Skip to content

chore(deps): update all dependencies - #523

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all
Open

chore(deps): update all dependencies#523
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence Type Update Pending
@azure-tools/typespec-autorest (source) 0.70.00.70.1 age adoption passing confidence pnpm.catalog.default patch
@biomejs/biome (source) 2.5.42.5.5 age adoption passing confidence pnpm.catalog.default patch 2.5.6
@biomejs/wasm-nodejs (source) 2.5.42.5.5 age adoption passing confidence pnpm.catalog.default patch 2.5.6
@types/node (source) ^22.20.0^26.0.0 age adoption passing confidence pnpm.catalog.default major
@types/node (source) ^22.20.0^26.0.0 age adoption passing confidence devDependencies major
@types/node (source) ^22.20.1^26.0.0 age adoption passing confidence devDependencies major
fast-uri@^3 ^3.1.4^4.0.0 age adoption passing confidence pnpm-workspace.overrides major 4.1.2
jsdom ^29.1.1^30.0.0 age adoption passing confidence devDependencies major 30.0.1
monaco-editor ^0.55.1^0.56.0 age adoption passing confidence dependencies minor
node (source) 26.5.026.6.0 age adoption passing confidence tools minor
node 26.2.026.5.1 age adoption passing confidence uses-with minor
pnpm/action-setup v6.0.9v6.0.10 age adoption passing confidence action patch
raw-body ^3.0.2^4.0.0 age adoption passing confidence dependencies major
react (source) 19.2.719.2.8 age adoption passing confidence pnpm.catalog.default patch
react-dom (source) 19.2.719.2.8 age adoption passing confidence pnpm.catalog.default patch
sharp (source, changelog) 0.35.00.35.3 age adoption passing confidence pnpm-workspace.overrides patch
typescript (source) ^6.0.3^7.0.0 age adoption passing confidence pnpm.catalog.typescript6 major

Release Notes

Azure/typespec-azure (@​azure-tools/typespec-autorest)

v0.70.1

Bug Fixes
  • #​4974 Preserve non-TypeSpec service.yaml versions when updating an existing manifest. Versions the emitter no longer produces are now kept when they are not TypeSpec-generated (for example legacy swagger-only versions migrated from readme.md), while stale source: typespec versions the emitter no longer produces are still removed. This makes re-running the emitter idempotent for manifests that carry historical versions.
biomejs/biome (@​biomejs/biome)

v2.5.5

Compare Source

Patch Changes
  • #​10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
    switch (value) {
      case 1n:
        break;
    }
  • #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
    declare const value: Recursive;
    
    String(value);
    value || "fallback";
  • #​10977 0bf7486 Thanks @​ematipico! - Fixed #​10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #​10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #​10983 edc0ed7 Thanks @​ayaangazali! - Fixed #​10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #​10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
    + A:hover { color: initial; }
    - @&#8203;KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
    + @&#8203;keyframes :GLOBAL KeepFrames { from { color: RED; } }
    - @&#8203;CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
    + @&#8203;container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }
  • #​10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
    +a { color: /* before */ red /* after */ !important; }
  • #​10993 b7a9694 Thanks @​denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.

    -.before > /* comment */ .after {}
    +.before /* comment */ > .after {}

    It now also keeps selectors with escaped newlines in attribute values inline when they fit.

    -div
    -  span[foo="bar\
    +div span[foo="bar\
     value"] {}
  • #​10978 8ebafe1 Thanks @​ematipico! - Fixed #​10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".

  • #​10901 68c10e6 Thanks @​Socialpranker! - Fixed #​10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

    This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.

  • #​10936 7df46f5 Thanks @​ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.

  • #​10941 f787725 Thanks @​siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.

  • #​10969 72d309b Thanks @​ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.

  • e62f6b6 Thanks @​ematipico! - Fixed #​10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.

  • #​10931 899c60d Thanks @​ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.

  • #​10904 ceee4f4 Thanks @​qzwxsaedc! - Fixed #​10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:

    import type Types from "./types";
    
    declare function parse(): Types.Result<string>;
    const result = parse();
    if (!result.success) {
    }
  • #​10962 f0a67f2 Thanks @​ematipico! - Biome no longer removes embedded styles and scripts in HTML files.

  • #​11000 5039a1e Thanks @​ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.

  • #​10957 cf263c4 Thanks @​dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.

  • #​10992 4bf9b21 Thanks @​ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

    For example, the following callback is now reported.

    declare function consume(...args: [number, () => void]): void;
    const prefix: [number] = [1];
    
    consume(...prefix, async () => {});
  • #​10915 b3b12b3 Thanks @​Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

    The rule provides an unsafe fix that flips the operator.

    // Invalid
    !foo === bar;
    !foo !== bar;
    
    // Valid
    foo !== bar;
    foo === bar;
  • #​10970 bd1038b Thanks @​ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:

    declare function consume(kind: "async", callback: () => Promise<void>): void;
    declare function consume(kind: "sync", callback: () => void): void;
    consume("sync", async () => {});
  • #​10933 48a4abb Thanks @​ematipico! - Fixed useArrayFind to recognize bigint zero indexes.

  • #​10931 899c60d Thanks @​ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.

  • #​10969 72d309b Thanks @​ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.

  • #​10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:

    declare const value: unknown;
    
    async function consume() {
      await value;
    }
biomejs/biome (@​biomejs/wasm-nodejs)

v2.5.5

Compare Source

fastify/fast-uri (fast-uri@^3)

v4.1.1

Compare Source

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v4.1.0...v4.1.1

v4.1.0

Compare Source

v4.0.1

Compare Source

⚠️ Security Release

What's Changed

New Contributors

Full Changelog: fastify/fast-uri@v4.0.0...v4.0.1

v4.0.0

Compare Source

What's Changed

Full Changelog: fastify/fast-uri@v3.1.2...v4.0.0

jsdom/jsdom (jsdom)

v30.0.0

Compare Source

microsoft/monaco-editor (monaco-editor)

v0.56.0

Compare Source

Breaking Changes
  • Reorganizes the exported ESM modules to provide supported, tree-shakeable entry points (#​5155). The monaco-editor entry point continues to load all features and languages. Custom bundles can now import monaco-editor/editor and opt into:
    • all editor features with monaco-editor/features/register.all, or individual features with monaco-editor/features/<feature>/register;
    • all language definitions with monaco-editor/languages/definitions/register.all, or individual definitions with monaco-editor/languages/definitions/<language>/register;
    • the CSS, HTML, JSON, and TypeScript language features with monaco-editor/languages/features/register.all, or their individual register entry points.
  • Renames the misspelled IOverlayWidgetPosition.stackOridinal property to stackOrdinal.
  • Removes the deprecated IMirrorModel and IWorkerContext worker API types.
New Features and APIs
  • Adds editor.doubleClickSelectsBlock.
  • Adds editor.find.closeOnResult and editor.inlayHints.showLongLineWarning.
  • Adds offWhenInlineCompletions to QuickSuggestionsValue.
  • Adds model and provider option support to inline completion providers.
  • Adds ICodeEditor.revealAllCursors, ICodeEditor.getWidthOfLine, and ICodeEditor.renderAsync.
  • Adds advanced-external and advanced-wasm diff algorithms.
  • Exposes typed native LSP client and transport APIs.
Fixes
  • Treats Markdown returned by language servers as untrusted (#​5280).
  • Updates the editor core to the version used by 0.56.0-dev-20260625.
nodejs/node (node)

v26.6.0

Compare Source

actions/node-versions (node)

v26.5.1: 26.5.1

Compare Source

Node.js 26.5.1

pnpm/action-setup (pnpm/action-setup)

v6.0.10

Compare Source

stream-utils/raw-body (raw-body)

v4.0.0

Compare Source

⚠️ Breaking changes
  • Remove support for Node <22 - by @​bjohansebas in #​156

    Node.js versions prior to 22 are no longer supported. This allows the package to migrate to ESM and rely on require(esm), which does not work correctly on earlier versions.

  • Migrate to TypeScript and publish as ESM-only - by @​bjohansebas in #​157

    CommonJS consumers can keep loading the package through require(esm).

  • Use native TextDecoder instead of iconv-lite - by @​bjohansebas in #​143

    Supported encodings are now those of the WHATWG Encoding Standard; encodings outside the standard (e.g. UTF-32) now throw a 415 error. utf-16 no longer detects a big-endian BOM and always decodes as little-endian; use utf-16be for big-endian content.

  • Remove streams1 support - by @​bjohansebas in #​144 and #​161

    Node streams that emit string chunks now error with a 500 stream.encoding.set through the callback (previously they were decoded silently, or crashed the process when no encoding was set), matching the web stream path. Streams are expected to implement the readable stream interface (unpipe, pause).

  • Validate the limit option - by @​bjohansebas in #​162

    A limit that does not parse to a byte count (e.g. 'banana', NaN) now throws a TypeError instead of silently reading with no limit at all. limit: null remains the explicit way to disable the limit.

🚀 Improvements
  • Support reading WHATWG ReadableStream (web streams) through the new getRawBodyWeb export - by @​bjohansebas in #​148, #​160 and #​175

    fetch Request/Response bodies, Blob.stream(), TransformStream readables, and Readable.toWeb() bridges can be read with getRawBodyWeb, which takes the same options as getRawBody; getRawBody itself keeps accepting only node streams. Streams already locked, read, or cancelled error with a 500 stream.not.readable; client aborts are mapped to the same 400 request.aborted error as node streams, with the original error in cause; string chunks are accepted without an encoding (UTF-8 Buffer), but error with a 500 stream.encoding.set when combined with one, since the stream is already decoded; non-byte chunks (e.g. ArrayBuffer) error with a TypeError. On error the reader lock is released, but the stream is not cancelled; disposing it is up to the caller.

  • Add a custom decoder option - by @​bjohansebas in #​145

    A function compatible with iconv-lite's getDecoder can be plugged in to decode encodings outside the WHATWG Encoding Standard.

  • Use native stream.unpipe() and remove the unpipe dependency - by @​Phillip9587 in #​93

  • Remove the check for a global Promise when no callback is provided - by @​bjohansebas in #​146

  • Add a benchmark suite - by @​bjohansebas in #​163

    npm run bench compares the node and web stream paths with realistic request bodies.

  • Fail as soon as a stream exceeds its declared length - by @​bjohansebas in #​172

    A body that sends more bytes than its declared length now errors with a 400 request.size.invalid as soon as the excess arrives, rather than buffering the rest first. This bounds memory to length even when no limit is set. When both are set, a length overrun is reported before the limit's 413.

🐞 Bug fixes
  • Fix a length that does not parse to a number failing every request - by @​bjohansebas in #​172

    Values like '' passed the numeric pre-check but parsed to NaN, so the size check could never match and every request errored with a 400 request.size.invalid. They are now treated as no expected length, like any other unparseable value.

  • Fix node streams destroyed without an error never settling - by @​bjohansebas in #​158

    They now error through the callback / reject the promise with the same 400 request.aborted error as the web path, instead of never invoking the callback or settling the promise.

  • Fix process crash when a custom decoder throws while reading node streams - by @​bjohansebas in #​157

react/react (react)

v19.2.8

Compare Source

react/react (react-dom)

v19.2.8

Compare Source

lovell/sharp (sharp)

v0.35.3

Compare Source

v0.35.2

Compare Source

v0.35.1

Compare Source

  • TypeScript: Ensure type definitions are published for both ESM and CJS.
    #​4537

  • WebAssembly: Ensure wrapper file is published.
    #​4538

microsoft/TypeScript (typescript)

v7.0.2

Compare Source


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 1, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 14 workspace projects
? Verifying lockfile against supply-chain policies (1441 entries)...
Progress: resolved 1, reused 0, downloaded 0, added 0
Progress: resolved 16, reused 0, downloaded 0, added 0
Progress: resolved 29, reused 0, downloaded 0, added 0
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /runner/cache/others/pnpm/store/v11
  Virtual store is at:             node_modules/.pnpm
Progress: resolved 42, reused 0, downloaded 0, added 0
[WARN] The git-hosted package fetched from "https://codeload.github.com/hyperjump-io/json-schema-errors/tar.gz/429b18eb914fa1e01b23f38519e4da240e4113d8" has to be built but the build scripts were ignored.
Progress: resolved 56, reused 0, downloaded 1, added 0
Progress: resolved 63, reused 0, downloaded 1, added 0
Progress: resolved 65, reused 0, downloaded 1, added 0
Progress: resolved 68, reused 0, downloaded 1, added 0

   ╭──────────────────────────────────────────╮
   │                                          │
   │   Update available! 11.17.0 → 11.20.0.   │
   │   Changelog: https://pnpm.io/v/11.20.0   │
   │     To update, run: pnpm add -g pnpm     │
   │                                          │
   ╰──────────────────────────────────────────╯

Progress: resolved 69, reused 0, downloaded 1, added 0
Progress: resolved 74, reused 0, downloaded 1, added 0
[WARN] Request took 10135ms: https://registry.npmjs.org/@angular%2Fcommon
[WARN] Request took 10247ms: https://registry.npmjs.org/@angular%2Fcompiler-cli
[WARN] Request took 10718ms: https://registry.npmjs.org/@angular%2Fcli
Progress: resolved 79, reused 0, downloaded 1, added 0
[WARN] Request took 11417ms: https://registry.npmjs.org/zod
[WARN] Request took 10932ms: https://registry.npmjs.org/monaco-editor
Progress: resolved 81, reused 0, downloaded 1, added 0
[WARN] Request took 13755ms: https://registry.npmjs.org/react-hook-form
Progress: resolved 82, reused 0, downloaded 1, added 0
[WARN] Request took 17665ms: https://registry.npmjs.org/react
Progress: resolved 83, reused 0, downloaded 1, added 0
[WARN] Request took 12413ms: https://registry.npmjs.org/@next%2Fswc-linux-x64-musl
[WARN] Request took 12729ms: https://registry.npmjs.org/@next%2Fswc-win32-arm64-msvc
[WARN] Request took 12931ms: https://registry.npmjs.org/@next%2Fswc-linux-arm64-gnu
[WARN] Request took 12985ms: https://registry.npmjs.org/@next%2Fswc-linux-arm64-musl
[WARN] Request took 13134ms: https://registry.npmjs.org/@next%2Fswc-darwin-x64
[WARN] Request took 13592ms: https://registry.npmjs.org/@next%2Fswc-win32-x64-msvc
[WARN] Request took 13731ms: https://registry.npmjs.org/@next%2Fswc-linux-x64-gnu
[WARN] Request took 14141ms: https://registry.npmjs.org/@next%2Fswc-darwin-arm64
[WARN] Request took 24482ms: https://registry.npmjs.org/react-dom
Progress: resolved 84, reused 0, downloaded 1, added 0
[WARN] Request took 19522ms: https://registry.npmjs.org/@next%2Fenv
[WARN] Request took 29906ms: https://registry.npmjs.org/@types%2Fnode
Progress: resolved 85, reused 0, downloaded 1, added 0
[WARN] Request took 34458ms: https://registry.npmjs.org/typescript
Progress: resolved 86, reused 0, downloaded 1, added 0
[WARN] Request took 15888ms: https://registry.npmjs.org/@types%2Fnode
[WARN] Request took 12194ms: https://registry.npmjs.org/es-toolkit
[WARN] Request took 40541ms: https://registry.npmjs.org/next
Progress: resolved 87, reused 0, downloaded 1, added 0
Progress: resolved 160, reused 0, downloaded 1, added 0
Progress: resolved 272, reused 0, downloaded 1, added 0
Progress: resolved 318, reused 0, downloaded 1, added 0
Progress: resolved 353, reused 0, downloaded 1, added 0
Progress: resolved 400, reused 0, downloaded 1, added 0
Progress: resolved 407, reused 0, downloaded 1, added 0
Progress: resolved 410, reused 0, downloaded 1, added 0
[WARN] Request took 10434ms: https://registry.npmjs.org/typescript
Progress: resolved 413, reused 0, downloaded 1, added 0
Progress: resolved 421, reused 0, downloaded 1, added 0
[WARN] Request took 26280ms: https://registry.npmjs.org/next
[WARN] Request took 20201ms: https://registry.npmjs.org/vite
✓ Lockfile passes supply-chain policies (1441 entries in 55.4s)
[WARN] Request took 13706ms: https://registry.npmjs.org/vite
Progress: resolved 422, reused 0, downloaded 1, added 0
Progress: resolved 536, reused 0, downloaded 1, added 0
Progress: resolved 578, reused 0, downloaded 1, added 0
Progress: resolved 682, reused 0, downloaded 1, added 0
Progress: resolved 757, reused 0, downloaded 1, added 0
Progress: resolved 848, reused 0, downloaded 1, added 0
Progress: resolved 899, reused 0, downloaded 1, added 0
Progress: resolved 905, reused 0, downloaded 1, added 0
Progress: resolved 911, reused 0, downloaded 1, added 0
Progress: resolved 1062, reused 0, downloaded 1, added 0
Progress: resolved 1116, reused 0, downloaded 1, added 0
Progress: resolved 1228, reused 0, downloaded 1, added 0
Progress: resolved 1326, reused 0, downloaded 1, added 0
Progress: resolved 1399, reused 0, downloaded 1, added 0
Progress: resolved 1440, reused 0, downloaded 1, added 0
[WARN] 2 deprecated subdependencies found: @types/parse-path@7.1.0, mathjax-full@3.2.2
Progress: resolved 1441, reused 0, downloaded 1, added 0
Progress: resolved 1441, reused 0, downloaded 1, added 0, done
[ERR_PNPM_PEER_DEP_ISSUES] Unmet peer dependencies

✕ unmet peer typescript
  Installed: 7.0.2
  Wanted:
    ">=6.0 <6.1":
      @angular/compiler-cli@22.0.7
      @angular/build@22.0.7

✕ unmet peer typescript
  Installed: 7.0.2
  Wanted:
    "^5.5.0 || ^6.0.0":
      twoslash@0.3.9
hint: To disable failing on peer dependency issues, add the following to pnpm-workspace.yaml in your project root:

  strictPeerDependencies: false

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants