chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.2	2.5.11
@semantic-release/changelog	6.0.3	7.0.0
@semantic-release/git	10.0.1	11.0.1
@types/node	26.1.0	26.4.0
semantic-release	25.0.5	25.0.9
typescript	6.0.3	7.0.2
vitest	4.1.10	4.1.11

Updates @biomejs/biome from 2.5.2 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates @semantic-release/changelog from 6.0.3 to 7.0.0

Release notes

Sourced from @​semantic-release/changelog's releases.

v7.0.0

7.0.0 (2026-07-21)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

• Replaced xo with prettier with default configuration; following newly established convention
• Replaced nyc with c8 for code coverage
• Replaced lodash with lodash-es for proper esm support

Related Issue

• semantic-release/semantic-release#2133
• semantic-release/semantic-release#4032

v7.0.0-beta.1

7.0.0-beta.1 (2026-04-23)

Features

• ES Module (#414) (e154214)

BREAKING CHANGES

• @semantic-release/changelog is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b1044e1 chore(ci): update Node.js version requirements and test matrix configurations
• 0563e5d chore(deps): update to the latest semantic-release version (#417)
• e154214 feat: ES Module (#414)
• 15e48e4 chore(deps): update dependency sinon to v18.0.1 (#400)
• 1c48000 test: remove codecov (#399)
• 3be34e3 ci(action): update actions/setup-node action to v4.0.3 (#395)
• 854ffb6 ci(action): update actions/checkout action to v4.1.7 (#393)
• e7c79f8 chore(deps): update dependency nyc to v17 (#392)
• 171adfb ci(action): update actions/checkout action to v4.1.6 (#390)
• 13e3bf7 chore(deps): update dependency sinon to v18 (#389)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/changelog since your current version.

Updates @semantic-release/git from 10.0.1 to 11.0.1

Release notes

Sourced from @​semantic-release/git's releases.

v11.0.1

11.0.1 (2026-07-24)

Bug Fixes

• deps: update dependency execa to v10 (#564) (b39d5c6)

v11.0.0

11.0.0 (2026-07-21)

Features

• ES Module (#544) (4d704a2), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/git is now v20.1.0

v11.0.0-beta.2

11.0.0-beta.2 (2026-07-20)

Bug Fixes

• update Node.js engine version requirements in package.json and package-lock.json (ddf699e)

v11.0.0-beta.1

11.0.0-beta.1 (2026-07-17)

Features

• ES Module (#526) (e523946), closes #491 #490

BREAKING CHANGES

• @semantic-release/git is now a native ES Module. It has named exports for each plugin hook (verifyConditions, prepare)
• the minimum required version of semantic-release to use @semantic-release/changelog is now v20.1.0

Other Notable Changes

... (truncated)

Commits

• b39d5c6 fix(deps): update dependency execa to v10 (#564)
• 9dd61f1 chore(deps): lock file maintenance (#470)
• c5c6f06 chore(deps): update dependency lodash-es to v4.18.1 [security] (#545)
• b67458c ci(action): update actions/setup-node action to v6.5.0 (#557)
• d4990ff ci(action): update actions/checkout action to v6.1.0 (#556)
• 16d191f chore(deps): update dependency tempy to v3.2.0 (#448)
• 8efa7b7 chore(deps): update dependency sinon to v21.1.2 (#554)
• e53dc53 chore(deps): update dependency prettier to v3.9.5 (#552)
• 4c2f87f chore(deps): update dependency ls-engines to v0.10.1 (#551)
• 7685d83 chore(deps): update dependency ava to v6.4.1 (#548)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​semantic-release/git since your current version.

Updates @types/node from 26.1.0 to 26.4.0

Commits

• See full diff in compare view

Updates semantic-release from 25.0.5 to 25.0.9

Release notes

Sourced from semantic-release's releases.

v25.0.9

25.0.9 (2026-08-05)

Bug Fixes

• do not expose the authenticated repository URL in EGITNOPERMISSION errors (#4283) (8d905a5)

v25.0.8

25.0.8 (2026-07-18)

Bug Fixes

• handle potential null values in commit message and gitTags trimming (0a60004)
• hide-sensitive: mask key/auth/webhook env vars (973d763)
• mask sensitive environment variables and improve commit handling (#4252) (1bfdc52)
• prevent template evaluation syntax in branch expansion and tag formatting (f121540)

v25.0.7

25.0.7 (2026-07-13)

Bug Fixes

• argument Injection via repositoryUrl in package.json (#4245) (c46dbda)

v25.0.6

25.0.6 (2026-07-10)

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

Commits

• 8d905a5 fix: do not expose the authenticated repository URL in EGITNOPERMISSION error...
• e176eb7 ci(action): update github/codeql-action action to v4.37.6 (#4282)
• d27db1b chore(deps): update dependency js-yaml to v4.3.1 (#4279)
• 55beeac ci(action): update github/codeql-action action to v4.37.5 (#4277)
• 7bf348d chore(deps): update dependency nock to v14.0.17 (#4275)
• 2ec3ba2 chore(deps): update dependency mockserver-client to v7.5.0 (#4274)
• d3b7724 chore(deps): update npm to v12.0.2 (#4273)
• 514dc5f chore(deps): update dependency npm-run-all2 to v9.0.3 (#4271)
• f25b716 ci(action): update github/codeql-action action to v4.37.4 (#4270)
• 1114416 chore: remove 'next version' badge from README (#4265)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view