Update dependency @biomejs/biome to v2.5.13

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.5.12 → 2.5.13

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.13

Compare Source

Patch Changes

• #​11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  
  .my-style {
    color: red;
  }
  
  /* Valid */
  @import 'foo.css' layer(base);
  
  @layer base {
    .my-style {
      color: red;
    }
  }

• #​11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #​11620 20e513a Thanks @​jakeleventhal! - Fixed #​11610, #​11611, #​11612, #​11615, and #​11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #​11657 e322040 Thanks @​ematipico! - Fixed #​7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #​11627 23aad6d Thanks @​ematipico! - Fixed #​6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #​11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #​11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

• #​11676 840a52a Thanks @​dyc3! - Fixed #​11672 and #​11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.

• #​11660 49485ed Thanks @​ematipico! - Fixed #​11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.

• #​11664 9a73b9c Thanks @​dyc3! - Improved the performance of useRegexpExec.

• #​11661 5341b3f Thanks @​ematipico! - Fixed #​7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

• #​11630 62e1fc5 Thanks @​dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

   <span>
  -  {head.median - base.median >= 0 ? "+" : "−"}
  -  {formatMs(Math.abs(head.median - base.median))}
  +  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
   </span>

• #​11658 ed4bfa4 Thanks @​fredrikblau! - Fixed #​11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.

  <h1 set:html={heading} />
  <h2 set:text={heading}></h2>

  <template>
    <h1 v-html="heading"></h1>
    <h2 v-text="heading"></h2>
  </template>

• #​11613 47d7383 Thanks @​ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.

• #​11618 21a10cf Thanks @​siketyan! - Fixed #​11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:

  interface Context {
    doSomething(): Promise<void>;
  }
  
  declare function test(callback: (ctx: Context) => Promise<void>): void;
  
  test(async (ctx) => {
  	ctx.doSomething(); // now reported as a floating promise
  });

• #​11698 b019982 Thanks @​denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.

  -background-image: url(image\);
  +background-image: url(image\ );

• #​11622 c23e4c7 Thanks @​Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.

  <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />

• #​11606 de0528f Thanks @​dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.

• #​11687 09d97d9 Thanks @​hori-design! - Fixed #​11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.

• #​11595 a64d757 Thanks @​dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.

• #​11675 353cbae Thanks @​dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.

• #​11625 ea20e5a Thanks @​denbezrukov! - Improved linting performance for large CSS and JSON files.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.

• #​11669 579f401 Thanks @​denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 1c956b40-a380-48ac-86f4-e9c280f2486c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}