chore(deps): bump the minor-and-patch group with 27 updates

[dependabot]

Bumps the minor-and-patch group with 27 updates:

Package	From	To
@ai-sdk/provider-utils	5.0.34	5.0.36
@astryxdesign/cli	0.5.2	0.5.3
@astryxdesign/core	0.5.2	0.5.3
@biomejs/biome	2.5.11	2.5.12
@types/node	26.4.0	26.4.1
knip	6.33.0	6.34.0
@ai-sdk/anthropic	4.0.46	4.0.49
@ai-sdk/code-mode	1.0.42	1.0.50
@ai-sdk/cohere	4.0.35	4.0.37
@ai-sdk/google	4.0.58	4.0.64
@ai-sdk/open-responses	2.0.36	2.0.39
@ai-sdk/openai	4.0.52	4.0.60
@ai-sdk/openai-compatible	3.0.41	3.0.44
@ai-sdk/provider	4.0.9	4.0.10
@larksuiteoapi/node-sdk	1.73.0	1.73.3
ai	7.0.85	7.0.93
socks	2.8.9	2.8.10
undici	8.10.1	8.10.2
@earendil-works/pi-tui	0.84.4	0.85.1
katex	0.18.5	0.18.7
lucide-react	1.38.0	1.41.0
@types/react-dom	19.2.5	19.2.7
@astryxdesign/theme-neutral	0.5.2	0.5.3
@playwright/test	1.62.1	1.63.0
@storybook/react-vite	10.5.10	10.6.0
simple-icons	16.29.0	16.30.0
storybook	10.5.10	10.6.0

Updates @ai-sdk/provider-utils from 5.0.34 to 5.0.36

Changelog

Sourced from @​ai-sdk/provider-utils's changelog.

5.0.36

Patch Changes

• 6bcc0f8: Update Undici to a version patched for CVE-2026-13697.

5.0.35

Patch Changes

• 5190b67: feat(provider): extend the FilesV4 interface with optional getFileMetadata, downloadFile (streaming), and deleteFile operations, plus abortSignal/headers call options and a { type: 'stream' } upload data variant; upload results now expose byteSize, createdAt, and expiresAt (also surfaced by the core uploadFile() helper, which now forwards abortSignal/headers); add postMultipartStreamToApi (streaming multipart uploads with deterministic part ordering and failure-path stream teardown), deleteFromApi, and createBinaryStreamResponseHandler to provider-utils
• Updated dependencies [5190b67]
  • @​ai-sdk/provider@​4.0.10

Commits

• 8a09c78 Version Packages (#20144)
• 6bcc0f8 fix(provider-utils): update undici for CVE-2026-13697 (#20165)
• 3bd0fcf Version Packages (#20126)
• 5190b67 feat(provider): add optional getFileMetadata/downloadFile/deleteFile to Files...
• See full diff in compare view

Updates @astryxdesign/cli from 0.5.2 to 0.5.3

Release notes

Sourced from @​astryxdesign/cli's releases.

Astryx v0.5.3

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.3 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes. Nothing else in the header becomes a target. The end area is a layout row — flex, wrap, and the edge compensation that lets its buttons overhang the header padding — not a painted surface, and a theme that wants the header to grow around its buttons instead of letting them overhang sets padding-block on the existing banner target, which reaches the same height without exposing a private margin. The title, the two controls and the text column are likewise left alone: the column paints nothing (display: flex; flex-direction: column; gap: 0) and the space it owns is expressible on banner-description, while the title and the controls already render the way the consuming theme wants them.

• Add nativePicker to DateTimeInput for browser and OS date/time pickers, with Astryx time fallbacks for seconds, custom increments, and preset options. Native fields follow DateInput's compact minimum sizing in fit-content layouts. (#5620)

• Let themes add typed Heading visual roles with a safe semantic-level fallback when the owning theme styles are unavailable. (#6026)

• RadioListItem and CheckboxListItem accept rich label and description (#5257) RadioListItem typed label and description as string while its sibling CheckboxListItem already typed label as ReactNode — so the same slot had two contracts, and an app whose option descriptions carry links could not type them on either component. Both now take ReactNode; the runtime already rendered it.

  RadioListItem gains the aria-label escape hatch CheckboxListItem established, with the same meaning: a plain-text accessible name for the control. The radio differs in one way worth knowing — it points at its visible label for its accessible name, so a rich label still names it from its own text, and aria-label is there to narrow a name that reads badly rather than to supply a missing one. aria-label now lands on the radio instead of the row <div>, where ARIA ignored it.

• Stepper: --step-connector-gap, so a theme can stop the on-track connector short of the indicator The on-track layouts draw the connector as one segment either side of the node. A theme that wants the track to leave a hole around the indicator had to reach the two segments separately, and they are only distinguishable by sibling position — which changes with indicator="none".

  One public var does it instead, declared on the Stepper root because component vars are root-owned: a theme writes stepper: {base: {'--step-connector-gap': '4px'}} and every connector inherits it. Astryx spends it on whichever side each segment faces the node from, so the pair leaves a symmetric hole and the caller never names the pieces. 0px by default: the shipped track still reads as one unbroken line.

  Measured in Chromium against a built theme override, reading painted pixels down a 12px segment:

  | value | clipped away | stepper height | | ------- | ------------- | -------------- | | 6px | 6px | unchanged | | -4px | 0 | unchanged | | 1rem | capped to 8px | unchanged | | 999px | capped to 8px | unchanged | | 10% | 1px (of 12px) | unchanged | | 50% | capped to 6px | unchanged |

  Four things that had to be true and are:

  A theme override reaches it. The default is declared once on the root, not on each connector. Declared per-connector, every connector re-declared 0px on itself, and a value declared on an element beats an inherited one — so a generated stepper override compiled cleanly and changed nothing.

  The value is bounded, and both halves earn it — neither for padding's reasons. max(0px, …) because inset() accepts a negative length: Chromium computes inset(0 0 -4px 0) as written rather than clamping it the way it clamps negative padding, so the floor has to be declared. min(…, --spacing-2) — the flexible segment's own min-height — so an oversized gap leaves a short track rather than an unbounded one. Neither can grow the Stepper; a clip cannot change layout. (An earlier padding-based revision grew a three-step Stepper 108px → 144px at 1rem.)

  The horizontal clip mirrors under dir="rtl". clip-path: inset() is physical — top/right/bottom/left, no logical form — while the row itself reverses. Left unflipped, the leading segment sits to the right of the node in RTL and still clipped its right edge, so the hole opened at the join between steps instead of at the indicator. Measured before the fix: con0 x=622, indicator x=606, clips RIGHT edge. After: clips LEFT edge, with LTR unchanged. The block axis needs no handling — dir does not reverse it.

... (truncated)

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.5.3

New Components

• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Reuse Neutral-owned local tokens for semantic status fills across badges, status dots, step indicators, and progress bars. (#5854)
• Add Neutral's reproducible, theme-owned OKLCH palette without changing its runtime token mappings. The request, receipt, generated result, and CLI template artifacts are committed together for review. (#5987)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Add the checkout wizard page template. (#5660)

• CLI: record every command run and hand it to a function you supply. (#4812)

  // astryx.config.mjs
  export default {
    debug: event => appendFileSync('runs.ndjson', JSON.stringify(event) + '\n'),
  };

  That is the whole feature. Setting debug opts in; the function receives one DebugEvent per invocation and decides what happens to it. The CLI stores nothing.

  Each event carries the command, its arguments and flags (with their Commander source, so you can tell a typed flag from a default), the outcome, exit code, duration, error code, a coarse environment snapshot including which coding agent invoked the CLI, and — under output — everything the command printed to stdout and stderr. That last part is the answer the user actually got, which is what makes a record useful for improving the output rather than just counting invocations. Streams are captured separately with their true byte counts, and truncated past 32KB per stream so a command that prints a whole file does not dominate the record. Coverage is the point: handled errors, parse errors, --help, rejected invocations, uncaught throws, and Ctrl-C all report. The event is delivered from a process.on('exit') listener because the CLI's error path exits synchronously — anything hooked to normal completion would report successes and almost no failures — and the handler is loaded before parsing, because parse errors and --help short-circuit before any hook runs.

  event is a published contract: DebugEvent is exported from @astryxdesign/cli/debug with a sealed zod validator, parseDebugEvent, drift-locked to the type so the recorder cannot add a field without publishing it. schemaVersion is a literal, so widening it turns every consumer's branch into a compile error rather than a silent misread.

  The handler runs synchronously at exit — a returned promise is never awaited, so network delivery from inside it will not work; write a file or spawn a detached child. It receives a copy, so a handler that throws, or mutates what it was given, can neither fail the command nor affect anything else. Follow-up hardening keeps a handler from replacing the command's exit code and routes handler writes away from stdout so a --json envelope stays valid. (#5929)

  Nothing changes for a project that has not set debug. Startup is unmoved: the environment probe is deferred to delivery rather than run in begin, because its first Intl call initialises ICU and that alone was ~9% of the CLI's startup for everyone. Nor does the config run: Project.load evaluates the config module and loads its integrations, which most commands never did, so the file is read as text first and only loaded when the word debug appears in it. Measured across eight commands, no command evaluates a config that did not already.

  Values are scrubbed before delivery: home paths, absolute paths inside stack frames, email addresses, URL credentials, credential-shaped strings, and the value half of a sensitive assignment wherever it appears — including where an error message, a stack frame and the captured stderr all quote the flag that was rejected. Sensitive names are matched with - and _ stripped, so --api-key, --api_key and --apiKey are one rule; key, pat and pw are matched whole so they do not take --keyboard and --path with them. argv is scrubbed pairwise, so --token hunter2 loses its value the way --token=hunter2 does. Oversized values are clamped.

  Hardened against three adversarial chaos runs and an independent review, each finding mutation-tested before its fix landed: a __proto__ key silently reparenting the record that carried it, one oversized value discarding the whole event, an exit that bypassed cliError being indistinguishable from a classified failure, a signal-terminated run leaving no record at all, a sensitive --flag=value scrubbed in argv but written back out in full through the error message and captured stderr that quote it, absolute paths surviving inside stack frames — where nothing puts whitespace in front of them — and taking the machine's username with them, a graceful Ctrl-C recorded as a failure with an exit code the process never returned, --api-key and --token value reaching a handler intact, and the two startup costs above.

  One change reaches beyond this feature: installJsonShim now shims commands as they join the command tree rather than in a single walk at startup, so a command registered later can no longer silently fall out of the --json contract.

• CLI: astryx init --json now works. It emits the install receipt as a standard envelope — init.run with the mode, the features that ran, the agent-doc files written, any soft docsError, and the template outcome, or init.remove for --remove-agents. Human output is suppressed so stdout carries only the envelope, and the exit code is unchanged from human mode. (#4812) init was the last side-effecting command still refused by the --json gate. That gate existed to stop a command writing half a project and only then reporting that --json was unsupported; since init() already returned a typed receipt, the fix was to emit it rather than to keep refusing. theme and layout remain off the allowlist, but both are command groups with no output of their own.

• Add result and agent-session context to DebugEvent (#5971)

• Add the dialog wizard page template. (#5798)

• Let themes add typed Heading visual roles with a safe semantic-level fallback when the owning theme styles are unavailable. (#6026)

• Add the form wizard page template. (#5664)

• Add the inline wizard page template. (#5797)

• An integration can now supply a debug handler, so installing it turns on its debug logs with no change to the app. Export debug from astryx.integration.*; the app's own debug still runs, both get every event, and a handler that throws cannot affect the command. Opt out with {"astryx": {"inheritDebug": false}}. (#5998)

• Mute the low-tone edge of Neutral's dark chromatic palette while preserving its light and neutral ramps. (#6069)

• Rebuild the table-page template as a searchable, filterable, sortable table pattern with filter-aware totals, row detail, a scrolling document masthead, and guidance organized around narrowing, sorting, and communicating filtered state. (#5865)

... (truncated)

Commits

• ad49392 chore: version packages for v0.5.3 (#6087)
• b2e6a1d fix(theme-neutral): tune destructive and non-semantic surfaces (#6049)
• cde73c7 fix(theme-neutral): map tokens to reviewed palette (#6034)
• b1fcbee feat(core): support custom Heading visual types (#6026)
• 5aca971 feat(templates): add the vertical wizard page template (#5672)
• 0ccad5b feat(theme-neutral): mute dark palette edge (#6069)
• 05b679c feat(templates): add the checkout wizard page template (#5660)
• b76e3c8 feat(templates): add the form wizard page template (#6072)
• 63a0bcd feat(core): let Stepper collapse itself in narrow containers (#5659)
• 093c131 docs(core): improve getting started theme list (#5032)
• Additional commits viewable in compare view

Updates @astryxdesign/core from 0.5.2 to 0.5.3

Release notes

Sourced from @​astryxdesign/core's releases.

Astryx v0.5.3

[!WARNING] Stepper context compatibility: v0.5.3 changed the package-exported StepperContextValue / useStepperContext shape. Ordinary <Stepper> and <Step> usage is unaffected, but consumers that call the context hook directly or construct StepperContextValue should remain on v0.5.2 while a source-compatible repair is evaluated. See #5659.

Astryx 0.5.3 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes. Nothing else in the header becomes a target. The end area is a layout row — flex, wrap, and the edge compensation that lets its buttons overhang the header padding — not a painted surface, and a theme that wants the header to grow around its buttons instead of letting them overhang sets padding-block on the existing banner target, which reaches the same height without exposing a private margin. The title, the two controls and the text column are likewise left alone: the column paints nothing (display: flex; flex-direction: column; gap: 0) and the space it owns is expressible on banner-description, while the title and the controls already render the way the consuming theme wants them.

• Add nativePicker to DateTimeInput for browser and OS date/time pickers, with Astryx time fallbacks for seconds, custom increments, and preset options. Native fields follow DateInput's compact minimum sizing in fit-content layouts. (#5620)

• Let themes add typed Heading visual roles with a safe semantic-level fallback when the owning theme styles are unavailable. (#6026)

• RadioListItem and CheckboxListItem accept rich label and description (#5257) RadioListItem typed label and description as string while its sibling CheckboxListItem already typed label as ReactNode — so the same slot had two contracts, and an app whose option descriptions carry links could not type them on either component. Both now take ReactNode; the runtime already rendered it.

  RadioListItem gains the aria-label escape hatch CheckboxListItem established, with the same meaning: a plain-text accessible name for the control. The radio differs in one way worth knowing — it points at its visible label for its accessible name, so a rich label still names it from its own text, and aria-label is there to narrow a name that reads badly rather than to supply a missing one. aria-label now lands on the radio instead of the row <div>, where ARIA ignored it.

• Stepper: --step-connector-gap, so a theme can stop the on-track connector short of the indicator The on-track layouts draw the connector as one segment either side of the node. A theme that wants the track to leave a hole around the indicator had to reach the two segments separately, and they are only distinguishable by sibling position — which changes with indicator="none".

  One public var does it instead, declared on the Stepper root because component vars are root-owned: a theme writes stepper: {base: {'--step-connector-gap': '4px'}} and every connector inherits it. Astryx spends it on whichever side each segment faces the node from, so the pair leaves a symmetric hole and the caller never names the pieces. 0px by default: the shipped track still reads as one unbroken line.

  Measured in Chromium against a built theme override, reading painted pixels down a 12px segment:

  | value | clipped away | stepper height | | ------- | ------------- | -------------- | | 6px | 6px | unchanged | | -4px | 0 | unchanged | | 1rem | capped to 8px | unchanged | | 999px | capped to 8px | unchanged | | 10% | 1px (of 12px) | unchanged | | 50% | capped to 6px | unchanged |

  Four things that had to be true and are:

  A theme override reaches it. The default is declared once on the root, not on each connector. Declared per-connector, every connector re-declared 0px on itself, and a value declared on an element beats an inherited one — so a generated stepper override compiled cleanly and changed nothing.

  The value is bounded, and both halves earn it — neither for padding's reasons. max(0px, …) because inset() accepts a negative length: Chromium computes inset(0 0 -4px 0) as written rather than clamping it the way it clamps negative padding, so the floor has to be declared. min(…, --spacing-2) — the flexible segment's own min-height — so an oversized gap leaves a short track rather than an unbounded one. Neither can grow the Stepper; a clip cannot change layout. (An earlier padding-based revision grew a three-step Stepper 108px → 144px at 1rem.)

  The horizontal clip mirrors under dir="rtl". clip-path: inset() is physical — top/right/bottom/left, no logical form — while the row itself reverses. Left unflipped, the leading segment sits to the right of the node in RTL and still clipped its right edge, so the hole opened at the join between steps instead of at the indicator. Measured before the fix: con0 x=622, indicator x=606, clips RIGHT edge. After: clips LEFT edge, with LTR unchanged. The block axis needs no handling — dir does not reverse it.

... (truncated)

Changelog

Sourced from @​astryxdesign/core's changelog.

0.5.3

New Components

• Add built-in popover, bottom-sheet, and compact-touch adaptive presentation policies to DropdownMenu, MoreMenu, and ContextMenu. (#5395)
• Add popover, bottom-sheet, and adaptive presentation options to Selector and MultiSelector, with docsite examples for both bottom-sheet variants. (#5395)
• Add isReadOnly to Selector and MultiSelector so selected values remain focusable and form-submittable without exposing selection menus or editing affordances. (#5805)
• Add the opt-in theme-local token contract for maintained theme families. (#5844)
• Add elevation prop to ToggleButton for floating (FAB-style) toggles, mirroring Button; retained inside a ToggleButtonGroup. (#6012)

New Features

• Add structured accessibility requirements and theme coverage support to component documentation. (#5713)

• Banner: the header's supporting line now carries a stable theme target, astryx-banner-description. (#5483) Only the header, the status icon and the content panel were themeable before, so a theme restyling the description — its colour, its type, or the space between it and the title — had to reach in with a structural selector like .astryx-banner > div:nth-child(2) > div:nth-child(2). Purely additive: no existing class, data attribute, or style changes. Nothing else in the header becomes a target. The end area is a layout row — flex, wrap, and the edge compensation that lets its buttons overhang the header padding — not a painted surface, and a theme that wants the header to grow around its buttons instead of letting them overhang sets padding-block on the existing banner target, which reaches the same height without exposing a private margin. The title, the two controls and the text column are likewise left alone: the column paints nothing (display: flex; flex-direction: column; gap: 0) and the space it owns is expressible on banner-description, while the title and the controls already render the way the consuming theme wants them.

• Add nativePicker to DateTimeInput for browser and OS date/time pickers, with Astryx time fallbacks for seconds, custom increments, and preset options. Native fields follow DateInput's compact minimum sizing in fit-content layouts. (#5620)

• Let themes add typed Heading visual roles with a safe semantic-level fallback when the owning theme styles are unavailable. (#6026)

• RadioListItem and CheckboxListItem accept rich label and description (#5257) RadioListItem typed label and description as string while its sibling CheckboxListItem already typed label as ReactNode — so the same slot had two contracts, and an app whose option descriptions carry links could not type them on either component. Both now take ReactNode; the runtime already rendered it.

  RadioListItem gains the aria-label escape hatch CheckboxListItem established, with the same meaning: a plain-text accessible name for the control. The radio differs in one way worth knowing — it points at its visible label for its accessible name, so a rich label still names it from its own text, and aria-label is there to narrow a name that reads badly rather than to supply a missing one. aria-label now lands on the radio instead of the row <div>, where ARIA ignored it.

• Stepper: --step-connector-gap, so a theme can stop the on-track connector short of the indicator The on-track layouts draw the connector as one segment either side of the node. A theme that wants the track to leave a hole around the indicator had to reach the two segments separately, and they are only distinguishable by sibling position — which changes with indicator="none".

  One public var does it instead, declared on the Stepper root because component vars are root-owned: a theme writes stepper: {base: {'--step-connector-gap': '4px'}} and every connector inherits it. Astryx spends it on whichever side each segment faces the node from, so the pair leaves a symmetric hole and the caller never names the pieces. 0px by default: the shipped track still reads as one unbroken line.

  Measured in Chromium against a built theme override, reading painted pixels down a 12px segment:

  | value | clipped away | stepper height | | ------- | ------------- | -------------- | | 6px | 6px | unchanged | | -4px | 0 | unchanged | | 1rem | capped to 8px | unchanged | | 999px | capped to 8px | unchanged | | 10% | 1px (of 12px) | unchanged | | 50% | capped to 6px | unchanged |

  Four things that had to be true and are:

  A theme override reaches it. The default is declared once on the root, not on each connector. Declared per-connector, every connector re-declared 0px on itself, and a value declared on an element beats an inherited one — so a generated stepper override compiled cleanly and changed nothing.

  The value is bounded, and both halves earn it — neither for padding's reasons. max(0px, …) because inset() accepts a negative length: Chromium computes inset(0 0 -4px 0) as written rather than clamping it the way it clamps negative padding, so the floor has to be declared. min(…, --spacing-2) — the flexible segment's own min-height — so an oversized gap leaves a short track rather than an unbounded one. Neither can grow the Stepper; a clip cannot change layout. (An earlier padding-based revision grew a three-step Stepper 108px → 144px at 1rem.)

  The horizontal clip mirrors under dir="rtl". clip-path: inset() is physical — top/right/bottom/left, no logical form — while the row itself reverses. Left unflipped, the leading segment sits to the right of the node in RTL and still clipped its right edge, so the hole opened at the join between steps instead of at the indicator. Measured before the fix: con0 x=622, indicator x=606, clips RIGHT edge. After: clips LEFT edge, with LTR unchanged. The block axis needs no handling — dir does not reverse it.

  One declaration covers both layers. The gap has to reach the track (the segment's own background) and the accent fill (an absolutely placed ::before). Spending it on each separately meant two declarations on two boxes, so a percentage resolved against a different containing block for each and stopped them ~1.2px apart. A single clip-path: inset(…) on the segment clips the element and its pseudo-element together against one reference box, so every accepted value behaves identically on both — which is what #5824 requires of a public input across its full value domain. Clipping also cannot change layout, so the node the segment positions cannot move.

  No indicator, no gap. indicator="none" renders no node, so a gap there is a hole in a track that is meant to be continuous.

  Any CSS length or percentage is accepted and behaves the same way on both layers. A percentage resolves against each segment's own box, so a fixed and a flexible segment clip by slightly different amounts from one declared value — cosmetic, bounded by the cap, and recorded as accepted rather than fixed.

  Why a custom property and not a guaranteed CSS property. A theme target reaches the element, never its ::before. Measured against a built theme override on step-connector: paddingBlock: 6px produces no hole at all — the background paints to its border box and the fill is out of reach — its only effect being the Stepper growing 108px → 120px; paddingBlockEnd: 6px produces no hole either, and addresses only one of the two edges. Only the component can clip both layers together, mirror per axis and direction, and clamp first.

  Adds Stepper.spec.md, the canonical owning record for this public property, carrying that admission argument, the value contract, and the anatomy-to-target map. Stepper.doc.mjs gains the anatomy entries its existing stepper, step, and step-connector targets never had, so every current target is anchored to a described part.

... (truncated)

Commits

• ad49392 chore: version packages for v0.5.3 (#6087)
• e41e521 feat(core): add elevation prop to ToggleButton (#6037)
• b1fcbee feat(core): support custom Heading visual types (#6026)
• 18eec18 refactor(Popover): refine internal toggle API (#5793)
• 63a0bcd feat(core): let Stepper collapse itself in narrow containers (#5659)
• 8449e38 fix(core): add playground wrapper and defaults for LayoutPanel docsite previe...
• d305910 docs: gate theme-extensible axes on safe fallbacks (#6063)
• 28ce0ea fix(PowerSearch): use DateRangeInput for range values (#6004)
• 64e715a fix: repair runtime and tooling audit regressions (#6051)
• 7f77968 test(Resizable): keep legacy bound clamps permanent (#6050)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.11 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• See full diff in compare view

Updates @types/node from 26.4.0 to 26.4.1

Commits

• See full diff in compare view

Updates knip from 6.33.0 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

• fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)Description has been truncated