chore(deps)(deps): bump the npm-dependencies group across 1 directory with 23 updates

[dependabot]

Bumps the npm-dependencies group with 23 updates in the /ui directory:

Package	From	To
@tailwindcss/postcss	4.3.1	4.3.2
@tanstack/react-query	5.101.0	5.101.2
i18next	26.3.1	26.3.4
immer	11.1.8	11.1.11
lucide-react	1.18.0	1.23.0
react-hook-form	7.79.0	7.81.0
react-router-dom	7.17.0	7.18.1
tailwindcss	4.3.1	4.3.2
valibot	1.4.1	1.4.2
@biomejs/biome	2.5.0	2.5.2
@playwright/test	1.61.0	1.61.1
@storybook/addon-a11y	10.4.5	10.4.6
@storybook/addon-docs	10.4.5	10.4.6
@storybook/addon-onboarding	10.4.5	10.4.6
@storybook/addon-vitest	10.4.5	10.4.6
@storybook/react-vite	10.4.5	10.4.6
@vitejs/plugin-react	6.0.2	6.0.3
@vitest/coverage-v8	4.1.9	4.1.10
playwright	1.61.0	1.61.1
postcss	8.5.15	8.5.16
storybook	10.4.5	10.4.6
vite	8.0.16	8.1.3
vitest	4.1.9	4.1.10

Updates @tailwindcss/postcss from 4.3.1 to 4.3.2

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.2] - 2026-06-26

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

Commits

• 056a155 4.3.2 (#20281)
• See full diff in compare view

Updates @tanstack/react-query from 5.101.0 to 5.101.2

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.101.2

Patch Changes

• Updated dependencies [f5bf180, 25cdd97, ecd89c8, 01c7634, 49012db]:
  • @​tanstack/query-devtools@​5.101.2
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query-next-experimental@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query-persist-client@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.2
  • @​tanstack/react-query@​5.101.2

@​tanstack/react-query@​5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

@​tanstack/react-query-devtools@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-devtools@​5.101.1
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query-next-experimental@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query-persist-client@​5.101.1

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.101.1
  • @​tanstack/react-query@​5.101.1

@​tanstack/react-query@​5.101.1

Patch Changes

• Updated dependencies [9eff92e]:

... (truncated)

Changelog

Sourced from @​tanstack/react-query's changelog.

5.101.2

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.101.2

5.101.1

Patch Changes

• Updated dependencies [9eff92e]:
  • @​tanstack/query-core@​5.101.1

Commits

• 610e8d1 ci: Version Packages (#10996)
• 1f84256 docs: document the select typing caveat for parallel-queries hooks (#10984)
• b809297 ci: Version Packages (#10977)
• ccc843e test({react,preact}-query/useQueries): move type-only tests to 'useQueries.te...
• 4154613 test({react,preact}-query/useMutation): split 'should handle conditional logi...
• 8bb5fde test({react,preact}-query/useMutation): split 'should pass meta to mutation' ...
• 87426a3 test(react-query): replace deprecated 'toBeCalledTimes' with 'toHaveBeenCalle...
• feb1efd test(*): move 'vi.useRealTimers' to the end of 'afterEach' so cleanup runs un...
• See full diff in compare view

Updates i18next from 26.3.1 to 26.3.4

Release notes

Sourced from i18next's releases.

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Changelog

Sourced from i18next's changelog.

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

Commits

• 817ede5 26.3.4
• 46d0dd8 build
• 642137b fix(security): prevent deepExtend from recursing into inherited built-ins
• cf7080d 26.3.3
• 05fd7be build
• cc0bd80 changelog: 26.3.3 entry for #2438
• 9cbfa63 fix(types): preserve selector returnObjects shape with context (#2438)
• 3b04712 26.3.2
• fc20f5d changelog: 26.3.2 entry for #2437
• 6901e04 fix: reassemble comma-in-parens formatters at any chain position (#2437)
• Additional commits viewable in compare view

Updates immer from 11.1.8 to 11.1.11

Release notes

Sourced from immer's releases.

v11.1.11

11.1.11 (2026-07-03)

Bug Fixes

• improve DraftMap.{entries,values}() compatibility#1228 (#1228) (858d036)

v11.1.10

11.1.10 (2026-07-03)

Bug Fixes

• undefined assigned to a prototype-inherited key gets dropped (#1262) (16e225b)

v11.1.9

11.1.9 (2026-07-01)

Bug Fixes

• prevent prototype pollution via constructor.prototype access (CVE-2026-XXXX) (#1259) (48fc378)

Commits

• 60ca295 chore(deps): bump @​sigstore/core from 3.2.0 to 3.2.1 (#1258)
• 858d036 fix: improve DraftMap.{entries,values}() compatibility#1228 (#1228)
• 89acf94 chore(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /website (#1257)
• f2b409e chore(deps-dev): bump vite from 6.4.2 to 6.4.3 (#1256)
• e6eb6e3 chore(deps): bump @​babel/plugin-transform-modules-systemjs in /website (#1238)
• 5868ec5 chore(deps): bump fast-uri from 3.1.0 to 3.1.2 in /website (#1237)
• c6ce0e9 chore(deps): bump tar from 7.5.13 to 7.5.16 (#1253)
• 9ec6559 chore(deps): bump joi from 17.7.0 to 17.13.4 in /website (#1250)
• 86c3776 chore(deps): bump shell-quote from 1.7.4 to 1.8.4 in /website (#1248)
• e606b33 chore(deps): bump shell-quote from 1.8.0 to 1.8.4 (#1247)
• Additional commits viewable in compare view

Updates lucide-react from 1.18.0 to 1.23.0

Release notes

Sourced from lucide-react's releases.

Version 1.23.0

What's Changed

• fix(docs): prevent scrollbar layout shift on icons page by @​g30r93g in lucide-icons/lucide#4500
• chore(docs): Remove certificates banner by @​ericfennis in lucide-icons/lucide#4504
• ci(repo-journal.yml): GH copilot repo summary by @​ericfennis in lucide-icons/lucide#4505
• ci(repo-journal.yml): Small fix in the workflow by @​ericfennis in lucide-icons/lucide#4508
• ci(repo-journal.yml): Switch to token by @​ericfennis in lucide-icons/lucide#4509
• feat(icons): added paper-bag icon by @​dkast in lucide-icons/lucide#4023

New Contributors

• @​g30r93g made their first contribution in lucide-icons/lucide#4500
• @​dkast made their first contribution in lucide-icons/lucide#4023

Full Changelog: lucide-icons/lucide@1.22.0...1.23.0

Version 1.22.0

What's Changed

• feat(icons): add 6 database variant icons by @​Barakudum in lucide-icons/lucide#4336
• ci(release.yml): Remove concurrency field to prevent release mess by @​ericfennis in lucide-icons/lucide#4485
• fix(docs): fix color input clipping by @​Hsiii in lucide-icons/lucide#4488
• docs(site): add Deno to installation instructions by @​bartlomieju in lucide-icons/lucide#4486
• chore(deps): bump esbuild from 0.25.12 to 0.28.1 by @​dependabot[bot] in lucide-icons/lucide#4459
• fix(docs): prevent private analytics token from blocking local dev by @​Hsiii in lucide-icons/lucide#4481
• docs(installation.md): Remove outdate next tag in installation by @​ericfennis in lucide-icons/lucide#4495
• fix(lucide-react-native): Fix context provider export by @​ericfennis in lucide-icons/lucide#4497
• fix(astro): add Astro v7 compatibility by @​iseraph-dev in lucide-icons/lucide#4491
• fix(icons): changed carrot icon by @​jguddas in lucide-icons/lucide#4010
• fix(icons): changed ungroup icon by @​jguddas in lucide-icons/lucide#3969
• feat(icons): added phi icon also used as golden-ratio by @​whoisBugsbunny in lucide-icons/lucide#4218

New Contributors

• @​bartlomieju made their first contribution in lucide-icons/lucide#4486

Full Changelog: lucide-icons/lucide@1.21.0...1.22.0

Version 1.21.0

What's Changed

• ci(release.yml): Remove new-version in release flow by @​ericfennis in lucide-icons/lucide#4478
• ci(release.yml): Fix workflow and remove version scripts in package scripts by @​ericfennis in lucide-icons/lucide#4479
• fix(docs): rename navigation category label by @​Hsiii in lucide-icons/lucide#4483
• feat(icons): added broken-bone icon by @​Patolord in lucide-icons/lucide#4131

New Contributors

• @​Hsiii made their first contribution in lucide-icons/lucide#4483
• @​Patolord made their first contribution in lucide-icons/lucide#4131

Full Changelog: lucide-icons/lucide@1.20.0...1.21.0

Version 1.20.0

What's Changed

... (truncated)

Commits

• 5ff536e ci(release.yml): Fix workflow and remove version scripts in package scripts...
• See full diff in compare view

Updates react-hook-form from 7.79.0 to 7.81.0

Release notes

Sourced from react-hook-form's releases.

Version 7.81.0

⚜️ feat: FieldArray component (#13394)

<FieldArray
  control={control}
  name="test"
  render={({ fields }) => null}
/>

🐞 fix #13538 useFieldArray min 1 item validation error changes its location in the errors object (#13539) 🐞 fix #13569 calling reset triggers subscribe with latest name instead of undefined (#13574) 🐞 fix(useController): reflect cleared parent object in controlled fields (#13550) (#13553) 🐞 fix(flatten): preserve Date values as leaf nodes (#13566) 🐛 fix(unset): guard against prototype keyword path traversal (#13559) (#13560) 🏸 improve setValue api with shrink value (#13576) 👝 close #13577 improve re-render with useFieldArray reset (#13578) 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#13579)

thanks to @​DakshSinghDhami, @​JSap0914, @​tran-simon & @​EduardF1

Version 7.80.0

🧄 feat: disable useFieldArray fields (#13535)

const { fields } = useFieldArray({ disabled: true });
fields[0].disabled; // contains disabled props

🛺 perf: make rhf more performant (#13524) 🐞 fix(deepEqual): empty array and empty plain object should not be equal (#13533)

thanks to @​JSap0914

Changelog

Sourced from react-hook-form's changelog.

[7.81.0] - 2026-07-05

Added

• FieldArray component built on useFieldArray for controlled field-array rendering

Fixed

• clearErrors changing the name value from form.subscribe
• reset triggering subscribe with the latest name instead of undefined
• setValues leaving stale elements behind when shrinking a field array
• flatten preserving Date values as leaf nodes
• useFieldArray min length validation error changing location in the errors object
• useController not reflecting a cleared parent object in controlled fields

Security

• Harden unset() against prototype-path traversal (__proto__ / constructor / prototype), matching the existing set() guard

Performance

• Improve re-render with useFieldArray reset

[7.80.0] - 2026-06-20

Added

• disabled prop support for individual fields within useFieldArray

Fixed

• deepEqual incorrectly treating empty array [] and empty plain object {} as equal

Performance

• Improve onChange, setValid, dirty checking, setValue, and setValues performance

Commits

• 46b217e 7.81.0
• 6595a91 🐞 fix #13575 issue: clearErrors changes the name value from form.subscribe (#...
• cae5dfe 👝 close #13577 improve re-render with useFieldArray reset (#13578)
• 5b2b743 🏸 improve setValue api with shrink value (#13576)
• 6112441 🐞 fix #13569 calling reset triggers subscribe with latest name instead of und...
• f89388f 🐞 fix(flatten): preserve Date values as leaf nodes (#13566)
• 46381fa Revert "docs: fix grammar in demo descriptions (#13565)" (#13568)
• d4c804a Revert "test: remove duplicate UseFieldArray slug (#13564)" (#13567)
• 63ec54f test: remove duplicate UseFieldArray slug (#13564)
• 08792ad docs: fix grammar in demo descriptions (#13565)
• Additional commits viewable in compare view

Updates react-router-dom from 7.17.0 to 7.18.1

Changelog

Sourced from react-router-dom's changelog.

v7.18.1

Patch Changes

• Fix incorrect package.json main field for CommonJS builds (#15238)
• Updated dependencies:
  • react-router@7.18.1

v7.18.0

Patch Changes

• Updated dependencies:
  • react-router@7.18.0

Commits

• afdf85d Release v7.18.1 (#15253)
• 2ecaa1d Fix react-router-dom main entry metadata (#15238)
• 6fb1e79 Release v7.18.0 (#15187)
• See full diff in compare view

Updates tailwindcss from 4.3.1 to 4.3.2

Release notes

Sourced from tailwindcss's releases.

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

Changelog

Sourced from tailwindcss's changelog.

[4.3.2] - 2026-06-26

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

Commits

• 056a155 4.3.2 (#20281)
• c8b081d Add suggestions for named opacity modifiers (#20287)
• c46f654 Ensure --alpha(…) is seen as a color, and --spacing(…) is seen as a `le...
• 5e9f66e Ensure @variant can be used in JS based APIs (#20252)
• 707c23b Ensure custom variants can be used via @variant in addBase (#20247)
• 127d170 Add bare value support for auto-rows-* and auto-cols-* (#20229)
• See full diff in compare view

Updates valibot from 1.4.1 to 1.4.2

Release notes

Sourced from valibot's releases.

v1.4.2

Many thanks to @​Faze-up and @​chatman-media for contributing to this release.

• Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #1521)
• Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #1522)
• Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #1522)

Commits

• 0dc26ea Bump library version to 1.4.2
• 1bd01c3 fix: handle keys that collide with Object.prototype in flatten and merge (#1522)
• 752c636 docs: clarify string length semantics (#1505)
• a3beff9 fix: cache word-count segmenter for non-primitive locales (#1521)
• 1f9b183 Update FUNDING.yml in fabvor of Open Collective
• 2c63b2a Update logos of partners in README
• 09616b2 Add CodeRabbit as partner and remove Stainless
• 92bcf55 Add Cloudflare to privacy policy page
• 9bb6617 Add Cloudflare as a deploy target to our website (#1508)
• c05bf95 Bump to-json-schema version to 1.7.1
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.0 to 2.5.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:act...
  Description has been truncated

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 35 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

[github-actions]

License Compliance Report

All dependencies pass license compliance checks

Go Dependencies

• Unknown: 35 package(s)
• MIT: 26 package(s)
• BSD-3-Clause: 16 package(s)
• Apache-2.0: 11 package(s)
• BSD-2-Clause: 1 package(s)

npm Dependencies

See full report in workflow artifacts

Allowed Licenses: MIT, Apache-2.0, BSD-*, ISC, CC0-1.0, MPL-2.0
Forbidden: GPL, AGPL, SSPL (strong copyleft)

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.