chore(deps-dev): bump the npm-dev-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #1108 · ai-driven-dev/framework

dependabot · 2026-10-26T20:56:38Z

Bumps the npm-dev-dependencies group with 6 updates in the /cli directory:

Package	From	To
@biomejs/biome	`2.5.15`	`2.6.2`
@commitlint/cli	`21.2.3`	`21.2.4`
@commitlint/config-conventional	`21.2.3`	`21.2.4`
@stryker-mutator/core	`10.0.0`	`10.1.1`
jscpd	`5.4.1`	`5.4.2`
knip	`6.41.0`	`6.42.1`

Updates @biomejs/biome from 2.5.15 to 2.6.2

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes
#11479 5c60ba8 Thanks @nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

#11742 3a1356d Thanks @Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.
#12318 774b5b5 Thanks @Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

Invalid:
type User {
  id: ID!
}
enum Role {
ADMIN
USER
}
directive @auth on FIELD_DEFINITION
#6886 3479d15 Thanks @christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

#11102 0874b7f Thanks @gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.
#10711 40de5a0 Thanks @soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.
{
  "plugins": [
    { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
    { "path": "local-plugin.grit", "resolutionKind": "project" },
    { "path": "local-plugin.grit" }
  ]
}
Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.
#11432 4befd08 Thanks @ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.6.2

Patch Changes

#12494 3f40430 Thanks @ematipico! - Fix another patch

2.6.1

Patch Changes

#12492 edaa1db Thanks @ematipico! - Fixes a problem with npm publishing

2.6.0

Minor Changes
#11479 5c60ba8 Thanks @nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

#11742 3a1356d Thanks @Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.
#12318 774b5b5 Thanks @Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

Invalid:
type User {
  id: ID!
}
enum Role {
ADMIN
USER
}
directive @auth on FIELD_DEFINITION
#6886 3479d15 Thanks @christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

#11102 0874b7f Thanks @gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.
#10711 40de5a0 Thanks @soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.
{
  "plugins": [
    { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
    { "path": "local-plugin.grit", "resolutionKind": "project" },

... (truncated)

Commits

0d9aef6 ci: release (#12495)
30ffad1 ci: release (#12493)
8c814e1 ci: release (#12065)
e51cec2 chore: update sponsors (#12428)
cb88f07 feat(lint): add noSvelteClassDirective (#12254)
774b5b5 feat: sorted GraphQL documents (#12318)
914dca7 feat(lint/js): add noUselessCall (#12082)
a3fa0d6 feat(graphql_analyze): implement useSortedArguments (#12282)
5f8ea6c feat(lint): add noVueLifecycleAfterAwait (#12229)
b92638b feat(lint): add noVueShadowNativeEvents (#12136)
Additional commits viewable in compare view

Updates @commitlint/cli from 21.2.3 to 21.2.4

Release notes

Sourced from @commitlint/cli's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

fix(load): replace config file arrays with seed arrays by @escapedcat in conventional-changelog/commitlint#5056

fix: update dependency jsonc to v3 by @renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

perf(load): load typescript configs with jiti directly by @escapedcat in conventional-changelog/commitlint#5052

Docs, etc

docs: add AGENTS.md with commit type guidance by @escapedcat in conventional-changelog/commitlint#5053

test(ensure): pin case conversion of digits, punctuation and accents by @escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @commitlint/cli's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @commitlint/cli

Commits

d8e3656 v21.2.4
See full diff in compare view

Updates @commitlint/config-conventional from 21.2.3 to 21.2.4

Release notes

Sourced from @commitlint/config-conventional's releases.

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

fix(load): replace config file arrays with seed arrays by @escapedcat in conventional-changelog/commitlint#5056

fix: update dependency jsonc to v3 by @renovate[bot] in conventional-changelog/commitlint#5020

Performance Improvements

perf(load): load typescript configs with jiti directly by @escapedcat in conventional-changelog/commitlint#5052

Docs, etc

docs: add AGENTS.md with commit type guidance by @escapedcat in conventional-changelog/commitlint#5053

test(ensure): pin case conversion of digits, punctuation and accents by @escapedcat in conventional-changelog/commitlint#5055

Full Changelog: conventional-changelog/commitlint@v21.2.3...v21.2.4

Changelog

Sourced from @commitlint/config-conventional's changelog.

21.2.4 (2026-10-18)

Note: Version bump only for package @commitlint/config-conventional

Commits

d8e3656 v21.2.4
See full diff in compare view

Updates @stryker-mutator/core from 10.0.0 to 10.1.1

Release notes

Sourced from @stryker-mutator/core's releases.

v10.1.1

10.1.1 (2026-10-23)

Due to the below provenance issue in the release process, this is a re-release of v10.1.0.

For more information on the provenance issue, see: sigstore/sigstore-js#1708 and npm/cli#10078

v10.1.0

10.1.0 (2026-10-23)

Bug Fixes

core: prevent test runners racing to populate shared caches on startup (#6251) (c931a93), closes #6250

instrumenter: crash when mutating ts non null expression in babel >= 8 (#6221) (e873a24), closes #6185

vitest-runner: do not select tests whose name only starts with a filtered name (#6246) (6ad4adb)

vitest-runner: report mutant collection failures instead of surviving mutants (#6269) (cf5695e)

Features

add opt-in mutation-phase test timing diagnostics with sidecar reporter (#5866) (201dce8)

core: cli option for command runner (#6006) (aa7f3bb), closes #5153

core: report mutant duration in the mutation report (#6252) (7284a4a), closes #5866 #5866

vitest-runner: report test locations (#6188) (f2a49ff), closes #6186

vitest-runner: support vitest pool options (#6268) (3073ea2), closes #6236 #5982 #6223

vitest-runner: support vitest v5 (#6214) (10e2cca)

Changelog

Sourced from @stryker-mutator/core's changelog.

10.1.1 (2026-10-23)

Note: Version bump only for package @stryker-mutator/core

10.1.0 (2026-10-23)

Bug Fixes

core: prevent test runners racing to populate shared caches on startup (#6251) (c931a93), closes #6250

Features

add opt-in mutation-phase test timing diagnostics with sidecar reporter (#5866) (201dce8)

core: cli option for command runner (#6006) (aa7f3bb), closes #5153

core: report mutant duration in the mutation report (#6252) (7284a4a), closes #5866 #5866

Commits

9591277 v10.1.1
d6148ff v10.1.0
c931a93 fix(core): prevent test runners racing to populate shared caches on startup (...
7284a4a feat(core): report mutant duration in the mutation report (#6252)
8419413 chore(deps): update dependency prettier to v3.9.4 (#6089)
aa7f3bb feat(core): cli option for command runner (#6006)
201dce8 feat: add opt-in mutation-phase test timing diagnostics with sidecar reporter...
61c7a59 chore(deps): update dependency @types/semver to v7.8.0 (#6165)
See full diff in compare view

Updates jscpd from 5.4.1 to 5.4.2

Release notes

Sourced from jscpd's releases.

Release v5.4.2

The post What's new in jscpd 5.4.2 shows the new features with commands and real output.

New Features

Boundaries keep the code of a module inside it. The new boundaries key of the config file lists rules. A rule names the code it protects (code: a folder, a file, a glob, or a method as path#name), where copies of it must not show up (notIn, or every file outside code when it is left out) and where they may after all (allow). Every clone run checks the rules, and a copy of protected code outside its boundary fails the run with exit code 1. Import linters miss such copies, because a copied function imports nothing.

jscpd looks for copies three ways, and a rule can set its own bars in thresholds. Token clones find copy-paste, the structure comparison of --similarity finds an edited copy, and the --semantic model finds the same logic written again, often in another language. disable turns kinds off by their --kind names. Without a downloaded model, jscpd prints a warning and checks the rules without the semantic search.

A mistake in a rule, such as an unknown key or a glob that doesn't compile, stops the run with an error that names the rule. A rule that checks nothing in a run, after a typo in a path or a method name for example, gets a warning.

The console, console-full, ai and json reporters show the violations, the json one under boundaries. Baselines and --changed don't apply to violations yet, and SARIF, the language server and the MCP server don't report them.

fixtures/boundaries-demo is a small shop whose web app copies the backend's pricing and loan code. (#1225, #1227)

--ignore-identifiers pairs a name with one name. Every name used to match every other name, so x = x + x * x was a clone of d = a + b * c, although its data flows another way. Now a name on one side has to stand for the same name on the other side every time, and two names can't stand for one, as in Baker's parameterized matching and NiCad's consistent renaming. On 24 projects in 11 languages, 6,942 of the 14,501 renamed clones that the old matching reported had no such mapping.

jscpd cuts a clone where a name starts to stand for two and still reports every part of --min-tokens tokens or more.

A name reached as a member, after . or ?., and after -> in C, C++, PHP and Perl, is another name than a local of the same text. A constructor that sets this.url = url still matches its copy that sets this.url = link (#1220).

--ignore-identifiers and --ignore-identifiers=consistent give the new matching, --ignore-identifiers=blind the old one. The config takes "ignoreIdentifiers": true, "consistent" or "blind", and the Action input takes consistent or blind. The value goes after = only, so --ignore-identifiers src/ still scans src/.

fixtures/type2-demo has the consistent and members examples. (#1217, #1218)

--similarity pairs a name with one name too. The fingerprint of a subtree now records how its names repeat, so x = x + x * x no longer scores 1.0 against d = a + b * c, and a renamed copy still does. Members, labels such as keyword arguments and object keys, and types each have names of their own, so self.url = url still matches self.url = link. A function's own name matches any name. Kotlin's true, false and null and Clojure's true, false and nil are literals now. On the same 24 projects, 15 of 23,530 pairs fell below 0.8, and runs take 2 to 9% longer. --ignore-identifiers=blind brings back the old scores and also turns on renamed token clones. fixtures/similarity-demo/names scores a renamed copy at 1.00 and a mirrored function at 0.74. (#1219)

--history tracks the health score, and a bare --history walks the last 30 commits. Every commit of the series gets the score that jscpd --health gives its tree. The console draws a health chart under the duplication chart and adds HEALTH and CHANGE columns, and every point of the JSON report has health. --health and --dashboard take --history now: the badge or the dashboard comes first, then the series, in the markdown and html reports too.

jscpd --history used to fail with "a value is required". Without a value the flag takes the config's history, or else the newest 30 commits of HEAD (--history-limit). --history-every N spaces them N commits apart, and the Action's history input takes true.

jscpd scans a commit the way it scans the working tree: --ignore and --pattern see its files at their working-tree paths, and the checkout runs none of the repository's hooks. A walk that stops at the edge of a shallow clone prints a warning that names the commit.

The last 30 commits of axios take about 5.4 seconds, against 4.9 without the health score. (#1199)

jscpd knows 73 more formats by extension, and files by name. 94 of 224 formats had no built-in extension, a gap that came from v4, so jscpd . skipped Dockerfiles, Makefiles, go.mod, Elixir and Nix files unless you mapped them. The new extensions come from GitHub Linguist, and a table of file names maps Dockerfile, Containerfile, Makefile, go.mod, CMakeLists.txt, Gemfile, Jenkinsfile and others. Existing formats got more suffixes, such as .zsh, .jsonc, .tfvars and .sbt. A Markdown fence such as ```dockerfile takes its format from the same table, and --formats-exts and --formats-names still win over every built-in mapping. FORMATS.md lists the file names too. (#1174, #1192)

Changes

jscpd . scans more files. On 22 repositories the new file associations picked up 1 to 5 more files each, mostly Dockerfiles, .editorconfig, .jsonc, Makefiles and go.mod, and jscpd scans the .rst files of Sphinx docs like Markdown. The duplication percentage can move, and a --threshold gate can fail. (#1192)

--ignore-identifiers reports fewer renamed clones, and some of them are shorter. A baseline that 5.4 made with --ignore-identifiers is a blind one. Keep --ignore-identifiers=blind with it or update the baseline, or --fail-on-new-clones reports the cut clones as new. (#1218)

--history walks first parents. A merged branch counts as its merge commit, so a range across merged branches gives fewer points than before. jscpd builds a series only when a reporter shows it (console, console-full, ai or json, and markdown or html with --health or --dashboard), so a badge-only --health job no longer walks the range. The ai lines read 37be780 2026-08-08 2/1/47.6 +47.6 health 72 -2 now, and a wrong health or dead-code option no longer fails a clone run. (#1199)

Bug Fixes

jscpd aborted on a Markdown page whose front matter ran into a code fence. A page that opens with a horizontal rule and later shows a Python stub had front matter from the rule down to the stub's ..., across the fence, and the scan panicked: jscpd exited with 134, and jscpd --mcp and jscpd --lsp died. A --- on the first line now opens front matter only when the next line isn't blank, as Pandoc reads it, and only a --- or ... line before the first code fence closes it. The frontmatter of an Astro component follows the same rule. A page of code fences that never close used to take quadratic time, 3.9 seconds for 100 KB, and takes 0.04 seconds now. (#1223, #1226)

A Razor view was read out of order. jscpd tokenized the HTML of a whole view and then the C# of its blocks, so a clone across that seam ended before it started: release builds printed ranges such as [48:48 - 5:35], and debug builds panicked. A view is now one stream in the order of its text. Two identical views count as duplicated from the first line to the last, and markup in an @if or @foreach block matches the same markup outside one. (#1221, #1222)

The MCP server's check_duplication never matched a Vue, Svelte or Astro snippet. It tokenized a snippet as one stream, while a scan splits a component into its blocks and a Markdown file into its prose and fences. A component snippet met only the components inside Markdown fences, by meaning it found nothing, and the fences of a Markdown snippet matched nothing either. The server now splits a snippet the way a scan splits a file of its format. Each match has format and lines, and the note names every block too short to match. #1228 also fixed how jscpd counts the duplicated lines of a clone whose two fragments swap places, so the statistics of a --cross-formats run can change a little. (#1224, #1228, #1229)

--history failed when git's log.showSignature was on. git printed the signature check of each signed commit before the commit, and jscpd took that line for a commit hash. jscpd now passes --no-show-signature and reads only lines that start with a commit hash. Reported with an exact reproduction by @vitorcsbrito. (#1195, #1196)

--compare paired a function with every near-best lookalike. It took the rule of --semantic, where a group of near-equal functions all pair with each other, but in a port a function has one counterpart. A pair now stays only when it is the best match of one of its two functions, and a near tie goes to the partner in a file of the same name. On the analysis modules of Lucene and Lucene.NET the pairs went from 2,219 to 1,392, and the share of pairs between files of the same name from 46% to 73%. Analysis and numbers by @MysterionRise. (#1162, #1194)

--semantic reported a page and the component it renders as a clone. It skips a pair when one function calls the other, but it didn't count a JSX element such as <EditUserForm /> as a call. It does now, and so does the call graph of --compare. Reported by @Rosenblad, fixed by @cristianchiriac. (#1210, #1211)

Reports named a clone in a Markdown block or a component like guide.md:markup. The VS Code extension opened that name as a file and failed. The JSON name, the language server's jscpd/clones and jscpd/semantic, the XML path and the xcode location now name the file, and the JSON keeps the block's language in format. The console, ai and HTML reports still name the block. (#1200)

... (truncated)

Commits

db415b5 release: cpd-v5.4.2
See full diff in compare view

Updates knip from 6.41.0 to 6.42.1

Release notes

Sourced from knip's releases.

Release 6.42.1

fix(semantic-release): resolve shareable configs from extends (#2159) (4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks @giaBaoJS!

fix(jest): load projects entries as Jest configs (#2167) (4c22593724460890e4492ba86119d0188127f2ba) - thanks @Cayan!

Update npmx.dev snapshot (4b19797b77a559f7190e9119b3a156e1ac6aef9f)

fix(tailwind): track packages referenced from CSS url() (#2166) (949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks @agustincastaing!

Add .otf to foreign file extensions (fcff4db0b88d6282569743cd779aec5a5df99862)

Match quoted SCSS url() values within a single line (2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)

fix(bun): treat bun test arguments as path filters (#2165) (5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks @jakeleventhal!

fix(vitest): use default test entries when config has no test key (#2170) (7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks @fixfon!

Release 6.42.0

fix: add bun 1.4.3 check subcommand (#2131) (09129b8aaa554ffae2ff8f42a5ff4d6994eb7759) - thanks @NimmLor!

Detect pnpm workspaces correctly around packages: (resolve #2133, close #2134) (d1cc0928be54e6cac9668460d9f6a21e3a94f818)

fix(github-actions): resolve working-directory nested under checkout path (#2136) (87e051e45f12c107cc25ed08bba962b95bb23b51) - thanks @kenny-ish!

fix(nx): track local generator and executor entry points (#2117) (#2121) (558407f51b5fdf4460275b69950676e7bace35d5) - thanks @DreamLongYT!

Update dependency bun to v1.4.3 (#2137) (71f90bf6d5fb2675430f60416e403851f9cb2cfe) - thanks @renovate[bot]!

docs(react-router): note to run react-router typegen before Knip (#2140) (f21ce9a9f1e3264cad1b763cf31ec2c177fb8656) - thanks @MannXo!

fix: normalize scoped binary names (close #2143) (c8509c4e45e1c343da707c26877a0a6584f6bc11)

Clarify plugin implementation boundaries (c5a67f59d351e8d26dc6ecbbd3c3193e313772a4)

fix(jest): treat mocked and required dependencies as used (#2141) (3eaf1ba16045a3ac22f0717c4f1252312298bb76) - thanks @TkDodo!

fix: preserve root-only plugins for trailing-slash cwd (#2139) (7f0db0e7670bfd18fab081b522a104f787829f7d) - thanks @sean0407!

fix(nx): resolve run-commands script paths from the target cwd (#2151) (516bd9a324303653978528f582287c857846fcc8) - thanks @JeanBeaurepaire!

Resolve Nx run-commands loader paths from the target cwd (fa8ca13e1345115d30122900ab68db7339487502)

Add @solidjs/vite-plugin plugin (#2144) (579a88d306429694be43590efb50cb72067551ba) - thanks @everton-dgn!

feat: add filesystem-routing plugin (#2145) (1abd9e1875bae36b0baf77f5864aab849d1528a8) - thanks @everton-dgn!

Support tags in line comments (resolve #1924) (5abef4846e20f09fd4d0ee8dc2513ce50b616cdb)

Keep resolveFromAST to static values in plugin guide (4cd353fd9ecb780228a63069080586a46ba6a8f2)

fix(solidjs-vite-plugin): keep entry overrides in production (#2155) (e4b5f890787da07824cc174cb624396f2133ff06) - thanks @everton-dgn!

feat(angular): resolve styleUrl and styleUrls of @Component (#2157) (c20d4d720c586c9c5dc6e3d1a6ea60c557688bfa) - thanks @Cayan!

Update npmx.dev snapshot (59eb873f3beecf40b7aed9579bd29e1ab8b631f0)

fix(next): recognize Turbopack alias targets (#2156) (1d44f6a1a39c5557c1e215c7cf9db17937967344) - thanks @jakeleventhal!

fix: preserve re-exports from framework entries (#2154) (263ce20408a77b2473c555f304ad3b55c696b6a6) - thanks @jakeleventhal!

feat(solidjs-vite-plugin): follow Solid's SSR and client mode entry rules (#2148) (d711231eae14d8ecac562d73078125f3b30dc8fd) - thanks @everton-dgn!

feat(filesystem-routing): read route options from Vite configs (#2149) (585f206ca52d54e30f2068c818e1b33b50085459) - thanks @everton-dgn!

feat(filesystem-routing): resolve routes from the Vite root (#2150) (8cc0cb0c9ff09463cad30817c8cf78cbc48b7ed6) - thanks @everton-dgn!

fix: track namespace members in Promise.all imports (#2162) (3f17cdfce7a0f90e2599a7074291c4c875fe8244) - thanks @everton-dgn!

Update a few dependencies (161dbed3ccffa574e3a9493ddb20842eefa26af8)

Fix Solid setup fixture coverage (ebe4180785667f6ff85c1e6ce2a11226713b2d5a)

Migrate shell script parsing to unbash v6 (f86044c6760ac4f27e564f15feeae907cba3d297)

Add sponsors: @pennylane-hq, @agentscore, @oblique-security (thank you!) (57ff23eb430aaece73e02574923cabc6016a920b)

Stop pairing Promise.all imports and bindings after a spread (5bd2c64eaf92f82a316d8fa6551acdb1d6c48c32)

Update some stats (dd02ddeb235dd516cf93db99dda2180b0eb09a97)

fix(nx): read karmaConfig from target options (#2164) (4e1e4bc18f6d2f2705d729c375a20bd1679b8c0f) - thanks @Cayan!

Add tsrs plugin (#2163) (ba09126c023a2c408de8d7dae3bf6ab97e420966) - thanks @jakeleventhal!

Drop redundant containingFilePath from plugin config inputs (ffb6caf02891d29eee41c7a0ecf147312dbe7205)

Resolve Nx target option configs from the workspace root (52c5233aa905124c5b30c0bb7f9b0b25cd4260c6)

Commits

ee32ee6 Release knip@6.42.1
7ee576c fix(vitest): use default test entries when config has no test key (#2170)
5f3a7fb fix(bun): treat bun test arguments as path filters (#2165)
2c5c2a2 Match quoted SCSS url() values within a single line
fcff4db Add .otf to foreign file extensions
949da00 fix(tailwind): track packages referenced from CSS url() (#2166)
4c22593 fix(jest): load projects entries as Jest configs (#2167)
4c4a5ec fix(semantic-release): resolve shareable configs from extends (#2159)
8aa7d0e Release knip@6.42.0
52c5233 Resolve Nx target option configs from the workspace root
Additional commits viewable in compare view

…ry with 6 updates Bumps the npm-dev-dependencies group with 6 updates in the /cli directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.15` | `2.6.2` | | [@commitlint/cli](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/cli) | `21.2.3` | `21.2.4` | | [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) | `21.2.3` | `21.2.4` | | [@stryker-mutator/core](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/core) | `10.0.0` | `10.1.1` | | [jscpd](https://github.com/kucherenko/jscpd/tree/HEAD/rust/jscpd) | `5.4.1` | `5.4.2` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.41.0` | `6.42.1` | Updates `@biomejs/biome` from 2.5.15 to 2.6.2 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/@biomejs/biome@2.6.2/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.2/packages/@biomejs/biome) Updates `@commitlint/cli` from 21.2.3 to 21.2.4 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/cli/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.4/@commitlint/cli) Updates `@commitlint/config-conventional` from 21.2.3 to 21.2.4 - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v21.2.4/@commitlint/config-conventional) Updates `@stryker-mutator/core` from 10.0.0 to 10.1.1 - [Release notes](https://github.com/stryker-mutator/stryker-js/releases) - [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/core/CHANGELOG.md) - [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/core) Updates `jscpd` from 5.4.1 to 5.4.2 - [Release notes](https://github.com/kucherenko/jscpd/releases) - [Commits](https://github.com/kucherenko/jscpd/commits/v5.4.2/rust/jscpd) Updates `knip` from 6.41.0 to 6.42.1 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.42.1/packages/knip) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dev-dependencies - dependency-name: "@commitlint/cli" dependency-version: 21.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dev-dependencies - dependency-name: "@commitlint/config-conventional" dependency-version: 21.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dev-dependencies - dependency-name: "@stryker-mutator/core" dependency-version: 10.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dev-dependencies - dependency-name: jscpd dependency-version: 5.4.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dev-dependencies - dependency-name: knip dependency-version: 6.42.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot requested a review from a team as a code owner October 26, 2026 20:56

dependabot Bot added the dependencies Dependency update (dependabot) label Oct 26, 2026

aidd-bot Bot approved these changes Oct 26, 2026

View reviewed changes

aidd-bot Bot enabled auto-merge (squash) October 26, 2026 20:56

dependabot Bot changed the title ~~chore(deps-dev): bump the npm-dev-dependencies group in /cli with 6 updates~~ chore(deps-dev): bump the npm-dev-dependencies group across 1 directory with 6 updates Oct 26, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/cli/next/npm-dev-dependencies-2bb6409800 branch from 209fad9 to f200c19 Compare October 26, 2026 21:25

aidd-bot Bot approved these changes Oct 26, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps-dev): bump the npm-dev-dependencies group across 1 directory with 6 updates - #1108

chore(deps-dev): bump the npm-dev-dependencies group across 1 directory with 6 updates#1108
dependabot[bot] wants to merge 1 commit into
nextfrom
dependabot/npm_and_yarn/cli/next/npm-dev-dependencies-2bb6409800

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.6.2

2.6.2

Minor Changes

2.6.2

Patch Changes

2.6.1

Patch Changes

2.6.0

Minor Changes

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

21.2.4 (2026-10-18)

v21.2.4

21.2.4 (2026-10-18)

Bug Fixes

Performance Improvements

Docs, etc

21.2.4 (2026-10-18)

v10.1.1

10.1.1 (2026-10-23)

v10.1.0

10.1.0 (2026-10-23)

Bug Fixes

Features

10.1.1 (2026-10-23)

10.1.0 (2026-10-23)

Bug Fixes

Features

Release v5.4.2

New Features

Changes

Bug Fixes

Release 6.42.1

Release 6.42.0

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 26, 2026 •

edited

Loading