Bump the linting group across 1 directory with 4 updates by dependabot[bot] · Pull Request #326 · eviltester/grid-table-editor

dependabot · 2026-07-15T03:55:55Z

Bumps the linting group with 4 updates in the / directory: @biomejs/biome, fallow, oxfmt and oxlint.

Updates @biomejs/biome from 2.5.1 to 2.5.3

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.3

2.5.3

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

What's Changed

fix(useVueValidVOn): allow verb-modifier-only handlers and object syntax by @otkrickey in biomejs/biome#10773

fix(css_parser): recover CSS Modules syntax at EOF by @WaterWhisperer in biomejs/biome#10815

feat(fmt/yaml): sequence mapping by @ematipico in biomejs/biome#10814

fix(lint): handle TypeScript wrappers in unsafe optional chains by @Aqu1bp in biomejs/biome#10827

fix(lint): report computed member access in noProcessEnv by @JamBalaya56562 in biomejs/biome#10820

ci: ignore quick-xml RustSec advisories by @JamBalaya56562 in biomejs/biome#10831

perf(core): embedded ranges plumbing by @ematipico in biomejs/biome#10836

feat(md/fmt): more compatibility gains by @ematipico in biomejs/biome#10833

chore(xtask): migrate Error global type by @minseong0324 in biomejs/biome#10721

fix(lint): suppress false positives in noUnusedVariables for Svelte store subscriptions and $bindable() props by @Mokto in biomejs/biome#10534

refactor(md/parse): reduce emitted nodes by @ematipico in biomejs/biome#10847

feat(md/fmt): quotes, thematic breaks and link definition by @ematipico in biomejs/biome#10844

refactor(md/parse): parse HTML into one single node by @ematipico in biomejs/biome#10848

docs(noMissingVarFunction): list container-name in ignored properties by @dfedoryshchev in biomejs/biome#10852

refactor(md/parse): fold code content lines and indentation runs by @ematipico in biomejs/biome#10851

fix: astro shorthand syntax embedded nodes by @Netail in biomejs/biome#10853

chore(xtask): migrate disposable global types by @minseong0324 in biomejs/biome#10841

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.3

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

2.5.2

Patch Changes
#10595 f458028 Thanks @pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

#10798 4a32b63 Thanks @pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.
#10545 f3d4c00 Thanks @Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.
<script>
import { SvelteMap } from "svelte/reactivity";
const map = $state(new SvelteMap()); // redundant
</script>
#10752 f62fb8b Thanks @ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

#10796 f1b3ab2 Thanks @ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

#10719 aa649b5 Thanks @minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

... (truncated)

Commits

9e1999f chore: revert the revert
0b0fd8d chore: revert
0afa35a ci: release (#10817)
3447b2f feat(useDomQuerySelector): add ignore option (#10835)
e649198 ci: release (#10747)
4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
See full diff in compare view

Updates fallow from 2.103.0 to 2.104.0

Release notes

Sourced from fallow's releases.

v2.104.0: CSS-in-JS intelligence, styling health, token blast-radius

Highlights

This release is heavy on CSS intelligence. fallow health --css now understands CSS-in-JS (styled-components, emotion, linaria, vanilla-extract, StyleX, Panda) as first-class, ships a second styling-health quality axis, and adds a design-token blast-radius index. Plus a staged human review walkthrough, an opt-in unused-prop exemption, and a batch of framework false-positive fixes.

CSS intelligence (CSS program, Phases 3-4)

CSS-in-JS is first-class in fallow health --css. styled-components / emotion / linaria (tagged templates) and vanilla-extract / StyleX / Panda / emotion-object (object notation) previously produced null css_analytics. A lexical lifter now extracts the CSS body from both forms and feeds it through the same structural analytics and styling-health pipeline, so a CSS-in-JS app gets real duplicate-block, structural, and token-sprawl signals. Dep-gated on a declared CSS-in-JS library, so non-CSS-in-JS projects are byte-unchanged.

Styling-health: a second CSS-quality axis, confidence-aware. fallow health --css reports a separate styling_health score (0-100) and A-F grade with a Deductions: breakdown across five capped penalty categories. It carries a confidence marker (high / low) so a thin authored-CSS surface (utility-first Tailwind app) renders dimmed with a caveat instead of an authoritative grade. Descriptive-only: no exit code, badge, or CI gating.

Formula v3 weights value drift over exact repetition. Research is clear that exact CSS duplication is the least-harmful pattern while design-token inconsistency is the real maintenance harm, so the exact-block penalty is down-weighted to a soft hint and token-erosion gains a hardcoded-value-sprawl drift term (distinct un-tokenized box-shadow / border-radius / line-height values). STYLING_HEALTH_FORMULA_VERSION bumps to 3. If you diff styling_health.score/grade over time, re-baseline or gate on formula_version; the one-time step-change at this boundary is expected.

Design-token blast-radius (token_consumers) for Tailwind v4 AND CSS-in-JS tokens. fallow health --css --format json now carries a reverse index of where each design token is consumed. Change --color-brand (Tailwind @theme) or a StyleX defineVars / vanilla-extract createTheme token and see a consumer_count plus located consumers[] before touching it. consumer_count is a static lower bound (descriptive context, not a deletion gate); the authoritative dead-token finding stays unused_theme_tokens.

New get_token_blast_radius MCP tool. A focused, read-only tool that surfaces the token blast-radius directly without the agent needing to know the data hides inside css_analytics.

Fuzzy CSS clones via value canonicalization. fallow dupes now canonicalizes CSS values on the stylesheet path (a zero-with-unit collapses to bare 0, a hex color expands to its long lowercased form), so value-drifted clones (0px vs 0, #fff vs #ffffff) hash equal and the same shadow / gradient / transition recipe re-implemented with drift finally matches. Scoped to CSS-family files and SFC/Astro <style> regions; JS/TS clone detection is unchanged.

Review and configuration

fallow review --walkthrough: a staged terminal tour. Renders the review walkthrough guide as an ordered, human-readable tour (Review Focus header, staged sections, per-file one-line facts and grounded badges, a collapsed "cleared" panel). --format markdown emits a paste-into-PR artifact; --format json is byte-identical to --walkthrough-guide. Per-file viewed state persists locally (--mark-viewed) and tolerates a moved tree. Always exits 0.

unusedComponentProps.ignorePattern: exempt intentionally-unused props. Set "unusedComponentProps": { "ignorePattern": "^_" } to exempt props whose local destructure binding matches the regex (the leading-underscore convention that TS noUnusedParameters and ESLint varsIgnorePattern honor). Applies to Vue, Svelte, Astro, and React/Preact. Opt-in; default behavior is unchanged. Thanks @hniedner for the request. (Closes #1648)

CI, coverage, and architecture

The GitLab CI template can reuse a pre-installed fallow binary. Set FALLOW_SKIP_INSTALL: "true" to skip npm install -g fallow and run a fallow already on PATH (for example a version pinned through a pnpm catalog), so CI runs the same binary as your local lint gate. The job fails fast when no fallow is found. Thanks @Jerc92 for the patch in #1662.

Coverage upload enrichment. fallow coverage --with-callers uploads importer edges, and the inventory upload now emits per-function complexity and per-file churn.

Typed architecture boundaries. fallow-engine, fallow-output, and fallow-api now own the command-neutral analysis runners, output contracts, and programmatic Rust boundary; LSP, MCP, and NAPI callers consume typed results and serialize JSON only at protocol boundaries. The old fallow-programmatic-cli compatibility crate has been removed.

Bug fixes

Iterating a typed class array no longer false-flags the class members as unused. A cluster of unused-class-member false positives where the class is only used through an iteration loop variable is now fixed across array-method callbacks (.map / .forEach / .filter / ...), for...of, React/Preact JSX .map, Svelte {#each}, Vue v-for (including props.<field> sources), Angular @for / *ngFor inline templates, and Astro template .map. Over-credit only: a genuinely unused member still reports. Thanks @Ericlm for the report and minimal reproduction. (Closes #1707, #1711, #1712, #1713)

unused-files no longer false-flags a Next.js page.mdx when next.config wraps its config object. export default withMDX(nextConfig) (the official @next/mdx idiom), module.exports = createJestConfig(cfg), and nested/curried wrappers now resolve, which also fixes the same class for any wrapped Vite / Webpack / Jest config. Thanks @AlonMiz for the report. (Closes #1642)

unused-files no longer false-flags a commit-and-tag-version updater script. A new plugin (legacy enabler standard-version) credits each bumpFiles[] / packageFiles[] updater module and filename target, from both the package.json key and standalone .versionrc configs, gated on the file existing on disk. Thanks @rbalet for the report. (Closes #1640)

unused-class-members no longer false-flags framework-dispatched OpenLayers methods or a coercion-only toString. A handleEvent on an ol/interaction/* subclass and a toString used only through string coercion (template interpolation, String(...), +) are now credited, with tight gating so genuinely-dead members still report. (Closes #1638)

Telemetry findings_present is recorded again for fallow flags, fallow watch, and the security survivors / blind-spots subcommands. A debug-build invariant now fails fast if any finding-surfacing workflow records an event without noting its find-state, preventing the whole regression class. No change to the telemetry payload shape. (Closes #1650)

Full Changelog: fallow-rs/fallow@v2.103.0...v2.104.0

Changelog

Sourced from fallow's changelog.

[2.104.0] - 2026-07-01

Added

The GitLab CI template can reuse a pre-installed fallow binary. Set FALLOW_SKIP_INSTALL: "true" to skip npm install -g fallow and run the fallow already resolvable on PATH, for example a version pinned through a pnpm catalog and exposed on PATH, so CI runs the same binary as your local lint gate. The job fails fast with a clear error when no fallow is found. Default behavior is unchanged. Thanks @Jerc92 for the patch in #1662.

Design-token blast-radius for CSS-in-JS tokens (CSS program Phase 3d). The Phase 2 token blast-radius (css_analytics.token_consumers + the get_token_blast_radius MCP tool) covered only Tailwind v4 @theme tokens. It now also covers CSS-in-JS token DEFINITIONS, so changing a StyleX defineVars or vanilla-extract createTheme / createThemeContract / createGlobalTheme token shows its blast radius (a consumer_count plus located consumers[]) the same way an @theme token does. Because CSS-in-JS tokens are defined in JS objects and consumed via cross-module member access (import { vars } from './tokens'; vars.color.primary, including bracket access vars.color['gray-100']) or Panda token('colors.brand') calls, the consumer scan resolves relative imports, tsconfig path aliases, and workspace package imports to their defining files and matches the member-access or call chain against the defined leaf token paths, so an unrelated same-named binding is never counted. Entries reuse the existing token_consumers shape with consumers[].kind set to js-member for StyleX / vanilla-extract member access and js-call for Panda token(...) calls. Dep-gated on a declared CSS-in-JS library (@stylexjs/stylex, @vanilla-extract/css, or @pandacss/dev), descriptive-only (no actions, no exit-code effect), no new wire field, and no CACHE_VERSION bump; a non-CSS-in-JS project and a plain fallow health run (no --css) are byte-unchanged, and the Tailwind token_consumers output is untouched. consumer_count is still a static lower bound for dynamic import strings, unresolved aliases, generated package state, and computed token access, and unlike Tailwind there is no corroborating dead-token finding, so a CSS-in-JS consumer_count of 0 is a weaker signal.

Fuzzy CSS clones via CSS-aware value canonicalization (CSS program Phase 4). fallow dupes already tokenized CSS, but the lexer was character-naive, so near-miss / value-drifted CSS clones (the same shadow / gradient / transition recipe re-implemented with 0px vs 0 or #fff vs #ffffff drift, the shape of design-system erosion) never matched. The duplicate-detection tokenizer now canonicalizes CSS values on the stylesheet path: a zero-with-unit collapses to a bare 0 (0px/0em/0%) and a hex color expands to its long lowercased form (#fff -> #ffffff, #abcd -> #aabbccdd), so semantically-equal CSS hashes equal and the clone engine surfaces the fuzzy duplicates. Scoped to CSS-family files and SFC/Astro <style> regions only; JS/TS clone detection is unchanged. (PR #1669)

CSS-in-JS first-class in fallow health --css (CSS program Phase 3).

... (truncated)

Commits

e36026d chore: release v2.104.0
ea88340 fix(napi): align smoke test with consolidated engine root-validation message
bcc1f78 docs: link iteration-binding residual follow-up issues (#1716, #1717, #1718)
b8ef5a0 fix(extract): credit deferred iteration-binding sibling class members (#1715)
8ce42a1 docs: link iteration-binding follow-up issues (#1714)
91fb0ee fix(extract): credit iteration-binding class members (#1710)
db54051 fix(extract): credit Vue v-for loop variable class member accesses (#1709)
66697dd refactor(architecture): finish typed engine split
3352186 chore(license): drop redundant ed25519-dalek dev-dependency
16d7934 chore(deps): bump syn from 2.0.117 to 2.0.118 (#1695)
Additional commits viewable in compare view

Updates oxfmt from 0.56.0 to 0.58.0

Commits

39677ba release(apps): oxlint v1.73.0 && oxfmt v0.58.0 (#24219)
5306f24 release(apps): oxlint v1.72.0 && oxfmt v0.57.0 (#23935)
See full diff in compare view

Updates oxlint from 1.71.0 to 1.73.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)

2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)

bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)

5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)

7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)

2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)

ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)

6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)

7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)

732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)

a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)

ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)

3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)

ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)

e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)

6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)

85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)

fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)

ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)

dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)

989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)

cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

25d577e language_server: Start tools in parallel (#15500) (Sysix)

3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)

3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)

9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)

3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)

444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)

2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)

a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)

3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)

2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)

57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.73.0] - 2026-07-06

🚀 Features

a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#23612) (Mikhail Baev)

85735cb linter/unicorn: Implement no-confusing-array-with rule (#23638) (Shekhu☺️)

cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#23975) (Todor Andonov)

dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#24088) (camc314)

d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#24043) (Boshen)

0a75682 linter: Add per-rule timings for type-aware linting (#22488) (camchenry)

743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#23970) (Mikhail Baev)

🐛 Bug Fixes

bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#24122) (camc314)

45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#24024) (Boshen)

[1.72.0] - 2026-06-29

🚀 Features

1c8f50c linter: Add schema for eslint/no-restricted-import (#23642) (Sysix)

🐛 Bug Fixes

742be36 refactor/node/handle-callback-err: Reject invalid regex config (#23740) (camc314)

Commits

39677ba release(apps): oxlint v1.73.0 && oxfmt v0.58.0 (#24219)
a2c97f3 feat(linter/unicorn): implement explicit-timer-delay rule (#23612)
bdb51c7 fix(linter/jest/prefer-ending-with-an-expect): validate config patterns (#24122)
85735cb feat(linter/unicorn): implement no-confusing-array-with rule (#23638)
cb4fbb9 feat(linter/eslint): implement no-unreachable-loop rule (#23975)
dc32112 feat(linter/eslint/no-constant-binary-expression): check relational compariso...
d963967 feat(linter/unicorn/no-array-sort): add allowAfterSpread option (#24043)
45d607d fix(linter/react/forbid-component-props): make allow/disallow lists optional ...
0a75682 feat(linter): add per-rule timings for type-aware linting (#22488)
743e222 feat(linter/react): add disallowedValues option for forbid-dom-props rule...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the linting group with 4 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [fallow](https://github.com/fallow-rs/fallow), [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) and [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint). Updates `@biomejs/biome` from 2.5.1 to 2.5.3 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.3/packages/@biomejs/biome) Updates `fallow` from 2.103.0 to 2.104.0 - [Release notes](https://github.com/fallow-rs/fallow/releases) - [Changelog](https://github.com/fallow-rs/fallow/blob/main/CHANGELOG.md) - [Commits](fallow-rs/fallow@v2.103.0...v2.104.0) Updates `oxfmt` from 0.56.0 to 0.58.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.58.0/npm/oxfmt) Updates `oxlint` from 1.71.0 to 1.73.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.73.0/npm/oxlint) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: linting - dependency-name: fallow dependency-version: 2.104.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: linting - dependency-name: oxfmt dependency-version: 0.58.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: linting - dependency-name: oxlint dependency-version: 1.73.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: linting ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file npm npm ecosystem dependency updates labels Jul 15, 2026

dependabot Bot requested a review from eviltester as a code owner July 15, 2026 03:55

dependabot Bot added dependencies Pull requests that update a dependency file npm npm ecosystem dependency updates labels Jul 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the linting group across 1 directory with 4 updates#326

Bump the linting group across 1 directory with 4 updates#326
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/linting-16ddeb87ff

dependabot Bot commented on behalf of github Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 15, 2026

Biome CLI v2.5.3

2.5.3

Patch Changes

What's Changed

2.5.3

Patch Changes

2.5.2

Patch Changes

v2.104.0: CSS-in-JS intelligence, styling health, token blast-radius

Highlights

CSS intelligence (CSS program, Phases 3-4)

Review and configuration

CI, coverage, and architecture

Bug fixes

[2.104.0] - 2026-07-01

Added

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

🐛 Bug Fixes

⚡ Performance

📚 Documentation

Oxfmt v0.12.0

[1.73.0] - 2026-07-06

🚀 Features

🐛 Bug Fixes

[1.72.0] - 2026-06-29

🚀 Features

🐛 Bug Fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants