chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #6 · OpenPhysics/StandingWaves

dependabot · 2026-08-24T09:27:43Z

Bumps the development-dependencies group with 5 updates in the / directory:

Package	From	To
@biomejs/biome	`2.5.8`	`2.5.9`
happy-dom	`20.11.2`	`20.11.6`
tsx	`4.23.11`	`4.23.12`
vite	`8.2.1`	`8.2.2`
vitest	`4.1.10`	`4.1.11`

Updates @biomejs/biome from 2.5.8 to 2.5.9

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes
#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
@layer {
  a {
    color: red;
  }
}
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
 <div>
   
+
   
 </div>
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
@variant @xl {
  div {
    background: red;
  }
}
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
<script module>

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.9

Patch Changes
#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
@layer {
  a {
    color: red;
  }
}
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
 <div>
   
+
   
 </div>
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
@variant @xl {
  div {
    background: red;
  }
}
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
<script module>
  export function greet() {
    console.log("Hello!");

... (truncated)

Commits

2081460 ci: release (#11309)
6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
a8798ea feat: useNamedLayer (#11377)
85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
e65f07e feat(lint): nursery useControlLabel (#11312)
ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
See full diff in compare view

Updates happy-dom from 20.11.2 to 20.11.6

Release notes

Sourced from happy-dom's releases.

v20.11.6

👷‍♂️ Patch fixes

Updates docs for the global-registrator package - By @capricorn86 in task #2300

v20.11.5

👷‍♂️ Patch fixes

Allow explicit element types for querySelector (e.g. querySelector<HTMLInputElement>(".my-input")) - By @cyphercodes

v20.11.4

👷‍♂️ Patch fixes

Fixes the CORS check fetch() to match origins instead of host and protocol - By @rexxars in task #1490

v20.11.3

👷‍♂️ Patch fixes

Make document.links return a live HTMLCollection - By @bangseongbeom in task #2299

Copy labels array to prevent mutation of cached querySelectorAll result - By @mixelburg in task #2226

Commits

d43c106 fix: #2300 Updates docs for the global-registrator package (#2301)
e978bc8 fix: Allow explicit element types for querySelector (#2283)
1bc1505 fix: #1490 Different ports/parent domains are different origins (#2286)
0378ff9 fix: #2299 Make document.links return a live HTMLCollection
16a6ea2 fix: #2226 Copy labels array to prevent mutation of cached querySelectorAll...
8cc734b chore: #2276 Update sponsors (#2277)
See full diff in compare view

Updates tsx from 4.23.11 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

This release is also available on:

npm package (@latest dist-tag)

Commits

ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
651f5be test: cover CommonJS TypeScript import.meta paths
See full diff in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

bundled-dev: handle lazy request error (#23291) (3ba026d)

bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)

config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)

css: don't pass empty targets to lightningcss (#23295) (2804636)

define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)

deps: update all non-major dependencies (#23217) (ba958bd)

deps: update rolldown-related dependencies (#23218) (83ecb2c)

module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)

optimizer: close custom extension analysis bundles (#23207) (8fb7675)

reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)

respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)

ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)

vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)

use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

define: close rolldown bundler after generate (#23231) (b4d66fe)

module-runner: add TLA circular import case (#23299) (4a261f2)

module-runner: simplify server-hmr tests (#23300) (599b44b)

ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

de1111a release: v8.2.2
cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
2804636 fix(css): don't pass empty targets to lightningcss (#23295)
599b44b test(module-runner): simplify server-hmr tests (#23300)
4a261f2 test(module-runner): add TLA circular import case (#23299)
Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ectory with 5 updates Bumps the development-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.8` | `2.5.9` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.11.2` | `20.11.6` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.11` | `4.23.12` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@biomejs/biome` from 2.5.8 to 2.5.9 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.9/packages/@biomejs/biome) Updates `happy-dom` from 20.11.2 to 20.11.6 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.11.2...v20.11.6) Updates `tsx` from 4.23.11 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.11...v4.23.12) Updates `vite` from 8.2.1 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: happy-dom dependency-version: 20.11.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-08-24T09:27:44Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-08-24T09:28:21Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@biomejs/biome

2.5.9

Unknown

npm/@biomejs/cli-darwin-arm64

2.5.9

Unknown

npm/@biomejs/cli-darwin-x64

2.5.9

Unknown

npm/@biomejs/cli-linux-arm64

2.5.9

Unknown

npm/@biomejs/cli-linux-arm64-musl

2.5.9

Unknown

npm/@biomejs/cli-linux-x64

2.5.9

Unknown

npm/@biomejs/cli-linux-x64-musl

2.5.9

Unknown

npm/@biomejs/cli-win32-arm64

2.5.9

Unknown

npm/@biomejs/cli-win32-x64

2.5.9

Unknown

npm/@oxc-project/types

0.146.0

Unknown

npm/@rolldown/binding-android-arm-eabi

1.2.5

Unknown

npm/@rolldown/binding-android-arm64

1.2.5

Unknown

npm/@rolldown/binding-darwin-arm64

1.2.5

Unknown

npm/@rolldown/binding-darwin-x64

1.2.5

Unknown

npm/@rolldown/binding-freebsd-x64

1.2.5

Unknown

npm/@rolldown/binding-linux-arm-gnueabihf

1.2.5

Unknown

npm/@rolldown/binding-linux-arm64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-arm64-musl

1.2.5

Unknown

npm/@rolldown/binding-linux-ppc64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-s390x-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-x64-gnu

1.2.5

Unknown

npm/@rolldown/binding-linux-x64-musl

1.2.5

Unknown

npm/@rolldown/binding-openharmony-arm64

1.2.5

Unknown

npm/@rolldown/binding-win32-arm64-msvc

1.2.5

Unknown

npm/@rolldown/binding-win32-x64-msvc

1.2.5

Unknown

npm/@vitest/expect

4.1.11

Unknown

npm/@vitest/mocker

4.1.11

Unknown

npm/@vitest/pretty-format

4.1.11

Unknown

npm/@vitest/runner

4.1.11

Unknown

npm/@vitest/snapshot

4.1.11

Unknown

npm/@vitest/spy

4.1.11

Unknown

npm/@vitest/utils

4.1.11

Unknown

npm/happy-dom

20.11.6

🟢 6.4

Details

Check	Score	Reason
Maintained	🟢 10	24 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	⚠️ 2	Found 7/30 approved changesets -- score normalized to 2
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
Packaging	🟢 10	packaging workflow detected
SAST	🟢 7	SAST tool is not run on all commits -- score normalized to 7

npm/rolldown

1.2.5

Unknown

npm/tinyrainbow

3.1.1

Unknown

npm/tsx

4.23.12

Unknown

npm/vite

8.2.2

🟢 6.8

Details

Check	Score	Reason
Code-Review	🟢 7	Found 20/27 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Token-Permissions	🟢 6	detected GitHub workflow tokens with excessive permissions
License	🟢 10	license file detected
Binary-Artifacts	⚠️ 1	binaries present in source code
Pinned-Dependencies	🟢 7	dependency not pinned by hash detected -- score normalized to 7
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Fuzzing	⚠️ 0	project is not fuzzed
SAST	🟢 10	SAST tool is run on all commits

npm/vitest

4.1.11

Unknown

Scanned Files

package-lock.json

dependabot Bot requested a review from veillette as a code owner August 24, 2026 09:27

Navigation Menu

Uh oh!

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates - #6

chore(deps-dev): bump the development-dependencies group across 1 directory with 5 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-9a3ff4f05f

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Uh oh!

github-actions Bot commented Aug 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 24, 2026

Biome CLI v2.5.9

2.5.9

Patch Changes

2.5.9

Patch Changes

v20.11.6

👷‍♂️ Patch fixes

v20.11.5

👷‍♂️ Patch fixes

v20.11.4

👷‍♂️ Patch fixes

v20.11.3

👷‍♂️ Patch fixes

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

plugin-legacy@8.2.2

v8.2.2

8.2.2 (2026-08-20)

Features

Bug Fixes

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Build System

v4.1.11

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot Bot commented on behalf of github Aug 24, 2026

Labels

Uh oh!

github-actions Bot commented Aug 24, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants