Skip to content

chore(deps): update all non-major dependencies - #1234

Merged
alecthomas merged 1 commit into
masterfrom
renovate/all-minor-patch
Mar 26, 2026
Merged

chore(deps): update all non-major dependencies#1234
alecthomas merged 1 commit into
masterfrom
renovate/all-minor-patch

Conversation

@renovate

@renovate renovate Bot commented Mar 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
biome patch 2.4.7 → 2.4.9
just minor 1.47.0 → 1.48.0
uv minor 0.10.10 → 0.11.1

Release Notes

biomejs/biome (biome)

v2.4.9: Biome CLI v2.4.9

2.4.9
Patch Changes

  • #​9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

    For example, the following snippet triggers the rule because the second selector and the first selector are the same:

    /* First selector */
.x .y .z {
}

/* Second selector */
.x {
  .y {
    .z {
    }
  }
}

  • #​9567 b7ab931 Thanks @​ematipico! - Fixed #​7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

    !foo || !foo.bar;

  • #​8670 607ebf9 Thanks @​tt-a1i! - Fixed #​8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

    class Kek {
  static kek(): number {
    return 0;
  }
  another(): string {
    return "";
  }
  kek(): number {
    return 1;
  } // no longer reported as non-adjacent
}

  • #​9476 97b80a8 Thanks @​masterkain! - Fixed #9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

  • #​9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

    For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.

  • #​9586 4cafb71 Thanks @​dyc3! - Fixed #​8828: Grit patterns using export { $foo } from $source now match named re-exports in JavaScript and TypeScript files.

  • #​9550 d4e3d6e Thanks @​dyc3! - Fixed #​9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.

  • #​8696 a7c19cc Thanks @​Faizanq! - Fixed #​8685 where noUselessLoneBlockStatements would remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.

  • #​9557 6671ac5 Thanks @​datalek! - Fixed #​9557: Biome's LSP server no longer crashes on startup when used with editors that don't send workspaceFolders during initialization. This affected any LSP client that only sends rootUri, which is valid per the LSP specification.

  • #​9455 1710cf1 Thanks @​omar-y-abdi! - Fixed #​9174: useExpect now correctly rejects asymmetric matchers in Vitest or Jest like expect.stringContaining(), expect.objectContaining(), and utilities like expect.extend() that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.

  • #​9584 956e367 Thanks @​ematipico! - Fixed a bug where Vue directive attribute values like v-bind:class="{'dynamic': true}" were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like :class, v-if, and v-html are now correctly parsed as expressions, preventing spurious parse errors.

  • #​9474 e168494 Thanks @​ematipico! - Added the new nursery rule noUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.

    The rule has the following options:

    • allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.
    • deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.
      When both deny and allow are provided, deny takes precedence.
    • requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.
    • requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.

  • #​9544 723798b Thanks @​ViniciusDev26! - Added an unsafe fix to useConsistentMethodSignatures that automatically converts between method-style and property-style signatures.

  • #​9555 8a3647b Thanks @​ematipico! - Fixed #188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.

  • #​9605 f65c637 Thanks @​ematipico! - Fixed #​9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:

    <style is:global define:vars={{ bgLight: light }}>
<Component name={{ first, name }} />

  • #​9565 ccb249e Thanks @​eyupcanakman! - Fixed #​9505: noUselessStringConcat no longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with + is not equivalent to a single template literal.

  • #​9534 4d050df Thanks @​Netail! - Added the nursery rule noInlineStyles. The rule disallows the use of inline style attributes in HTML and the style prop in JSX, including React.createElement calls. Inline styles make code harder to maintain and can interfere with Content Security Policy.

  • #​9611 cddaa44 Thanks @​gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent through workspace/didChangeConfiguration when the payload was wrapped in a top-level biome key. This caused requireConfiguration and related settings to be ignored in some editors.

What's Changed
New Contributors

Full Changelog: https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.8...@​biomejs/biome@2.4.9

v2.4.8: Biome CLI v2.4.8

2.4.8

Patch Changes

  • #​9488 bc709f6 Thanks @​mvanhorn! - Fixed #​9463: the "Biome found a configuration file outside of the current working directory" diagnostic now includes the configuration file path and the working directory, giving users actionable information to debug the issue.

  • #​9527 2f8bf80 Thanks @​mdm317! - Fixed #​8959: Fixed TypeScript arrow function formatting when a comment appears after =>.

  • #​9525 e7b3b10 Thanks @​ViniciusDev26! - Added the rule noDrizzleUpdateWithoutWhere to prevent accidental full-table updates when using Drizzle ORM without a .where() clause.

  • #​9531 1302740 Thanks @​ematipico! - Fixed #​9187: Astro frontmatter containing regex literals with quotes (/'/, /"/) or dashes (/---/) no longer causes parse errors.

  • #​9535 b630d93 Thanks @​leno23! - Fixed #​9524: remove extra space before > when bracketSameLine is true and the self-closing slash is absent in HTML formatter.

  • #​9537 81e6306 Thanks @​ematipico! - Fixed #​9238: The HTML parser no longer incorrectly reports --- inside element content (e.g. <td>---</td>) as an "Unexpected value or character" error.

  • #​9532 4b64145 Thanks @​ematipico! - Fixed #​9117: biome check --write no longer falsely reports Svelte and Vue files as changed when html.formatter.indentScriptAndStyle is enabled and the files are already correctly formatted.

  • #​9528 61451ef Thanks @​ematipico! - Fixed #​9341: Fixed an LSP crash that could corrupt file content when saving with format-on-save enabled.

  • #​9538 794f79c Thanks @​ematipico! - Fixed #​9279: The rule noSubstr now detects .substr() and .substring() calls in all expression contexts, including variable declarations, function arguments, return statements, and arrow function bodies.

  • #​9462 c23272c Thanks @​ematipico! - Fixed #​9370: The resolver now correctly prioritizes more specific exports patterns over less specific ones. Previously, a pattern like "./*" could match before "./features/*", causing resolution failures for packages with overlapping subpath patterns.

  • #​9515 f85c069 Thanks @​shivamtiwari3! - Fixed #​9506 and #​9479: Biome no longer reports false parse errors on <script type="speculationrules"> and <script type="application/ld+json"> tags. These script types contain non-JavaScript content and are now correctly skipped by the embedded language detector.

  • #​9514 7fe43c8 Thanks @​ematipico! - Fixed #​6964: Biome now correctly resolves the .gitignore file relative to vcs.root when configured. Previously, the vcs.root setting was ignored and Biome always looked for the ignore file in the workspace directory.

  • #​9521 af39936 Thanks @​ematipico! - Fixed #​9483. Now the rule noRedeclare doesn't panic when it encounters constructor overloads.

  • #​9490 60cf024 Thanks @​willfarrell! - Added support for modern CSS properties, pseudo-classes, and pseudo-elements.

    New known properties: dynamic-range-limit, overlay, reading-flow, reading-order, scroll-marker-group, scroll-target-group.

    New pseudo-elements: ::checkmark, ::column, ::picker, ::picker-icon, ::scroll-button, ::scroll-marker, ::scroll-marker-group.

    New pseudo-classes: :active-view-transition-type, :has-slotted, :target-after, :target-before, :target-current.

  • #​9526 4d42823 Thanks @​ematipico! - Fixed #​9358 and #​9375. Now attributes that have text expressions such as class={buttonClass()} are correctly tracked in Svelte files.

  • #​9520 61f53ee Thanks @​ematipico! - Fixed #​9519. Now noUnusedVariables doesn't flag variables that are used as typeof type.

  • #​9487 331dc0d Thanks @​mvanhorn! - Fixed #​9477: source.fixAll.biome no longer sorts imports when source.organizeImports.biome is disabled in editor settings. The organize imports action is now excluded from the fix-all pass unless explicitly requested.

  • #​9525 e7b3b10 Thanks @​ViniciusDev26! - Added the rule noDrizzleDeleteWithoutWhere to prevent accidental full-table deletes when using Drizzle ORM without a .where() clause.

What's Changed

New Contributors

Full Changelog: https://github.com/biomejs/biome/compare/@biomejs/biome@2.4.7...@​biomejs/biome@2.4.8

casey/just (just)

v1.48.0

Compare Source

Added
Changed
Misc

v1.47.1

Compare Source

Fixed
  • Block on running parallel dependencies (#​3139 by casey)
  • Fix setting-exported assignment visibility in child modules (#​3128 by casey)
Added
  • Add eager keyword to force evaluation of unused assignments (#​3131 by casey)
Changed
  • Only evaluate used variables in --evaluate and --command (#​3130 by casey)
Misc
astral-sh/uv (uv)

v0.11.1

Compare Source

Released on 2026-03-24.

Bug fixes
  • Add missing hash verification for riscv64gc-unknown-linux-musl (#​18686)
  • Fallback to direct download when direct URL streaming is unsupported (#​18688)
  • Revert treating 'Dynamic' values as case-insensitive (#​18692)
  • Remove torchdata from list of packages to source from the PyTorch index (#​18703)
  • Special-case == Python version request ranges (#​9697)
Documentation
  • Cover --python <dir> in "Using arbitrary Python environments" (#​6457)
  • Fix version annotations for PS_MODULE_PATH and UV_WORKING_DIR (#​18691)

v0.11.0

Compare Source

Released on 2026-03-23.

Breaking changes

This release includes changes to the networking stack used by uv. While we think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by uv so we have marked the change as breaking out of an abundance of caution.

The changes are largely driven by the upgrade of reqwest, which powers uv's HTTP clients, to v0.13 which included some breaking changes to TLS certificate verification.

The following changes are included:

  • rustls-platform-verifier is used instead of rustls-native-certs and webpki for certificate verification

    This change should have no effect unless you are using the native-tls option to enable reading system certificates.

    rustls-platform-verifier delegates to the system for certificate validation (e.g., Security.framework on macOS) instead of eagerly loading certificates from the system and verifying them via webpki. The effects of this change will vary based on the operating system. In general, uv's certificate validation should now be more consistent with browsers and other native applications. However, this is the most likely cause of breaking changes in this release. Some previously failing certificate chains may succeed, and some previously accepted certificate chains may fail. In either case, we expect the validation to be more correct and welcome reports of regressions.

    In particular, because more responsibility for validating the certificate is transferred to your system's security library, some features like CA constraints or revocation of certificates via OCSP and CRLs may now be used.

    This change should improve performance when using system certificate on macOS, as uv no longer needs to load all certificates from the keychain at startup.

  • aws-lc is used instead of ring for a cryptography backend

    There should not be breaking changes from this change. We expect this to expand support for certificate signature algorithms.

  • --native-tls is deprecated in favor of a new --system-certs flag

    The --native-tls flag is still usable and has identical behavior to --system-certs.

    This change was made to reduce confusion about the TLS implementation uv uses. uv always uses rustls not native-tls.

  • Building uv on x86-64 and i686 Windows requires NASM

    NASM is required by aws-lc. If not found on the system, a prebuilt blob provided by aws-lc-sys will be used.

    If you are not building uv from source, this change has no effect.

    See the CONTRIBUTING guide for details.

  • Empty SSL_CERT_FILE values are ignored (for consistency with SSL_CERT_DIR)

See #​18550 for details.

Python
  • Enable frame pointers for improved profiling on Linux x86-64 and aarch64

See the python-build-standalone release notes for details.

Enhancements
  • Treat 'Dynamic' values as case-insensitive (#​18669)
  • Use a dedicated error for invalid cache control headers (#​18657)
  • Enable checksum verification in the generated installer script (#​18625)
Preview features
  • Add --service-format and --service-url to uv audit (#​18571)
Performance
  • Avoid holding flat index lock across indexes (#​18659)
Bug fixes
  • Find the dynamic linker on the file system when sniffing binaries fails (#​18457)
  • Fix export of conflicting workspace members with dependencies (#​18666)
  • Respect installed settings in uv tool list --outdated (#​18586)
  • Treat paths originating as PEP 508 URLs which contain expanded variables as relative (#​18680)
  • Fix uv export for workspace member packages with conflicts (#​18635)
  • Continue to alternative authentication providers when the pyx store has no token (#​18425)
  • Use redacted URLs for log messages in cached client (#​18599)
Documentation
  • Add details on Linux versions to the platform policy (#​18574)
  • Clarify FLASH_ATTENTION_SKIP_CUDA_BUILD guidance for flash-attn installs (#​18473)
  • Split the dependency bots page into two separate pages (#​18597)
  • Split the alternative indexes page into separate pages (#​18607)

v0.10.12

Compare Source

Released on 2026-03-19.

Python
Enhancements
  • Include uv's target triple in version report (#​18520)
  • Allow comma separated values in --no-emit-package (#​18565)
Preview features
Bug fixes
  • Improve reporting of managed interpreter symlinks in uv python list (#​18459)
  • Preserve end-of-line comments on previous entries when removing dependencies (#​18557)
  • Treat abi3 wheel Python version as a lower bound (#​18536)
  • Detect hard-float support on aarch64 kernels running armv7 userspace (#​18530)
Documentation
  • Add Python 3.15 to supported versions (#​18552)
  • Adjust the PyPy note (#​18548)
  • Move Pyodide to Tier 2 in the Python support policy (#​18561)
  • Move Rust and Python version support out of the Platform support policy (#​18535)
  • Update Docker guide with changes from uv-docker-example (#​18558)
  • Update the Python version policy (#​18559)

v0.10.11

Compare Source

Released on 2026-03-16.

Enhancements
  • Fetch Ruff release metadata from an Astral mirror (#​18358)
  • Use PEP 639 license metadata for uv itself (#​16477)
Performance
  • Improve distribution id performance (#​18486)
Bug fixes
  • Allow --project to refer to a pyproject.toml directly and reduce to a warning on other files (#​18513)
  • Disable SYSTEM_VERSION_COMPAT when querying interpreters on macOS (#​18452)
  • Enforce available distributions for supported environments (#​18451)
  • Fix uv sync --active recreating active environments when UV_PYTHON_INSTALL_DIR is relative (#​18398)
Documentation
  • Add missing -o requirements.txt in uv pip compile example (#​12308)
  • Link to organization security policy (#​18449)
  • Link to the AI policy in the contributing guide (#​18448)

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 69277f6 to 066e5bc Compare March 25, 2026 04:28
@renovate
renovate Bot force-pushed the renovate/all-minor-patch branch from 066e5bc to e3de2e8 Compare March 26, 2026 05:23
@alecthomas
alecthomas merged commit f2db790 into master Mar 26, 2026
2 checks passed
@alecthomas
alecthomas deleted the renovate/all-minor-patch branch March 26, 2026 07:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alecthomas