() (alpha) to read an MCP Apps ui:// resource from an MCP server that Claude Code connected
• Improved askSideQuestion(): asked while a turn is running, it now sees that turn (its prompt, replies and finished tool results so far) instead of only the last completed turn
• Improved unattended retry (CLAUDE_CODE_RETRY_WATCHDOG): a usage-limit wait emits rate_limit_event (rejected, resetsAt) as it begins; api_retry heartbeats continue while sub-agent work waits
• Changed session_state_changed events (CLAUDE_CODE_EMIT_SESSION_STATE_EVENTS=1) to report requires_action while an MCP elicitation waits on the user, as for permission prompts
• Changed headless sessions to cancel an MCP server's pending form question when the tool call that drew it ends
• Updated to parity with Claude Code v2.1.280

v0.3.278

Compare Source

• Updated to parity with Claude Code v2.1.278

v0.3.277

Compare Source

• Added an optional builtin field to SlashCommand, set when a command is built into Claude Code
• Added pasted_content to SDKUserMessage: text the user pasted rather than typed, appended after the typed prompt
• Added optional remote-session latency fields (first_text_post_ms, first_text_post_wall_ms, first_stream_post_queue_wait_ms, first_stream_post_queued_behind) to the success result message
• Added 'userSettings' as an updateSettings() source, accepting only effortLevel, which is saved for the session's current model as /effort saves it
• Fixed a resumed or forked session's total_cost_usd, modelUsage and get_usage totals starting at zero instead of continuing from the earlier turns (maxBudgetUsd is unchanged)
• Changed SDKUsageReport usage rows to always carry severity and is_active: the report relays only rows from a live server reply, and none while the usage fetch is failing
• Updated to parity with Claude Code v2.1.277

v0.3.276

Compare Source

• Updated to parity with Claude Code v2.1.276

v0.3.275

Compare Source

• Fixed a deferred tool call's result being emitted with internal keys such as toolUseResult instead of tool_use_result when the tool re-runs at the start of a resumed turn
• Fixed getSessionMessages() and forkSession() sometimes missing a turn's assistant message when called right after the turn's result message
• Fixed forkSession({ upToMessageId }) rejecting a client-supplied SDKUserMessage.uuid that is not in UUID format
• Fixed forkSession rejecting the id that getSessionMessages returns for a message sent while Claude was working, and a fork showing a re-run prompt twice
• Fixed getSessionMessages() omitting a task notification or other queued message that Claude read while running a tool; it now comes back where Claude read it
• Updated to parity with Claude Code v2.1.275

v0.3.274

Compare Source

• Added startup_failure_reason to the error result a stream-json run writes before exiting on a known startup failure
• Added mcpServer: {name, source} to canUseTool options, mcp_server to tool hook inputs, and source to MCP server status rows, so hosts can key trust on source === "sdk"
• Added CLAUDE_CODE_MCP_STARTUP_WAIT_MS (pass via env) to bound or disable (0) the first-turn wait for connecting MCP servers
• Added CLAUDE_CODE_EMIT_STARTUP_TIMING=1 for stream-json hosts: the session's first system/init then carries the per-phase startup_timing breakdown that cloud sessions already emit
• Fixed getSessionMessages() omitting a message the user sent while Claude was running a tool; it now comes back as a user message where Claude read it
• Fixed missing origin: {kind: 'task-notification'} on the replayed user message when a background task finishes during a running turn (--replay-user-messages)
• Improved startup: the first turn no longer waits up to 2s for connecting MCP servers from settings files or plugins whose tools tool search defers; options.mcpServers servers are still awaited
• Changed queued background-task completions to share one model call: each still gets its own result, all but the last empty with num_turns: 0
• Updated to parity with Claude Code v2.1.274

v0.3.273

Compare Source

• Added a usage_report sibling (SDKUsageReport: session totals, the plan's usage rows as the server sends them, extra usage) on the assistant message that delivers a headless /usage result
• Added reason: "worker_restart" to task_notification messages when a background task was stopped by a worker process restart
• Added a one-line transcript notice when the SDK host's Stop or SessionStart hook callback times out, shown once until the host answers again
• Fixed a Stop, SubagentStop or SessionStart hook callback that exceeds its timeout being reported as a hook failure and discarding other hooks' decisions; it now counts as no decision
• Fixed the browser SSE transport dropping the live slash-command list update (system/commands_changed)
• Updated to parity with Claude Code v2.1.273

v0.3.272

Compare Source

• Updated to parity with Claude Code v2.1.272

v0.3.271

Compare Source

• Added optional omitClaudeMd to AgentDefinition in the agents option, so a subagent can run without user, project and local CLAUDE.md files; managed policy files still load
• Fixed listSessions, getSessionMessages and getSessionInfo with dir on Windows not finding sessions for a directory on a mapped network drive or SUBST drive
• Fixed sessionStore resume losing the global config when it is stored under the legacy .config.json name or an OAuth-suffixed file name
• Removed persistent from the MonitorInput tool type
• Updated to parity with Claude Code v2.1.271

v0.3.270

Compare Source

• Updated to parity with Claude Code v2.1.270

v0.3.269

Compare Source

• Changed user_message_uuid, user_message_uuids and resume_reason to be stamped on a turn's first complete assistant message as well as its first stream event when partial messages are on
• Fixed result.permission_denials omitting Read, Edit and Write calls blocked by a path-scoped deny rule
• Fixed interrupts and permission responses being delayed while a host-started MCP server OAuth sign-in waited on a slow authorization server
• Fixed missing tool_use_id on task_started / task_notification when the CLI resumes a background subagent on its own; they now carry the agent's last call id
• Changed plan mode to route writes through canUseTool even when allowDangerouslySkipPermissions is set; the flag now only enables switching to bypassPermissions later
• Updated to parity with Claude Code v2.1.269

v0.3.268

Compare Source

• Added result_index to result messages: the result's position in delivery order within the run, from 0
• Added local_command to the result message of a turn that ran a slash command without entering the model loop, carrying the command's name
• Added hold_on_cache_impact to the reload_plugins control request (Query.reloadPlugins({ holdOnCacheImpact: true })): holds a reload that would invalidate the session's prompt cache
• Added resume_reason to assistant, stream-event and result messages, set only on the automatic re-run of a turn a host restart interrupted
• Added kind (used, free, buffer, deferred) to each category in the get_context_usage control response, matching the /context result's context_usage rows
• Added optional defaultToNo and suppressAlwaysAllowRule hints to canUseTool options: the prompt should open on its decline option, or offer no persistent "always allow" choice
• Changed setModel() to confirm a model id the CLI doesn't know locally with the API the first time a session uses it, instead of refusing it as unrecognized
• Changed user_message_uuid on the automatic re-run of an interrupted turn to name that turn's last user prompt
• Changed the initialize success response to always include pending_permission_requests (empty when nothing is pending), so clients can tell that apart from an older CLI
• Changed the task-tracking tools (TaskCreate/Get/Update/List, TodoWrite) to be default tools only on Claude 3.x, Opus 4.0–4.7, Sonnet 4.0–4.6 and Haiku 4.5; elsewhere list them in tools/allowedTools
• Updated to parity with Claude Code v2.1.268

v0.3.267

Compare Source

• Added getCcrEvent(query, message) and getSseLastSequenceNum(query) to the browser SDK's SSE transport, plus fromSequenceNum, onCatchUpTruncated and onDeliveryUpdate SSE options
• Changed systemPrompt recording to default on for custom prompts and appends (a mid-session prompt change takes effect at the next compaction); pass snapshot: false to keep per-request rendering
• Updated to parity with Claude Code v2.1.267

v0.3.266

Compare Source

• Updated to parity with Claude Code v2.1.266

v0.3.265

Compare Source

• Added user_message_uuid and user_message_uuids to a synthetic turn's first reply and result for a message sent with isSynthetic: true and a uuid, naming the message that started it
• Added user_message_uuid and user_message_uuids to the first reply and the result of a turn Claude Code started itself, such as a resume, naming the messages you sent that it picked up mid-turn
• Fixed user_message_uuid missing from the success result of a turn that sent no API request, such as a slash command
• Fixed multi-turn sessions resetting the shell working directory to the cwd option at each new user message; a cd made by the agent now persists across turns, as in the interactive app
• Changed user_message_uuid to be set on the first reply after each change of the message a turn is answering, instead of on one reply frame per turn
• Updated to parity with Claude Code v2.1.265

v0.3.263

Compare Source

• Updated to parity with Claude Code v2.1.263

v0.3.261

Compare Source

• Added pluginDelivery: 'initialize' to send plugins over stdin so the launch command line no longer grows with the plugin count (fixes Windows start failures with many plugins)
• Fixed query() throwing "Object not disposable" in runtimes without a native Symbol.dispose, such as Node ≤22 vm contexts (Jest's node environment, vitest vmThreads/vmForks) and Node <18.18
• Updated to parity with Claude Code v2.1.261

v0.3.260

Compare Source

• Added optional user_message_uuid to thinking_tokens system messages, linking thinking progress to the user message that triggered the turn
• Added optional first_content_frame_ms, first_stream_post_ms, first_stream_post_ack_ms and first_stream_post_wall_ms fields to the success result message for remote-session latency breakdowns
• Fixed managedSettings disableAutoMode: "disable" (either spelling) being dropped by the restrictive-only filter instead of turning auto mode off for the spawned session
• Fixed rewindFiles() reporting success when no files could be restored (for example when checkpoint backups are missing); it now fails
• Changed error_max_structured_output_retries results to append the last StructuredOutput tool error; validation errors now name the offending key, allowed values, and actual length or count
• Changed rate_limit_event to also re-emit during an exceeded window on repeat 429s (about once per 30 seconds per limit window), so stream consumers can refresh stale rate-limit state
• Updated to parity with Claude Code v2.1.260

v0.3.259

Compare Source

• Added user_message_uuids beside user_message_uuid on a turn's first reply frame and result: every user message the turn answered, so a reply to several merged messages can be matched to each
• Added permissionPrompts: 'none' option to auto-deny permission prompts in sessions with nobody to answer them, without disabling auto mode's classifier
• Updated to parity with Claude Code v2.1.259

v0.3.258

Compare Source

• Updated to parity with Claude Code v2.1.258

v0.3.257

Compare Source

• Added thinkingTokens to ModelUsage (a subset of outputTokens), and fixed result-message usage.output_tokens_details.thinking_tokens reporting 0 instead of the session's real count
• Added tool_use_result.resourceLinks on user messages carrying MCP tool results: the resource_link blocks the tool returned, so hosts can render returned files without parsing the result text
• Added optional resource_links to task_notification for an auto-backgrounded MCP tool call that completed, listing the files it returned by reference; join to the call via tool_use_id
• Fixed mcp_reconnect and mcp_toggle acting on a same-named .mcp.json / ~/.claude.json server instead of the --mcp-config or mcp_set_servers one
• Fixed mcp_toggle disable also removing the tools of a sibling MCP server whose name extends the disabled one's (disabling foo dropped foo__bar's tools)
• Changed mcp_set_servers to also list a server whose connection attempt throws under added (with a failed row in mcp_status), not only under errors
• Changed Agent tool calls to emit the periodic tool_progress heartbeat (heartbeat: true) like other long tools; heartbeat frames never clear a subagent_retry indicator
• Fixed the browser SDK bundle (@anthropic-ai/claude-agent-sdk/browser) never streaming any messages on engines without native Symbol.dispose (Safari/iOS, Firefox ESR, older Chromium)
• Fixed a background Bash task that is still running when a stream-json session ends right after an interrupt (stdin closed) never receiving its final task_notification
• Fixed -p giving up on a long-running background subagent without actually stopping it, so background_tasks_changed kept listing it and events for it arrived after its stopped notification
• Added detail option to Query.getContextUsage(): 'summary' answers from the last response's usage and local estimates without per-category token-count API calls (default 'full')
• Updated to parity with Claude Code v2.1.257

v0.3.252

Compare Source

• Updated to parity with Claude Code v2.1.252

biomejs/biome (@​biomejs/biome)

v2.5.14

Compare Source

Patch Changes

• #​9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #​11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #​11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #​11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #​11461 22e9966 Thanks @​FoundDream! - Fixed #​11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #​11766 c2542c6 Thanks @​dyc3! - Fixed #​11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #​11790 17d0ff0 Thanks @​ematipico! - Fixed #​10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

• #​11777 7ee3a6c Thanks @​ematipico! - Fixed #​7573: added the requireExplicitCase option to useExhaustiveSwitchCases. When set to true, the rule reports missing cases even when the switch has a default clause, so you can keep a runtime fallback while checking that every value in the union has its own case. The option defaults to false.

• #​11751 d37f24b Thanks @​ematipico! - Fixed #​8347: the fix from useConsistentArrowReturn now parenthesizes returned expressions that begin with object literals before removing the arrow function body braces, preventing invalid output for expressions such as object property access.

• #​11784 46e8912 Thanks @​dyc3! - Fixed #​11782: noUndeclaredCustomProperties could hang while checking stylesheets imported by JavaScript modules with many shared dependencies.

• #​11731 1534885 Thanks @​ematipico! - Fixed #​7984: The fix from useSimplifiedLogicExpression now preserves line breaks in multiline conditions with line comments, preventing the right-hand side condition from being commented out.

• #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​7304: the HTML formatter now preserves authored segment breaks between CJK characters, and next to CJK punctuation, instead of replacing them with spaces.

   <div lang="zh-Hant-TW">
  -  這個段落是那麼長， 在一行寫不行。
  +  這個段落是那麼長，
  +  在一行寫不行。
   </div>

• #​11749 ff992a1 Thanks @​ematipico! - Fixed #​11747: formatting and checking large parenthesized object expressions no longer exhibit quadratic slowdowns.

• #​11736 1dd1fc4 Thanks @​dyc3! - Fixed #​8177: code actions no longer modify the wrong part of Vue, Svelte, or Astro files when experimental full HTML support is disabled.

• #​11743 3835945 Thanks @​santichausis! - Fixed #​10247: biome check --write/biome lint --write now correctly writes fixes for code inside an HTML attribute expression (for example a Svelte onclick={...} handler, or a mustache expression like {count}), instead of silently reporting the diagnostic as fixable and applying nothing.

  For example, running biome lint --write --unsafe for useBlockStatements (an unsafe fix) on this Svelte component used to leave the file unchanged:

  <button onclick={() => { if (open) close(); }}>Close</button>

• #​11740 8ea8b4a Thanks @​dyc3! - Fixed #​11453: useConsistentTestIt now updates imports alongside calls, preserving the original export through an alias. The rule ignores locally declared functions and withholds fixes when the preferred name would conflict with another binding or global reference.

• #​11355 27177ca Thanks @​dyc3! - Fixed the HTML formatter incorrectly applying native HTML element formatting to PascalCase component names such as <Ul> and <Body> in Vue, Svelte, and Astro files.

  -<Body>
  -  <div>content</div>
  -</Body>
  +<Body><div>content</div></Body>

• #​11355 27177ca Thanks @​dyc3! - Fixed the HTML formatter incorrectly applying SVG block formatting to unknown elements whose names matched SVG element names.

  -<foreignobject>
  -  <div>content</div>
  -</foreignobject>
  +<foreignobject><div>content</div></foreignobject>

• #​11741 fc69047 Thanks @​dyc3! - Fixed #​8893: useImportExtensions no longer suggests adding .ts to .jsx imports when a colocated .d.ts file provides type declarations.

• #​11642 c87341c Thanks @​dyc3! - Added the nursery rule useConsistentFunctionStyle, which requires a consistent style for defining functions.

  By default, the rule reports the following declaration because it requires a function expression assigned to a variable:

  function greet() {
      return "Hello";
  }

• #​11770 ddfd622 Thanks @​dyc3! - Fixed #​8980: suppression comments targeting the entire assist category are now respected, including biome-ignore-all assist when running check.

• #​11792 7a4b895 Thanks @​dyc3! - Fixed dashed utility base names in the Tailwind parser, including border-bs, font-features, and scrollbar-thumb. Classes such as min-inline-[12rem] now preserve the complete base name and parse the arbitrary value separately.

• #​11739 1fc17e3 Thanks @​Netail! - The rule useIncludes now also reports lastIndexOf() comparisons and some() calls with a strict-equality callback.

  arr.lastIndexOf(x) !== -1
  
  arr.some(item => item === x)

• #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​6888. GritQL plugins can now use contains on import-clause metavariables such as $clause in import $clause from "module" patterns.

• #​11790 17d0ff0 Thanks @​ematipico! - Fixed #​11786: useAnchorContent now reports anchors without accessible content in HTML, Astro, Vue, and Svelte even when they have an aria-label, aria-labelledby, or title attribute, matching JSX behavior.

• #​11651 a9c4aa0 Thanks @​saberoueslati! - Added the new nursery rule noVueUndeclaredDirectives, which reports custom Vue directives that are not declared by a <script setup> binding, the component's directives option, or the rule's globals option. Closes #​11478.

  <template>
    <!-- v-highlight is not declared anywhere -->
    <div v-highlight></div>
  </template>

  Aliased named imports in single-file components are now tracked under their local name, so noUndeclaredVariables recognizes vHighlight in import { highlight as vHighlight } from "./directives".

• #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​7795. The noJsxLiterals rule now ignores surrounding whitespace when matching literals against allowedStrings.

• #​11780 99c7049 Thanks @​ematipico! - Fixed false positives in useExhaustiveSwitchCases when numeric cases use different spellings of the same value. For example, case 0x1 now covers the numeric literal type 1.

• #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7880: noUselessStringConcat no longer reports literal concatenations split across multiple lines when a numeric literal ends the chain.

• #​11355 27177ca Thanks @​dyc3! - Improved performance of the HTML formatter for documents that contain many HTML-native or SVG-native tags.

• #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7949: useReadonlyClassProperties now reports static class properties that are never reassigned.

• #​11751 d37f24b Thanks @​ematipico! - Fixed #​7644: useImportExtensions now resolves path aliases declared by referenced TypeScript project configurations.

• #​11791 f88793c Thanks @​dyc3! - Fixed a false positive in useTailwindShorthandClasses for strings in conditional tests, such as cn(m === "w-2 h-2" ? "bg-red-800" : "bg-red-400").

• #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7783: noNoninteractiveElementInteractions no longer reports event handlers on native <dialog> elements.

• #​11733 7030068 Thanks @​dyc3! - Fixed #​11730: useExhaustiveSwitchCases reports missing cases when iterating over a class property with for...of.

• #​11717 2107dae Thanks @​ternaus! - Fixed #​11716: the noUnknownAttribute rule now accepts fullscreen event handlers, the credentialless iframe property, and the SVG maskType property when the React dependency range allows React 19.3 or later. The credentialless and maskType properties are restricted to <iframe> and <mask> elements, respectively.

• #​11737 b7e3559 Thanks @​dyc3! - Fixed #​11692: noFloatingPromises now detects unhandled promises returned through generic method signatures, including Playwright fixtures.

• #​11780 99c7049 Thanks @​ematipico! - Fixed #​7747: useExhaustiveSwitchCases now reports missing cases for literal unions derived from const tuples with (typeof values)[number] and objects with keyof typeof object.

  Other type-aware rules, including noFloatingPromises and noUselessTypeConversion, also recognize supported indexed-access results.

• #​11724 a9a5e9a Thanks @​dyc3! - Fixed redundant parentheses around binary and logical unary operands with leading line comments.

   !(
     // leading
  -  (a || b)
  +  a || b
   );

• #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​7722: noUnusedImports no longer reports type-only imports used in computed names of declared class properties.

• #​11731 1534885 Thanks @​ematipico! - Fixed #​6390: Biome now offers suppression actions for noDynamicNamespaceImportAccess in editors.

• #​11751 d37f24b Thanks @​ematipico! - Fixed #​7533: noDescendingSpecificity no longer compares selector specificity across separate cascade layer blocks.

• #​11735 9bd70c7 Thanks @​ematipico! - Fixed #​6206: useUniqueElementIds no longer reports static IDs on elements in SVG contexts.

  <svg>
      <defs>
          <pattern id="dots" width="10" height="10" />
      </defs>
      <rect fill="url(#dots)" width="100%" height="100%" />
  </svg>

• #​11715 f05a3c3 Thanks @​ematipico! - Fixed #​5447, so the GitHub reporter now associates annotations with the correct files when Biome runs from a nested directory.

• #​11720 c7c4e2b Thanks @​ematipico! - Fixed #​7816: useHookAtTopLevel no longer reports methods named like hooks when called on another function's result, such as Reactotron.configure(...).useReactNative(...).

• #​11355 27177ca Thanks @​dyc3! - Removed special HTML formatter handling for the obsolete <listing> element.

• #​11731 1534885 Thanks @​ematipico! - Fixed an issue where Grit plugin code fixes weren't available as editor code actions.

• #​11726 dea163f Thanks @​dyc3! - Fixed #​11722: the JavaScript formatter inserts a newline before the closing angle bracket when a leading comment forces type arguments onto multiple lines.

   type Foo = Record<
     // comment
     string,
  -  number>;
  +  number
  +>;

• #​9758 02ea438 Thanks @​Netail! - Added the nursery rule [noJsonUnsafeValues](ht

❗ Important

✂ PR body was truncated to here.

[vercel]

Deployment failed for project careerrat-website with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EOVERRIDE
npm error Override for postcss@8.5.28 conflicts with direct dependency
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-26T12_47_35_683Z-debug-0.log

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
careerrat-website	Ready	Preview	Sep 26, 2026 12:48pm UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: CodesWhat/careerrat/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8ee04d09-b79f-4310-9147-bc852b0c0d3a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}