Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.3.6 -> 2.3.8
chroma-js	3.1.2 -> 3.2.0
prettier (source)	3.6.2 -> 3.7.3
vite (source)	7.2.2 -> 7.2.4
zod (source)	4.1.12 -> 4.1.13

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.3.8

Compare Source

Patch Changes

• #​8188 4ca088c Thanks @​ematipico! - Fixed #​7390, where Biome couldn't apply the correct configuration passed via --config-path.

  If you have multiple root configuration files, running any command with --config-path will now apply the chosen configuration file.

• #​8171 79adaea Thanks @​dibashthapa! - Added the new rule noLeakedRender. This rule helps prevent potential leaks when rendering components that use binary expressions or ternaries.

  For example, the following code triggers the rule because the component would render 0:

  const Component = () => {
    const count = 0;
    return <div>{count && <span>Count: {count}</span>}</div>;
  };

• #​8116 b537918 Thanks @​Netail! - Added the nursery rule noDuplicatedSpreadProps. Disallow JSX prop spreading the same identifier multiple times.

  Invalid:

  <div {...props} something="else" {...props} />

• #​8256 f1e4696 Thanks @​cormacrelf! - Fixed a bug where logs were discarded (the kind from --log-level=info etc.). This is a regression introduced after an internal refactor that wasn't adequately tested.

• #​8226 3f19b52 Thanks @​dyc3! - Fixed #​8222: The HTML parser, with Vue directives enabled, can now parse v-slot shorthand syntax, e.g. <template #foo>.

• #​8007 182ecdc Thanks @​brandonmcconnell! - Added support for dollar-sign-prefixed filenames in the useFilenamingConvention rule.

  Biome now allows filenames starting with the dollar-sign (e.g. $postId.tsx) by default to support naming conventions used by frameworks such as TanStack Start for file-based-routing.

• #​8218 91484d1 Thanks @​hirokiokada77! - Added the noMultiStr rule, which disallows creating multiline strings by escaping newlines.

  Invalid:

  const foo =
    "Line 1\n\
  Line 2";

  Valid:

  const foo = "Line 1\nLine 2";
  const bar = `Line 1
  Line 2`;

• #​8225 98ca2ae Thanks @​ongyuxing! - Fixed #​7806: Prefer breaking after the assignment operator for conditional types with generic parameters to match Prettier.

  -type True = unknown extends Type<
  -  "many",
  -  "generic",
  -  "parameters",
  -  "one",
  -  "two",
  -  "three"
  ->
  -  ? true
  -  : false;
  +type True =
  +  unknown extends Type<"many", "generic", "parameters", "one", "two", "three">
  +    ? true
  +    : false;

• #​6765 23f7855 Thanks @​emilyinure! - Fixed #​6569: Allow files to export from themselves with noImportCycles.

  This means the following is now allowed:

  // example.js
  export function example() {
    return 1;
  }
  
  // Re-exports all named exports from the current module under a single namespace
  // and then imports the namespace from the current module.
  // Allows for encapsulating functions/variables into a namespace instead
  // of using a static class.
  export * as Example from "./example.js";
  
  import { Example } from "./example.js";

• #​8214 68c052e Thanks @​hirokiokada77! - Added the noEqualsToNull rule, which enforces the use of === and !== for comparison with null instead of == or !=.

  Invalid:

  foo == null;
  foo != null;

  Valid:

  foo === null;
  foo !== null;

• #​8219 793bb9a Thanks @​dyc3! - Fixed #​8190: The HTML parser will now parse Vue event handlers that contain : correctly, e.g. @update:modelValue="onUpdate".

• #​8259 4a9139b Thanks @​hirokiokada77! - Fixed #​8254: The noParameterAssign rule with propertyAssignment: "deny" was incorrectly reporting an error when a function parameter was used on the right-hand side of an assignment to a local variable's property.

  The rule should only flag assignments that modify the parameter binding or its properties (L-value), not the use of its value.

  Valid:

  (input) => {
    const local = { property: 0 };
    local.property = input;
  };

• #​8201 cd2edd7 Thanks @​Netail! - Added the nursery rule noTernary. Disallow ternary operators.

  Invalid:

  const foo = isBar ? baz : qux;

• #​8172 de98933 Thanks @​JeremyMoeglich! - Fixed #​8145: handling of large hex literals, which previously caused both false positives and false negatives.

  This affects noPrecisionLoss and noConstantMathMinMaxClamp.

• #​8210 7b44e9e Thanks @​Netail! - Corrected rule source reference. biome migrate eslint should do a bit better detecting rules in your eslint configurations.

• #​8213 e430555 Thanks @​ruidosujeira! - Fixed #​8209: Recognized formatting capability when either range or on-type formatting is supported, not only full-file formatting. This ensures editors and the language server correctly detect formatting support in files like JSONC.

• #​8202 6f49d95 Thanks @​hirokiokada77! - Fixed #​8079: Properly handle name and value metavariables for JsxAttribute GritQL queries.

  The following biome search command no longer throws an error:

  biome search 'JsxAttribute($name, $value) as $attr where { $name <: "style" }'
  

• #​8276 f7e836f Thanks @​hirokiokada77! - Added the noProto rule, which disallows the use of the __proto__ property for getting or setting the prototype of an object.

  Invalid:

  obj.__proto__ = a;
  const b = obj.__proto__;

  Valid:

  const a = Object.getPrototypeOf(obj);
  Object.setPrototypeOf(obj, b);

v2.3.7

Compare Source

Patch Changes

• #​8169 7fdcec8 Thanks @​arendjr! - Fixed #​7999: Correctly place await after leading comment in auto-fix action from noFloatingPromises rule.

• #​8157 12d5b42 Thanks @​Conaclos! - Fixed #​8148. noInvalidUseBeforeDeclaration no longer reports some valid use before declarations.

  The following code is no longer reported as invalid:

  class classA {
    C = C;
  }
  const C = 0;

• #​8178 6ba4157 Thanks @​dyc3! - Fixed #​8174, where the HTML parser would parse 2 directives as a single directive because it would not reject whitespace in Vue directives. This would cause the formatter to erroneously merge the 2 directives into one, resulting in broken code.

  - <Component v-else:property="123" />
  + <Component v-else :property="123" />

• #​8088 0eb08e8 Thanks @​db295! - Fixed #​7876: The noUnusedImports rule now ignores imports that are used by @​linkcode and @​linkplain (previously supported @​link and @​see).

  The following code will no longer be a false positive:

  import type { a } from "a"
  
  /**
   * {@​linkcode a}
   */
  function func() {}

• #​8119 8d64655 Thanks @​ematipico! - Improved the detection of the rule noUnnecessaryConditions. Now the rule isn't triggered for variables that are mutated inside a module.

  This logic deviates from the original rule, hence noUnnecessaryConditions is now marked as "inspired".

  In the following example, hey starts as false, but then it's assigned to a string. The rule isn't triggered inside the if check.

  let hey = false;
  
  function test() {
    hey = "string";
  }
  
  if (hey) {
  }

• #​8149 e0a02bf Thanks @​Netail! - Fixed #​8144: Improve noSyncScripts, ignore script tags with type="module" as these are always non-blocking.

• #​8182 e9f068e Thanks @​hirokiokada77! - Fixed #​7877: Range suppressions now handle suppressed categories properly.

  Valid:

  // biome-ignore-start lint: explanation
  const foo = 1;
  // biome-ignore-end lint: explanation

• #​8111 bf1a836 Thanks @​ryan-m-walker! - Added support for parsing and formatting the CSS if function.

  Example

  .basic-style {
    color: if(style(--scheme: dark): #eeeeee; else: #​000000;);
  }

• #​8173 7fc07c1 Thanks @​ematipico! - Fixed #​8138 by reverting an internal refactor that caused a regression to the rule noUnusedPrivateClassMembers.

• #​8119 8d64655 Thanks @​ematipico! - Improved the type inference engine, by resolving types for variables that are assigned to multiple values.

• #​8158 fb1458b Thanks @​dyc3! - Added the useVueValidVText lint rule to enforce valid v-text directives. The rule reports when v-text has an argument, has modifiers, or is missing a value.

  Invalid:

  <div v-text />
  <!-- missing value -->
  <div v-text:aaa="foo" />
  <!-- has argument -->
  <div v-text.bbb="foo" />
  <!-- has modifier -->

• #​8158 fb1458b Thanks @​dyc3! - Fixed useVueValidVHtml so that it will now flag empty strings, e.g. v-html=""

• #​7078 bb7a15c Thanks @​emilyinure! - Fixed #​6675: Now only flags
  noAccumulatingSpread on Object.assign when a new object is being allocated on
  each iteration. Before, all cases using Object.assign with reduce parameters
  were warned despite not making new allocations.

  The following code will no longer be a false positive:

  foo.reduce((acc, bar) => Object.assign(acc, bar), {});

  The following cases which do make new allocations will continue to warn:

  foo.reduce((acc, bar) => Object.assign({}, acc, bar), {});

• #​8175 0c8349e Thanks @​ryan-m-walker! - Fixed CSS formatting of dimension units to use correct casing for Q, Hz and kHz.

  Before:

  .cssUnits {
    a: 1Q;
    b: 1Hz;
    c: 1kHz;
  }

  After:

  .cssUnits {
    a: 1Q;
    b: 1Hz;
    c: 1kHz;
  }

gka/chroma.js (chroma-js)

v3.2.0

Compare Source

• scale.domain now returns the original domain array when called with no arguments

v3.1.4

Compare Source

What's Changed

• docs: fix discord link (resolves #​373) by @​gka in #​379
• feat: chroma.random accepts rng as argument by @​gka in #​378

Full Changelog: gka/chroma.js@v3.1.3...v3.1.4

prettier/prettier (prettier)

v3.7.3

Compare Source

diff

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#​18375 by @​fisker)

An internal refactor accidentally broke the VSCode extension plugin loading.

v3.7.2

Compare Source

diff

JavaScript: Fix string print when switching quotes (#​18351 by @​fisker)

// Input
console.log("A descriptor\\'s .kind must be \"method\" or \"field\".")

// Prettier 3.7.1
console.log('A descriptor\\'s .kind must be "method" or "field".');

// Prettier 3.7.2
console.log('A descriptor\\\'s .kind must be "method" or "field".');

JavaScript: Preserve quote for embedded HTML attribute values (#​18352 by @​kovsu)

// Input
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

// Prettier 3.7.1
const html = /* HTML */ ` <div class=${styles.banner}></div> `;

// Prettier 3.7.2
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;

TypeScript: Fix comment in empty type literal (#​18364 by @​fisker)

// Input
export type XXX = {
  // tbd
};

// Prettier 3.7.1
export type XXX = { // tbd };

// Prettier 3.7.2
export type XXX = {
  // tbd
};

v3.7.1

Compare Source

diff

API: Fix performance regression in doc printer (#​18342 by @​fisker)

Prettier 3.7.1 can be very slow when formatting big files, the regression has been fixed.

v3.7.0

Compare Source

diff

🔗 Release Notes

vitejs/vite (vite)

v7.2.4

Compare Source

Bug Fixes

• revert "perf(deps): replace debug with obug (#​21107)" (2d66b7b)

v7.2.3

Compare Source

Bug Fixes

• allow multiple bindCLIShortcuts calls with shortcut merging (#​21103) (5909efd)
• deps: update all non-major dependencies (#​21096) (6a34ac3)
• deps: update all non-major dependencies (#​21128) (4f8171e)

Performance Improvements

• deps: replace debug with obug (#​21107) (acfe939)

Miscellaneous Chores

• deps: update dependency @​rollup/plugin-commonjs to v29 (#​21099) (02ceaec)
• deps: update rolldown-related dependencies (#​21095) (39a0a15)
• deps: update rolldown-related dependencies (#​21127) (5029720)

colinhacks/zod (zod)

v4.1.13

Compare Source

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.