chore(deps-dev): Bump the development-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #1 · OpenLyceum/MotionMatch

dependabot · 2026-08-28T16:28:47Z

Bumps the development-dependencies group with 4 updates in the / directory: @biomejs/biome, happy-dom, vite and vitest.

Updates @biomejs/biome from 2.5.8 to 2.5.10

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.
<div /* block comment */ class="something"></div>
<Component /* c */ client:load />
#11403 8f7786f Thanks @Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.
#11438 3133ffa Thanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.
<div>{/* a note */}</div>
<div class={/* a note */}>x</div>
#11403 8f7786f Thanks @Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.
<div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>
#11403 8f7786f Thanks @Princesseuh! - Added support for Astro's fragment shorthand.
<>
  <p>a</p>
</>
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.
---
const a = "</script>";
// </script> in a comment
---
#11403 8f7786f Thanks @Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.10

Patch Changes
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.
<div /* block comment */ class="something"></div>
<Component /* c */ client:load />
#11403 8f7786f Thanks @Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.
#11438 3133ffa Thanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.
<div>{/* a note */}</div>
<div class={/* a note */}>x</div>
#11403 8f7786f Thanks @Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.
<div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>
#11403 8f7786f Thanks @Princesseuh! - Added support for Astro's fragment shorthand.
<>
  <p>a</p>
</>
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.
---
const a = "</script>";
// </script> in a comment
---
#11403 8f7786f Thanks @Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Commits

05797b1 ci: release (#11450)
5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
2081460 ci: release (#11309)
6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
a8798ea feat: useNamedLayer (#11377)
85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
e65f07e feat(lint): nursery useControlLabel (#11312)
ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
See full diff in compare view

Updates happy-dom from 20.11.2 to 20.11.6

Release notes

Sourced from happy-dom's releases.

v20.11.6

👷‍♂️ Patch fixes

Updates docs for the global-registrator package - By @capricorn86 in task #2300

v20.11.5

👷‍♂️ Patch fixes

Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @cyphercodes

v20.11.4

👷‍♂️ Patch fixes

Fixes the CORS check fetch() to match origins instead of host and protocol - By @rexxars in task #1490

v20.11.3

👷‍♂️ Patch fixes

Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299

Copy labels array to prevent mutation of cached querySelectorAll result - By @mixelburg in task #2226

Commits

d43c106 fix: #2300 Updates docs for the global-registrator package (#2301)
e978bc8 fix: Allow explicit element types for querySelector (#2283)
1bc1505 fix: #1490 Different ports/parent domains are different origins (#2286)
0378ff9 fix: #2299 Make document.links return a live HTMLCollection
16a6ea2 fix: #2226 Copy labels array to prevent mutation of cached querySelectorAll...
8cc734b chore: #2276 Update sponsors (#2277)
See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

bundled-dev: handle lazy request error (#23291) (3ba026d)

bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)

config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)

css: don't pass empty targets to lightningcss (#23295) (2804636)

define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)

deps: update all non-major dependencies (#23217) (ba958bd)

deps: update rolldown-related dependencies (#23218) (83ecb2c)

module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)

optimizer: close custom extension analysis bundles (#23207) (8fb7675)

reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)

respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)

ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)

vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)

use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

define: close rolldown bundler after generate (#23231) (b4d66fe)

module-runner: add TLA circular import case (#23299) (4a261f2)

module-runner: simplify server-hmr tests (#23300) (599b44b)

ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

de1111a release: v8.2.2
cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
2804636 fix(css): don't pass empty targets to lightningcss (#23295)
599b44b test(module-runner): simplify server-hmr tests (#23300)
4a261f2 test(module-runner): add TLA circular import case (#23299)
Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

dependabot · 2026-08-28T16:28:48Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

…ectory with 4 updates Bumps the development-dependencies group with 4 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [happy-dom](https://github.com/capricorn86/happy-dom), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `@biomejs/biome` from 2.5.8 to 2.5.10 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome) Updates `happy-dom` from 20.11.2 to 20.11.6 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.2...v20.11.6) Updates `vite` from 8.2.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: happy-dom dependency-version: 20.11.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-28T17:06:01Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@biomejs/biome

2.5.10

Unknown

npm/@biomejs/cli-darwin-arm64

2.5.10

Unknown

npm/@biomejs/cli-darwin-x64

2.5.10

Unknown

npm/@biomejs/cli-linux-arm64

2.5.10

Unknown

npm/@biomejs/cli-linux-arm64-musl

2.5.10

Unknown

npm/@biomejs/cli-linux-x64

2.5.10

Unknown

npm/@biomejs/cli-linux-x64-musl

2.5.10

Unknown

npm/@biomejs/cli-win32-arm64

2.5.10

Unknown

npm/@biomejs/cli-win32-x64

2.5.10

Unknown

npm/@oxc-project/types

0.146.0

Unknown

npm/@rolldown/binding-android-arm-eabi

1.2.5

Unknown

npm/@rolldown/binding-android-arm64

1.2.5

Unknown

npm/@rolldown/binding-darwin-arm64

1.2.5

Unknown

npm/@rolldown/binding-darwin-x64

1.2.5

Unknown

npm/@rolldown/binding-freebsd-x64

1.2.5

Unknown

npm/@rolldown/binding-linux-arm-gnueabihf

1.2.5

Unknown

npm/@rolldown/binding-linux-arm64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-arm64-musl

1.2.5

Unknown

npm/@rolldown/binding-linux-ppc64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-s390x-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-x64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-x64-musl

1.2.5

Unknown

npm/@rolldown/binding-openharmony-arm64

1.2.5

Unknown

npm/@rolldown/binding-win32-arm64-msvc

1.2.5

Unknown

npm/@rolldown/binding-win32-x64-msvc

1.2.5

Unknown

npm/@vitest/expect

4.1.11

Unknown

npm/@vitest/mocker

4.1.11

Unknown

npm/@vitest/pretty-format

4.1.11

Unknown

npm/@vitest/runner

4.1.11

Unknown

npm/@vitest/snapshot

4.1.11

Unknown

npm/@vitest/spy

4.1.11

Unknown

npm/@vitest/utils

4.1.11

Unknown

npm/happy-dom

20.11.6

🟢 6.4

Details

Check	Score	Reason
Maintained	🟢 10	24 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 2	Found 7/30 approved changesets -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

npm/rolldown

1.2.5

Unknown

npm/tinyrainbow

3.1.1

Unknown

npm/vite

8.2.2

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 20/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Binary-Artifacts	⚠️ 1	binaries present in source code
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/vitest

4.1.11

Unknown

Scanned Files

package-lock.json

veillette

Routine Dependabot dependency bump. Build and dependency review pass; approving for merge.

dependabot Bot requested a review from veillette as a code owner August 28, 2026 16:28

dependabot Bot changed the title ~~chore(deps-dev): bump the development-dependencies group with 4 updates~~ chore(deps-dev): Bump the development-dependencies group across 1 directory with 4 updates Aug 28, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-e3e73208a6 branch from c4cefb8 to 94740e7 Compare August 28, 2026 17:05

veillette approved these changes Aug 28, 2026

View reviewed changes

veillette merged commit 67553b1 into main Aug 28, 2026
7 of 8 checks passed

veillette deleted the dependabot/npm_and_yarn/development-dependencies-e3e73208a6 branch August 28, 2026 19:01

Navigation Menu

Uh oh!

chore(deps-dev): Bump the development-dependencies group across 1 directory with 4 updates - #1

chore(deps-dev): Bump the development-dependencies group across 1 directory with 4 updates#1
veillette merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-e3e73208a6

dependabot Bot commented on behalf of github Aug 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Aug 28, 2026

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

veillette left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.5.10

2.5.10

Patch Changes

2.5.10

Patch Changes

v20.11.6

👷‍♂️ Patch fixes

v20.11.5

👷‍♂️ Patch fixes

v20.11.4

👷‍♂️ Patch fixes

v20.11.3

👷‍♂️ Patch fixes

plugin-legacy@8.2.2

v8.2.2

8.2.2 (2026-08-20)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Build System

v4.1.11

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot Bot commented on behalf of github Aug 28, 2026

Labels

Uh oh!

github-actions Bot commented Aug 28, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

veillette left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Aug 28, 2026 •

edited

Loading