chore: bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the development-dependencies group with 3 updates in the / directory: @biomejs/biome, ava and ultracite.

Updates @biomejs/biome from 2.5.7 to 2.5.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.8

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Commits

• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• See full diff in compare view

Updates ava from 7.0.0 to 8.0.1

Release notes

Sourced from ava's releases.

v8.0.1

What's Changed

This release officially adds Node.js 26 support, with thanks to @​novemberborn in avajs/ava#3450.

Per our policy, support for Node.js 25 has been removed.

Full Changelog: avajs/ava@v8.0.0...v8.0.1

v8.0.0

Breaking Changes

AVA now expects Node.js 22.20, 24.12 or newer.

Internally AVA is now fully ESM. This is possible now that Node.js supports loading ES modules using require() calls and simplifies AVA's types and internals.

If you use AVA from a CommonJS project you'll have to update your imports:

-const test = require('ava');
+const {default: test} = require('ava');

We expect an increasing number of projects to be ESM only. As per the above, CommonJS is still supported, but we don't expect cjs extensions to be used. The default file extensions are now js and mjs. Specify extensions: ['cjs', 'js', 'mjs'] for AVA to run test files with the cjs extension.

All test files (and those loaded through AVA's require config) are now loaded via import(). Use customization hooks for transpilation. The object form of the extensions configuration is no longer supported.

If you use AVA with @​ava/typescript you must upgrade that package to v7.

New Features

There's two new test modifiers courtesy of @​sindresorhus: test.skipIf() to skip a test based on a runtime condition. test.runIf() is the inverse: the test only runs when the condition is true.

test.skipIf(process.platform === 'win32')('not on Windows', t => {
	t.pass();
});
test.runIf(process.platform === 'linux')('Linux only', t => {
t.pass();
});

These work with other modifiers like .serial and .failing:

test.serial.skipIf(process.platform === 'win32')('serial, not on Windows', t => {
	t.pass();
});
</tr></table>

... (truncated)

Commits

• bbfd946 v8.0.1
• 332fcd7 Pre-release updates (#3451)
• fcaaf43 Add Node.js 26 support; drop 25 (#3450)
• a913804 Test using AVA 8 (#3440)
• fe31286 v8.0.0
• 7bdbabb Improve error when throwsAsync/notThrowsAsync is not awaited (#3436)
• a304990 Full ESM internals; bias away from CJS; require @​ava/typescript@​7
• d012c64 Update release process documentation (#3435)
• 2cea71e CI tweaks (#3438)
• 27e9c84 Remove Node.js 20 support; update dependencies prior to release (#3432)
• Additional commits viewable in compare view

Updates ultracite from 7.10.2 to 7.10.5

Release notes

Sourced from ultracite's releases.

ultracite@7.10.5

Patch Changes

• 8df6ad0: Offer the vendored anti-slop Oxlint preset during ultracite init — it now appears in the JS-plugins prompt when you pick Oxlint, and non-interactive setup accepts it via --js-plugins anti-slop. Selecting it adds ultracite/oxlint/anti-slop to the generated config's extends; since the preset is vendored inside Ultracite, nothing extra is installed.
• cd229e9: Bump the oxlint-plugin-react-doctor pin from ^0.7.1 to ^0.9.12, so ultracite init installs the current plugin. All react-doctor rules enabled by the js-plugins presets still exist in 0.9.12, and the ported rules run in curated mode via the settings shipped alongside this release (#771).
• e1ac886: Pin React Doctor's ported rules to their framework-aware "curated" mode (#771). react-doctor 0.9.x rewrote its ported oxc/react-refresh rules — notably only-export-components — with a stripped-down default mode: no framework detection, no route-file skipping, and allowConstantExport off, so Next.js route-segment exports like export const dynamic = "force-static" or metadata were flagged as non-component exports in every route file. The ESLint react preset now sets settings["react-doctor"].portedRuleMode: "curated", and generated oxlint configs apply a new jsPluginSettings export from ultracite/oxlint/js-plugins on the root config (oxlint does not merge settings from extended configs, so the setting cannot ride along inside the preset). If you extend the js-plugins preset manually, add settings: jsPluginSettings to your root oxlint config.
• c27fe36: Generate oxlint configs that enable a subset of the JS plugins via a new selectJsPlugins export from ultracite/oxlint/js-plugins, instead of inlining the filtering logic into the generated file. The inlined block contained a typeof check that user-side lint presets flagged (anti-slop/no-runtime-typeof, #770); the generated config is now a one-line extend, is emitted already formatted (including the previously missing blank line after imports), and re-running ultracite init migrates existing configs with the old inlined block automatically.
• 0616523: Update the vendored anti-slop Oxlint plugin to upstream commit 446268e, picking up fixes to no-object-parameters and no-unknown-returns (respect lexical type binders in alias resolution) and a new allowInTypeGuards option on no-runtime-typeof. The ultracite/oxlint/anti-slop preset enables allowInTypeGuards, so typeof checks inside type predicate functions ((x): x is Tdmmulroy/anti-slop#10

ultracite@7.10.4

Patch Changes

• 417a85a: Add an opt-in ultracite/oxlint/anti-slop preset that ships a vendored, self-contained build of the anti-slop Oxlint plugin — fifteen rules that reject low-evidence TypeScript and JavaScript patterns (unjustified type assertions, unknown leaking through signatures, Reflect-based access, module mocking, and more). Extend it alongside ultracite/oxlint/core; nothing extra to install. The preset also turns off two core rules that conflict with anti-slop's widening checks (typescript/consistent-indexed-object-style and unicorn/no-immediate-mutation) when extended after core.
• 4d3fab8: Move suspicious/useArraySortCompare from the Biome core config to the opt-in type-aware config. The rule is in Biome's types domain — it type-infers the receiver of every method call before checking the method name, which made ultracite check up to ~260x slower on projects with expensive library types (zod, better-auth, Prisma). It now only runs when type-aware linting is explicitly enabled, alongside the other type/project-domain rules. Fixes #768.

ultracite@7.10.3

Patch Changes

• a1fa9c4: Replace the hand-rolled package exports map matching in the config-resolution doctor check with the resolve.exports library, which implements Node's full PACKAGE_TARGET_RESOLVE algorithm (wildcard patterns, key-order precedence, conditional exports, and array fallbacks). The manual node_modules walk is kept intentionally — it exists to avoid Bun's auto-install cache resolving specifiers the project's own node_modules can't.
• 414ea80: Replace the hand-rolled monorepo workspace scan in framework detection with the find-workspaces library. Workspace declarations from package.json (array and yarn-classic object form) and pnpm-workspace.yaml — including negated globs — are now resolved by the library instead of manual pattern collection and globbing, and lerna/bolt monorepos are picked up as well.
• a9a1989: Replace the hand-rolled upward directory walks in findNearestFile and detectLinter with the empathic library's find.any, which checks candidate names in order within each directory before moving to the parent — the same per-directory precedence the previous implementation enforced manually.
• 27b2707: Use magicast to update ESM lint-staged config files during ultracite init. The config is now edited as an AST instead of being imported and re-serialized, so comments and function-valued entries elsewhere in the config survive the update, and the user's config code is no longer executed. If the Ultracite glob pattern is already owned by a non-array value, or the config isn't a mergeable object literal (e.g. defineConfig(...)), init warns and leaves the file untouched instead of rewriting it. CommonJS configs keep the previous behavior.
• f2529b8: Rewrite the agent-fix progress renderer on top of log-update, cli-truncate, and string-width. log-update now owns the in-place block rewriting that was previously done with manual cursor-up/clear-line escape sequences, and line truncation is measured by display width instead of code units — so lint messages containing emoji or CJK text can no longer overflow the terminal row and corrupt the animated block.
• 277b9d6: Replace the hand-rolled child-process handling in the agent fix runner with execa. The timeout → SIGTERM → grace period → SIGKILL escalation, stderr capture, and spawn-failure handling now use execa's timeout and forceKillAfterDelay options, which are battle-tested across platforms (including Windows kill semantics the manual implementation didn't cover). Behavior is unchanged: agent runs still time out after 5 minutes, escalate to SIGKILL after a 10-second grace period, and report a capped stderr tail.
• 1614a80: Drop the direct cross-spawn dependency: all synchronous process spawning (linter runs, tool version checks, editor extension installs, skill installs) now goes through a small adapter over execa's sync API, which owns the Windows spawn semantics cross-spawn provided. The adapter preserves the spawnSync result shape (status/signal/error/stdout), always disables shell interpretation, and always decodes output as UTF-8. execa was already a dependency for the agent fix runner, so this consolidates on one process-spawning library.
• ac114b4: Replace the glob dependency with fast-glob for the tsconfig.json scan during init. fast-glob was already in the dependency tree via find-workspaces, so this drops glob's transitive dependencies (minipass, path-scurry, etc.) from the install without changing behavior.

Commits

• 326ba63 Version Packages (#772)
• ee1ffdd Enable allowInTypeGuards on no-runtime-typeof in the anti-slop preset
• 0616523 Update vendored anti-slop plugin to 446268e
• 8df6ad0 Offer the anti-slop preset in ultracite init
• cd229e9 Bump oxlint-plugin-react-doctor to ^0.9.12
• e1ac886 Pin react-doctor ported rules to curated mode to fix only-export-components f...
• c27fe36 Move generated js-plugins filtering into a selectJsPlugins export
• e8464fd Version Packages (#769)
• e2c5e76 Disable conflicting core rules by default in the anti-slop preset
• 6f2b661 Add antislop, run linter
• Additional commits viewable in compare view

[mstuart]

@dependabot rebase