chore(deps): update dependency @biomejs/biome to v2.4.5 by renovate[bot] · Pull Request #316 · settlemint/settlemint-action

renovate · 2026-01-26T23:13:37Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@biomejs/biome (source)	devDependencies	minor	`2.3.12` → `2.4.5`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

biomejs/biome (@biomejs/biome)

`v2.4.5`

Compare Source

Patch Changes

#9185 e43e730 Thanks @dyc3! - Added the nursery rule useVueScopedStyles for Vue SFCs. This rule enforces that <style> blocks have the scoped attribute (or module for CSS Modules), preventing style leakage and conflicts between components.
#9184 49c8fde Thanks @chocky335! - Improved plugin performance by batching all plugins into a single syntax visitor with a kind-to-plugin lookup map, reducing per-node dispatch overhead from O(N) to O(1) where N is the number of plugins.
#9283 071c700 Thanks @dyc3! - Fixed noUndeclaredVariables erroneously flagging functions and variables defined in the <script setup> section of Vue SFCs.
#9221 4612133 Thanks @ematipico! - Fixed an issue where the JSON reporter didn't contain the duration of the command.
#9294 1805c8f Thanks @Netail! - Extra rule source reference. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#9178 101b3bb Thanks @Bertie690! - Fixed #9172 and #9168:
Biome now considers more constructs as valid test assertions.

Previously, assert, expectTypeOf and assertType
were not recognized as valid assertions by Biome's linting rules, producing false positives in lint/nursery/useExpect and other similar rules.

Now, these rules will no longer produce errors in test cases that used these constructs instead of expect:
```
import { expectTypeOf, assert, assertType } from "vitest";

const myStr = "Hello from vitest!";
it("should be a string", () => {
  expectTypeOf(myStr).toBeString();
});
test("should still be a string", () => {
  assertType<string>(myStr);
});
it.todo("should still still be a string", () => {
  assert(typeof myStr === "string");
});
```
#9173 32dad2d Thanks @dyc3! - Added parsing support for Svelte's new comments-in-tags feature.

The HTML parser will now accept JS style comments in tags in Svelte files.
```
<button
  // single-line comment
  onclick={doTheThing}
>click me</button>

<div
  /* block comment */
  class="foo"
>text</div>
```
#8952 1d2ca15 Thanks @pkallos! - Added the nursery rule useNullishCoalescing. This rule suggests using the nullish coalescing operator (??) instead of logical OR (||) when the left operand may be nullish. This prevents bugs where falsy values like 0, '', or false are incorrectly treated as missing. Addresses #8043
```
// Invalid
declare const x: string | null;
const value = x || "default";

// Valid
const value = x ?? "default";
```
#9243 1992a85 Thanks @Netail! - Fixed #7813: improved the diagnostic of the rule useExhaustiveDependencies. The diagnostic now shows the name of the variable to add to the dependency array.

#9063 3d0648f Thanks @taga3s! - Added the nursery rule noVueRefAsOperand. This rule disallows cases where a ref is used as an operand.

The following code is now flagged:

import { ref } from "vue";

const count = ref(0);
count++; // Should be: count.value++

import { ref } from "vue";

const ok = ref(false);
if (ok) {
  // Should be: if (ok.value)
  //
}

#9273 f239e20 Thanks @denbezrukov! - Fixed #9253: parsing of @container scroll-state(...) queries.

@&#8203;container scroll-state(scrolled: bottom) {
}
@&#8203;container scroll-state(stuck) {
}
@&#8203;container scroll-state(not (stuck)) {
}
@&#8203;container scroll-state((stuck) and (scrolled: bottom)) {
}
@&#8203;container scroll-state((stuck) or (snapped: x)) {
}
@&#8203;container main-layout scroll-state(not ((stuck) and (scrolled: bottom))) {
}

#9259 96939c0 Thanks @ematipico! - Fixed CSS formatter incorrectly collapsing selectors when a BOM (Byte Order Mark) character is present at the start of the file. The formatter now correctly preserves line breaks between comments and selectors in BOM-prefixed CSS files, matching Prettier's behavior.
#9251 59e33fb Thanks @ematipico! - Fixed #9249: The CSS formatter no longer incorrectly breaks ratio values (like 1 / -1) across lines when followed by comments.
#9284 ec3a17f Thanks @denbezrukov! - Fixed #9253: removed false-positive diagnostics for valid @container/@supports general-enclosed queries.
```
@&#8203;container scroll-state(scrolled: bottom) {
}
@&#8203;supports foo(bar: baz) {
}
```
#9215 b2619a1 Thanks @FrederickStempfle! - Fixed #9189: biome ci in GitHub Actions now correctly disables colors so that ::error/::warning workflow commands are not wrapped in ANSI escape codes.
#9256 65ae4c1 Thanks @ematipico! - Fixed JSON reporter escaping of special characters in diagnostic messages. The JSON reporter now properly escapes double quotes, backslashes, and control characters in error messages and advice text, preventing invalid JSON output when diagnostics contain these characters.
#9223 5b9da81 Thanks @ematipico! - Fixed an issue where the JSON reporter didn't write output to a file when --reporter-file was specified. The output is now correctly written to the specified file instead of always going to stdout.
#9154 c487e54 Thanks @abossenbroek! - Fixed #9115: The noPlaywrightMissingAwait rule no longer produces false positives on jest-dom matchers like toBeVisible, toBeChecked, toHaveAttribute, etc. For matchers shared between Playwright and jest-dom, the rule now checks whether expect()'s argument is a Playwright locator or page object before flagging. Added semantic variable resolution so that extracted Playwright locators (e.g. const loc = page.locator('.item'); expect(loc).toBeVisible()) are still correctly flagged.
#9269 33e5cdf Thanks @dyc3! - Fixed a false positive where noUndeclaredVariables reported bindings from Vue <script setup> as undeclared when used in <template>.

This change ensures embedded bindings collected from script snippets (like imports and defineModel results) are respected by the rule.
#9267 2c2e060 Thanks @ematipico! - Fixed #9143 and #8849: The noUnresolvedImports rule no longer reports false positives for several common patterns:
- node:fs, node:path, node:url, and other Node.js built-in modules with the node: prefix are now accepted.
- Packages that declare their TypeScript entry point via "typings" (instead of "types") in package.json now resolve correctly.
- Named imports from aliased re-export chains (e.g. export { x as y } from "...") are now resolved correctly through the alias.
- Namespace re-exports (e.g. export * as Ns from "...") are now recognized as own exports of the barrel module.
#9254 f7bf12b Thanks @ematipico! - Fixed #8842: The CSS formatter now correctly formats @container scroll-state() without adding an unwanted space between the function name and opening parenthesis.
#9211 2d0b8e6 Thanks @ematipico! - Fixed #7905. Improved the accuracy of type-aware lint rules when analyzing re-exported functions and values.

Previously, when a binding was imported from another module, its type was not correctly inferred during the type analysis phase. This caused type-aware lint rules to fail to detect issues when working with re-exported imports.

The following rules now correctly handle re-exported imports:
- useAwaitThenable
- noFloatingPromises
- noMisusedPromises
- useArraySortCompare
Example of now-working detection:
```
// getValue.ts
export async function getValue(): Promise<number> {
  return 42;
}

// reexport.ts
export { getValue } from "./getValue";

// index.ts
import { getValue } from "./reexport";

// Previously: no diagnostic (type was unknown)
// Now: correctly detects that getValue() returns a Promise
await getValue(); // Valid - properly awaited
getValue(); // Diagnostic - floating promise
```
#8934 b49707c Thanks @tim-we! - Fixed #8265: Biome now correctly detects test framework calls that use three arguments (label, options, callback) (e.g., describe("foo", { retry: 2 }, () => {})). This fixes both formatting and the noDuplicateTestHooks lint rule for test frameworks like Vitest.
#9191 688fd34 Thanks @dyc3! - Fixed #9180: fixed a panic caused by an interaction between noRedundantUseStrict and the formatter
#9048 9bbdf4d Thanks @ff1451! - Added the nursery rule useNamedCaptureGroup.
The rule enforces using named capture groups in regular expressions instead of numbered ones. It supports both regex literals and RegExp constructor calls.
```
// Invalid: unnamed capture group
/(foo)/;
new RegExp("(foo)");

// Valid: named capture group
/(?<id>foo)/;
new RegExp("(?<id>foo)");
```
#9255 9b6685b Thanks @ematipico! - Fixed #9234, where some nursery rules panicked when they were configured with the option level without the corresponding options.
#8968 a2b4494 Thanks @LouisLau-art! - Fixed #8812: lint/suspicious/noArrayIndexKey will now report index usage anywhere in JSX key template or binary expressions, not only in the last visited identifier.
#9266 84935a4 Thanks @dyc3! - Fixed #9250: noVueDuplicateKeys will no longer flag keys under watch, preventing false positives.
#9056 1f2fe2e Thanks @ruidosujeira! - Added the nursery rule useArraySome to prefer .some() over verbose existence checks like filter(...).length > 0 and findIndex(...) !== -1, with suggestions for find/findLast existence checks. This also applies to ES2025 iterator helpers such as Iterator.prototype.find.
#9163 f87acf6 Thanks @JUSTIVE! - Added graphql to valid embedded graphql template tags inside JavaScript files, when the feature javascript.experimentalEmbeddedSnippetsEnabled is enabled. This allows proper support for graphql tags used in RelayJS.

Now, code snippets like the following are correctly formatted and limited:
```
import { graphql } from "react-relay";

const query = graphql`
  query {
    user(id: 1) {
      id
      name
    }
  }
`;
```
#8773 6b01778 Thanks @xcb3d! - Added the new nursery rule useUnicodeRegex.

The rule enforces the use of the u or v flag for regular expressions. This ensures proper handling of Unicode characters like emoji.
```
// Invalid
/foo/;
new RegExp("foo", "gi");

// Valid
/foo/u;
new RegExp("foo", "giu");
```

`v2.4.4`

Compare Source

Patch Changes

#9150 6946835 Thanks @dyc3! - Fixed #9138: Astro files containing --- in HTML content (e.g., <h1>---Hi</h1>) are now parsed correctly, both when a frontmatter block is present and when there is no frontmatter at all.
#9150 aa6f837 Thanks @dyc3! - Fixed #9138: The HTML parser incorrectly failing to parse bracket characters ([ and ]) in text content (e.g. <div>[Foo]</div>).
#9151 c0d4b0c Thanks @dyc3! - Fixed parsing of Svelte directive keywords (use, style) when used as plain text content in HTML/Svelte files. Previously, <p>use JavaScript</p> or <p>style it</p> would incorrectly produce a bogus element instead of proper text content.
#9162 7f1e060 Thanks @dyc3! - Fixed #9161: The Vue parser now correctly handles colon attributes like xlink:href and xmlns:xlink by parsing them as single attributes instead of splitting them into separate tokens.
#9164 458211b Thanks @dyc3! - Fixed #9161: The noAssignInExpressions rule no longer flags assignments in Vue v-on directives (e.g., @click="counter += 1"). Assignments in event handlers are idiomatic Vue patterns and are now skipped by the rule.

`v2.4.3`

Compare Source

Patch Changes

#9120 aa40fc2 Thanks @ematipico! - Fixed #9109, where the GitHub reporter wasn't correctly enabled when biome ci runs on GitHub Actions.
#9128 8ca3f7f Thanks @dyc3! - Fixed #9107: The HTML parser can now correctly parse Astro directives (client/set/class/is/server), which fixes the formatting for Astro directives.
#9124 f5b0e8d Thanks @ematipico! - Fixed #8882 and #9108: The Astro frontmatter lexer now correctly identifies the closing --- fence when the frontmatter contains multi-line block comments with quote characters, strings that mix quote types (e.g. "it's"), or escaped quote characters (e.g. "\").
#9142 3ca066b Thanks @THernandez03! - Fixed #9141: The noUnknownAttribute rule no longer reports closedby as an unknown attribute on <dialog> elements.
#9126 792013e Thanks @ematipico! - Added missing Mocha globals to the Test domain: context, run, setup, specify, suite, suiteSetup, suiteTeardown, teardown, xcontext, xdescribe, xit, and xspecify. These are injected by Mocha's BDD and TDD interfaces and were previously flagged as undeclared variables in projects using Mocha.
#8855 6918c9e Thanks @ruidosujeira! - Fixed #8840. Now the Biome CSS parser correctly parses not + scroll-state inside @container queries.
#9111 4fb55cf Thanks @Jayllyz! - Slightly improved performance of noIrregularWhitespace by adding early return optimization and simplifying character detection logic.
#8975 086a0c5 Thanks @FrankFMY! - Fixed #8478: useDestructuring no longer suggests destructuring when the variable has a type annotation, like const foo: string = object.foo.

`v2.4.2`

Compare Source

Patch Changes

#9103 fc9850c Thanks @dyc3! - Fixed #9098: useImportType no longer incorrectly flags imports used in Svelte control flow blocks ({#if}, {#each}, {#await}, {#key}) as type-only imports.
#9106 f4b7296 Thanks @dyc3! - Updated rule source metadata for rules from html-eslint.

#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noConditionalExpect. This rule disallows conditional expect() calls inside tests, which can lead to tests that silently pass when assertions never run.

// Invalid - conditional expect may not run
test("conditional", async ({ page }) => {
  if (someCondition) {
    await expect(page).toHaveTitle("Title");
  }
});

// Valid - unconditional expect
test("unconditional", async ({ page }) => {
  await expect(page).toHaveTitle("Title");
});

#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightElementHandle. Prefers locators to element handles.
```
const el = await page.$(".btn");
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightEval. Disallows page.$eval() and page.$$eval() methods.
```
await page.$eval(".btn", (el) => el.textContent);
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightForceOption. Disallows the force option on user interactions.
```
await locator.click({ force: true });
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightMissingAwait. Enforces awaiting async Playwright APIs.
```
const el = page.locator(".btn");
el.click(); // Missing await
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightNetworkidle. Disallows deprecated networkidle wait option.
```
await page.goto(url, { waitUntil: "networkidle" });
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightPagePause. Disallows page.pause() debugging calls in committed code.
```
await page.pause();
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightUselessAwait. Disallows unnecessary await on synchronous Playwright methods.
```
// Incorrect - locator() is synchronous
const loc = await page.locator(".btn");
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightWaitForNavigation. Prefers modern navigation APIs over deprecated waitForNavigation().
```
await page.waitForNavigation();
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightWaitForSelector. Prefers locators over deprecated waitForSelector().
```
await page.waitForSelector(".btn");
```
#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule noPlaywrightWaitForTimeout. Disallows hard-coded timeouts with waitForTimeout().
```
await page.waitForTimeout(5000);
```
#8960 4a5ff40 Thanks @abossenbroek! - Enhanced noSkippedTests to detect Playwright patterns (.fixme, test.describe, test.step, bracket notation, bare calls). Consolidated noPlaywrightSkippedTest into this rule.
#9101 0c0fb6f Thanks @siketyan! - Fixed #9080: The noUnusedVariables rule no longer reports a top-level Props interface or type alias as unused in Astro files.

#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule useExpect. This rule ensures that test functions contain at least one expect() assertion.

// Invalid - test without assertion
test("no assertion", async ({ page }) => {
  await page.goto("/");
});

// Valid - test with assertion
test("has assertion", async ({ page }) => {
  await expect(page).toHaveTitle("Title");
});

#8960 4a5ff40 Thanks @abossenbroek! - Added the nursery rule usePlaywrightValidDescribeCallback. Validates that describe callback signatures are not async.
```
test.describe("suite", async () => {});
```

`v2.4.1`

Compare Source

Patch Changes

#9092 6edd600 Thanks @ematipico! - Fixed #9052. This PR reverts changes introduced by #8519, which caused unwanted changes on how paths are resolved.
#9091 3bf674d Thanks @ematipico! - Fixed #9090, where SCSS files were incorrectly processed by Biome. This was a regressions caused by the latest developments for supporting SCSS out of the box.
#9100 66931a8 Thanks @siketyan! - Fixed #9081: The noUnknownPseudoElement rule no longer reports false positives for any known pseudo elements in CSS modules. This was a regression introduced in v2.4.0.
#9102 d01b903 Thanks @ematipico! - Fixed #9095, where Biome didn't print anything in stdin mode. This was a regression caused by a recent, internal refactor.

`v2.4.0`

Compare Source

Minor Changes

#8964 0353fa0 Thanks @dyc3! - Added ignore option to the useHookAtTopLevel rule.

You can now specify function names that should not be treated as hooks, even if they follow the use* naming convention.

Example configuration:

{
  "linter": {
    "rules": {
      "correctness": {
        "useHookAtTopLevel": {
          "options": {
            "ignore": ["useDebounce", "useCustomUtility"]
          }
        }
      }
    }
  }
}

#8769 d0358b0 Thanks @rahuld109! - Added the rule useAnchorContent for HTML to enforce that anchor elements have accessible content for screen readers. The rule flags empty anchors, anchors with only whitespace, and anchors where all content is hidden with aria-hidden. Anchors with aria-label or title attributes providing a non-empty accessible name are considered valid.
#8742 6340ce6 Thanks @rahuld109! - Added the rule useMediaCaption to the HTML language. Enforces that audio and video elements have a track element with kind="captions" for accessibility. Muted videos are allowed without captions.
#8621 d11130b Thanks @Netail! - Added support for multiple reporters, and the ability to save reporters on arbitrary files.

Combine two reporters in CI

If you run Biome on GitHub, take advantage of the reporter and still see the errors in console, you can now use both reporters:

biome ci --reporter=default --reporter=github

Save reporter output to a file

With the new --reporter-file CLI option, it's now possible to save the output of all reporters to a file. The file is a path,
so you can pass a relative or an absolute path:

biome ci --reporter=rdjson --reporter-file=/etc/tmp/report.json
biome ci --reporter=summary --reporter-file=./reports/file.txt

You can combine these two features. For example, have the default reporter written on terminal, and the rdjson reporter written on file:

biome ci --reporter=default --reporter=rdjson --reporter-file=/etc/tmp/report.json

The --reporter and --reporter-file flags must appear next to each other, otherwise an error is thrown.

#8399 ab88099 Thanks @ematipico! - The Biome CSS parser is now able to parse Vue SFC syntax such as :slotted and :deep. These pseudo functions are only correctly parsed when the CSS is defined inside .vue components. Otherwise, Biome will a emit a parse error.

This capability is only available when experimentalFullHtmlSupportedEnabled is set to true.
#8663 3dfea16 Thanks @ematipico! - Added support for Cursor files. When Biome sees a Cursor JSON file, it will parse it with comments enabled and trailing commas enabled:
- $PROJECT/.cursor/
- %APPDATA%\Cursor\User\ on Windows
- ~/Library/Application Support/Cursor/User/ on macOS
- ~/.config/Cursor/User/ on Linux
#8723 fe2c642 Thanks @cbstns! - Added JSON as a target language for GritQL pattern matching. You can now write Grit plugins for JSON files.

This enables users to write GritQL patterns that match against JSON files, useful for:
- Searching and transforming JSON configuration files
- Enforcing patterns in package.json and other JSON configs
- Writing custom lint rules for JSON using GritQL
Example patterns:

Match all key-value pairs:
```
language json

pair(key = $k, value = $v)
```
Match objects with specific structure:
```
language json

JsonObjectValue()
```
Supports both native Biome AST names (JsonMember, JsonObjectValue) and TreeSitter-compatible names (pair, object, array) for compatibility with existing Grit patterns.

For more details, see the GritQL documentation.
#8814 4d9c676 Thanks @Netail! - Added ignore option to noUnknownProperty. If an unknown property name matches any of the items provided in ignore, a diagnostic won't be emitted.
#8631 4d8f19d Thanks @Netail! - Add a new reporter --reporter=sarif, that emits diagnostics using the SARIF format.
#8270 4f7909d Thanks @lucasweng! - Added the useIframeTitle lint rule for HTML. The rule enforces the usage of the title attribute for the iframe element.

Invalid:
```
<iframe></iframe> <iframe title=""></iframe>
```
Valid:
```
<iframe title="title"></iframe>
```
#8164 1d25856 Thanks @ematipico! - Added a new assist action useSortedInterfaceMembers that sorts TypeScript interface members, for readability.

It includes an autofix.

Invalid example.
```
interface MixedMembers {
  z: string;
  a: number;
  (): void;
  y: boolean;
}
```
Valid example (after using the assist).
```
interface MixedMembers {
  a: number;
  y: boolean;
  z: string;
  (): void;
}
```
#8647 4c7c06f Thanks @siketyan! - It's now possible to provide the stacktrace for a fatal error. The stacktrace is only available when the environment variable RUST_BACKTRACE=1 is set, either via the CLI or exported $PATH. This is useful when providing detailed information for debugging purposes:
```
RUST_BACKTRACE=1 biome lint
```
#7961 a04c8df Thanks @siketyan! - The Biome Language Server now reports progress while scanning files and dependencies in the project.
#8289 a9025d4 Thanks @theshadow27! - Fixed #8024. The rule useIterableCallbackReturn now supports a checkForEach option. When set to false, the rule will skip checking for forEach() callbacks for returning values.
#8690 e06e5d1 Thanks @ematipico! - Added the rule useValidLang to the HTML language.
#7847 e90b14f Thanks @Jagget! - Added support for jsxFactory and jsxFragmentFactory.Biome now respects jsxFactory and jsxFragmentFactory settings from tsconfig.json when using the classic JSX runtime, preventing false positive noUnusedImports errors for custom JSX libraries like Preact.
```
// tsconfig.json
{
  compilerOptions: {
    jsx: "react",
    jsxFactory: "h",
    jsxFragmentFactory: "Fragment",
  },
}
```
```
// Component.jsx
import { h, Fragment } from "preact";

function App() {
  return <div>Hello</div>;
}
```
#8071 7f5bcf4 Thanks @ematipico! - Added new CLI options to the commands lsp-proxy and start that allow to control the Biome file watcher.

`--watcher-kind`

Controls how the Biome file watcher should behave. By default, Biome chooses the best watcher strategy for the
current OS, however sometimes this could result in some issues, such as folders locked.

The option accepts the current values:

recommended: the default option, which chooses the best watcher for the current platform.
polling: uses the polling strategy.
none: it doesn't enable the watcher. When the watcher is disabled, changes to files aren't recorded anymore by Biome. This might have
repercussions on some lint rules that might rely on updated types or updated paths.

The environment variable BIOME_WATCHER_KIND can be used as alias.

`--watcher-polling-interval`

The polling interval in milliseconds. This is only applicable when using the polling watcher. It defaults to 2000 milliseconds.

The environment variable BIOME_WATCHER_POLLING_INTERVAL can be used as alias.

#8262 4186b83 Thanks @lucasweng! - Added the useHtmlLang lint rule for HTML. The rule enforces that the html element has a lang attribute.

Invalid:
```
<html></html>
<html lang></html>
<html lang=""></html>
```
Valid:
```
<html lang="en"></html>
```

#8376 1a9334c Thanks @siketyan! - Added support for formatting and linting embedded GraphQL snippets in JavaScript.

For example, the following snippets are now formatted:

import gql from "graphql-tag";

const PeopleCountQuery = gql`
  query PeopleCount {
    allPeople {
      totalCount
    }
  }
`;

import { graphql } from "./graphql";

const PeopleCountQuery = graphql(`
  query PeopleCount {
    allPeople {
      totalCount
    }
  }
`);

This feature is experimental and must be enabled explicitly in the configuration:

{
  "javascript": {
    "experimentalEmbeddedSnippetsEnabled": true
  }
}

#7799 54682aa Thanks @PaulRBerg! - Added groupByNesting option to the useSortedKeys assist. When enabled, object keys are grouped by their value's nesting depth before sorting alphabetically.

Simple values (primitives, single-line arrays, and single-line objects) are sorted first, followed by nested values (multi-line arrays and multi-line objects).

Example

To enable this option, configure it in your biome.json:

{
  "linter": {
    "rules": {
      "source": {
        "useSortedKeys": {
          "options": {
            "groupByNesting": true
          }
        }
      }
    }
  }
}

With this option, the following unsorted object:

const object = {
  name: "Sample",
  details: {
    description: "nested",
  },
  id: 123,
};

Will be sorted as:

const object = {
  id: 123,
  name: "Sample",
  details: {
    description: "nested",
  },
};

#8641 1dc8dc2 Thanks @tt-a1i! - Added the noAutofocus lint rule for HTML. This rule enforces that the autofocus attribute is not used on elements, as it can cause usability issues for sighted and non-sighted users. The rule allows autofocus inside dialog elements or elements with the popover attribute, as these are modal contexts where autofocus is expected.
#8501 8eb3f19 Thanks @tt-a1i! - Added noPositiveTabindex to HTML. This rule prevents the usage of positive integers on the tabindex attribute, which can disrupt natural keyboard navigation order.
#8661 b36ff03 Thanks @tt-a1i! - Added the useAltText lint rule for HTML. This rule enforces that elements requiring alternative text (<img>, <area>, <input type="image">, <object>) provide meaningful information for screen reader users via alt, title (for objects), aria-label, or aria-labelledby attributes. Elements with aria-hidden="true" are exempt.
#7749 1c59333 Thanks @andogq! - Implements #1984. Updated useHookAtTopLevel to better catch invalid hook usage.

This rule is now capable of finding invalid hook usage in more locations. A diagnostic will now be generated if:
- A hook is used at the module level (top of the file, outside any function).
- A hook is used within a function or method which is not a hook or component, unless it is a function expression (such as arrow functions commonly used in tests).
Invalid:
```
// Invalid: hooks cannot be called at the module level.
useHook();
```
```
// Invalid: hooks must be called from another hook or component.
function notAHook() {
  useHook();
}
```
Valid:
```
// Valid: hooks may be called from function expressions, such as in tests.
test("my hook", () => {
  renderHook(() => useHook());

  renderHook(function () {
    return useHook();
  });
});
```
#8307 789b0e7 Thanks @mehm8128! - Added the useValidAriaRole lint rule for HTML. The rule enforces that elements with ARIA roles must use a valid, non-abstract ARIA role.
#8814 4d9c676 Thanks @Netail! - Added ignore option to noUnknownFunction. If an unknown function name matches any of the items provided in ignore, a diagnostic won't be emitted.
#8814 4d9c676 Thanks @Netail! - Added ignore option to noUnknownPseudoClass. If an unknown pseudo-class name matches any of the items provided in ignore, a diagnostic won't be emitted.
#8623 dc1f94e Thanks @mldangelo! - Added the noDuplicateClasses assist action to detect and remove duplicate CSS classes.

For JSX files: Supports class, className attributes and utility functions like clsx, cn, cva.

For HTML files: Checks class attributes. This is the first assist action for HTML.
```
// Before
<div class="flex p-4 flex" />;

// After
<div class="flex p-4" />;
```
#8399 ab88099 Thanks @ematipico! - Improved the CSS parser for CSS modules. Biome now automatically enables CSS modules parsing for *.module.css files.

If your codebase has only *.module.css files, you can remove the parser feature as follows, because now Biome does it for you:
```
{
  "css": {
    "parser": {
-      "cssModules": true
    }
  }
}
```
#8399 [ab88099](https://redirec

Configuration

📅 Schedule: Branch creation - At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday ( * 0-4,22-23 * * 1-5 ), Only on Sunday and Saturday ( * * * * 0,6 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

cubic-dev-ai

No issues found across 1 file

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot added the dependencies label Jan 26, 2026

renovate bot enabled auto-merge (squash) January 26, 2026 23:13

renovate-approve-2 bot approved these changes Jan 26, 2026

View reviewed changes

renovate-approve bot approved these changes Jan 26, 2026

View reviewed changes

cubic-dev-ai bot reviewed Jan 26, 2026

View reviewed changes

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.3.13~~ chore(deps): update dependency @biomejs/biome to v2.3.14 Feb 3, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from 86610cd to a66893c Compare February 3, 2026 19:34

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from a66893c to 89407bd Compare February 12, 2026 13:00

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.3.14~~ chore(deps): update dependency @biomejs/biome to v2.3.15 Feb 12, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from 89407bd to 3754369 Compare February 15, 2026 18:29

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.3.15~~ chore(deps): update dependency @biomejs/biome to v2.4.0 Feb 15, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from 3754369 to b23bb29 Compare February 16, 2026 19:39

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.4.0~~ chore(deps): update dependency @biomejs/biome to v2.4.1 Feb 16, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from b23bb29 to 7e9ff55 Compare February 17, 2026 03:08

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.4.1~~ chore(deps): update dependency @biomejs/biome to v2.4.2 Feb 17, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from 7e9ff55 to f1f6c46 Compare February 19, 2026 22:58

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.4.2~~ chore(deps): update dependency @biomejs/biome to v2.4.3 Feb 19, 2026

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from f1f6c46 to a6dcec6 Compare February 20, 2026 22:29

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.4.3~~ chore(deps): update dependency @biomejs/biome to v2.4.4 Feb 20, 2026

chore(deps): update dependency @biomejs/biome to v2.4.5

bb56293

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate bot force-pushed the renovate/biomejs-biome-2.x-lockfile branch from a6dcec6 to bb56293 Compare March 2, 2026 15:39

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.4.4~~ chore(deps): update dependency @biomejs/biome to v2.4.5 Mar 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency @biomejs/biome to v2.4.5#316

chore(deps): update dependency @biomejs/biome to v2.4.5#316
renovate[bot] wants to merge 1 commit intomainfrom
renovate/biomejs-biome-2.x-lockfile

renovate bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.4.5

Patch Changes

v2.4.4

Patch Changes

v2.4.3

Patch Changes

v2.4.2

Patch Changes

v2.4.1

Patch Changes

v2.4.0

Minor Changes

Combine two reporters in CI

Save reporter output to a file

--watcher-kind

--watcher-polling-interval

Example

Configuration

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jan 26, 2026 •

edited

Loading

`v2.4.5`

`v2.4.4`

`v2.4.3`

`v2.4.2`

`v2.4.1`

`v2.4.0`

`--watcher-kind`

`--watcher-polling-interval`