Skip to content

chore(deps-dev): bump @biomejs/biome from 2.5.6 to 2.5.7 in the npm-dev-dependencies group across 1 directory - #763

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dev-dependencies-b55ea31c86
Open

chore(deps-dev): bump @biomejs/biome from 2.5.6 to 2.5.7 in the npm-dev-dependencies group across 1 directory#763
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dev-dependencies-b55ea31c86

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dev-dependencies group with 1 update in the / directory: @biomejs/biome.

Updates @biomejs/biome from 2.5.6 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

  • #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

    ├── biome.json
    └── subdirectory
        ├── biome.json
        └── lib.js
    
    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

  • #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
    declare function schedule(handler: () => Promise<void>): string | undefined;
    schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.7

Patch Changes

  • #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

    ├── biome.json
    └── subdirectory
        ├── biome.json
        └── lib.js
    
    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

  • #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
    declare function schedule(handler: () => Promise<void>): string | undefined;
    schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

    type Mapper<T> = () => T;
    declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-dev-dependencies group with 1 update in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@biomejs/biome` from 2.5.6 to 2.5.7
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.7/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area:frontend Changes in frontend marketing site (apps/web/marketing/**) type:dependency Dependency updates (Renovate or manual) labels Aug 10, 2026
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​biomejs/​biome@​2.5.710010010099100

View full report

@github-actions
github-actions Bot enabled auto-merge (squash) August 10, 2026 10:35
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying profiletailors with  Cloudflare Pages  Cloudflare Pages

Latest commit: c2a22e5
Status: ✅  Deploy successful!
Preview URL: https://fbe99079.profiletailors-com.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-npm-kt4m.profiletailors-com.pages.dev

View logs

@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying app-profile-tailors with  Cloudflare Pages  Cloudflare Pages

Latest commit: c2a22e5
Status: ✅  Deploy successful!
Preview URL: https://0cd320a9.app-profile-tailors.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-npm-42ax.app-profile-tailors.pages.dev

View logs

yacosta738 added a commit that referenced this pull request Aug 10, 2026
…I for merge queue (#765)

* ci: run CI on merge_group for merge queue support

Add the merge_group trigger so the workflow executes on the temporary
commits GitHub creates for the merge queue (gh-readonly-queue/**). Without
it, the required status check never runs and the queue stalls.

Disable cancel-in-progress for merge_group events: cancelling a run that
is in the queue fails the group, so only cancel duplicate push/PR runs.

* chore(deps): remove dependabot in favor of renovate

Dependabot and Renovate were both opening PRs for the same dependencies
(e.g. codecov-action #648/#740, @biomejs/biome #763/#701, vitest #587/#756).
Keep Renovate only: it already groups ecosystem updates, schedules major
reviews, and auto-merges safe patches.

Delete the dependabot config and its auto-merge workflow (gated on
dependabot[bot] actor), and reword the type:dependency label.

* chore(deps): expand renovate grouping for real dependency map

Group the remaining ecosystems by the actual dependencies in
gradle/libs.versions.toml and the frontend package.json files:

- Spring Framework & Security, Spring AI, Jackson (tools.jackson + 2.x compat),
  Reactor, backend testing libs, Gradle plugins
- Vue UI/headless stack (reka-ui, shadcn-vue, vaul-vue, embla-carousel-vue,
  tanstack-vue-table, pragmatic-drag-and-drop, etc.)
- Vite/Vitest tooling, TypeScript and @types, @vue/* and @vueuse/*, Astro
  icon sets, Playwright/axe coverage

Drop the stale matchFileNames from Vue Core and Astro so grouping applies
across app, admin and marketing, and add groups that were missing entirely.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:frontend Changes in frontend marketing site (apps/web/marketing/**) type:dependency Dependency updates (Renovate or manual)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants