build(deps): bump the npm group with 5 updates by dependabot[bot] · Pull Request #90 · viktar-b/CalculationSourceObject

dependabot · 2026-10-05T09:47:20Z

Bumps the npm group with 5 updates:

Package	From	To
@biomejs/biome	`2.5.14`	`2.5.15`
@types/node	`26.6.2`	`26.6.4`
vitest	`5.0.2`	`5.0.3`
next	`16.3.6`	`16.3.8`
vite	`8.3.1`	`8.3.2`

Updates @biomejs/biome from 2.5.14 to 2.5.15

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes
#10634 b436ba0 Thanks @subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

For example, the following snippet triggers the rule.
function Component({ items = [] }) {
  return items;
}
#11956 faa8b37 Thanks @dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.
<script>
  export let name;
</script>
#10816 1b9479e Thanks @Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034
{
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}
#11960 1fdb5c2 Thanks @dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.
import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.15

Patch Changes
#10634 b436ba0 Thanks @subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

For example, the following snippet triggers the rule.
function Component({ items = [] }) {
  return items;
}
#11956 faa8b37 Thanks @dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.
<script>
  export let name;
</script>
#10816 1b9479e Thanks @Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034
{
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}
#11960 1fdb5c2 Thanks @dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.
import { page } from "$app/stores";
#11723 3b429d1 Thanks @m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

0b4c11f ci: release (#11815)
ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
034366d chore: update codspeed logo in readme (#12019)
717db8c feat(lint): add noMisplacedListElements (#11917)
089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
b2b4400 chore: update sponsors (#11973)
ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
1b9479e feat(lint): add useLogicalProperties rule (#10816)
Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.4

Commits

See full diff in compare view

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

View changes on GitHub

Commits

33cadea chore: release v5.0.3 (#11409)
346d389 fix(vm): don't reuse scripts across vite environments (#11395)
f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
062c75d chore: fix standalone docs build, update exports maps (#11394)
caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
7c36748 fix(browser): ignore page crash while cancelling (#11386)
92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
38f9885 fix(cache): revalidate imports of cached modules (#11381)
b24585f fix: don't retry when test.fails expectedly failed (#11219)
Additional commits viewable in compare view

Updates next from 16.3.6 to 16.3.8

Release notes

Sourced from next's releases.

v16.3.8

This release contains security fixes for the following advisories:

High:

Server-Side Request Forgery in Image Optimization

Medium:

Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service

Pending use cache fill can leak Draft Mode content into regular responses and persisted pages

Cache leak across root param values in nested 'use cache' functions

Low:

Information disclosure in the Next.js development server's Model Context Protocol endpoint

v16.3.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

turbo-tasks-backend: fix strongly consistent read hanging on a canceled task (#98931)

Credits

Huge thanks to @lukesandberg for helping!

Commits

b0fad0d v16.3.8
719e4c6 [lts-active] Scope response cache keys to their source route (#218)
e92db45 [lts-active] Fix metadata propagation for deduplicated nested caches (#223)
40c2ba9 [lts-active] Match Next data paths case-sensitively (#196)
2d9f50a [lts-active] Fix MCP middleware DNS rebinding (#213)
bd9214f [lts-active] Fix draft mode leaks through cross-request 'use cache' dedupli...
8db4a62 [lts-active][webpack] Ensure dynamicParams is respected in `opengraph-image...
e002ad6 [lts-active] fix(next/image): Pin DNS resolution when fetching external image...
4c20699 v16.3.7
2521aec [backport] turbo-tasks-backend: fix strongly consistent read hanging on a can...
See full diff in compare view

Updates vite from 8.3.1 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)

optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)

optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)

pass queries to renderBuiltUrl (#23586) (744269e)

server: handle file watcher errors without crashing (#23503) (6894f5c)

server: release previous environments after initialization (#23499) (5a3a010)

ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)

worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)

build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)

only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)

optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)

optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)

pass queries to renderBuiltUrl (#23586) (744269e)

server: handle file watcher errors without crashing (#23503) (6894f5c)

server: release previous environments after initialization (#23499) (5a3a010)

ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)

worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

avoid encoding intermediate source maps (#23461) (89574f6)

build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)

only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Commits

1003321 release: v8.3.2 (#23623)
24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
94d0080 perf: only register time middleware when debug logging is enabled (#23621)
89574f6 perf: avoid encoding intermediate source maps (#23461)
5a3a010 fix(server): release previous environments after initialization (#23499)
1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
6894f5c fix(server): handle file watcher errors without crashing (#23503)
cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 5 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.5.15` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.2` | `5.0.3` | | [next](https://github.com/vercel/next.js) | `16.3.6` | `16.3.8` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.1` | `8.3.2` | Updates `@biomejs/biome` from 2.5.14 to 2.5.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome) Updates `@types/node` from 26.6.2 to 26.6.4 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `vitest` from 5.0.2 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/vitest) Updates `next` from 16.3.6 to 16.3.8 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.3.6...v16.3.8) Updates `vite` from 8.3.1 to 8.3.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.2/packages/vite) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@types/node" dependency-version: 26.6.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 5.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: next dependency-version: 16.3.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: vite dependency-version: 8.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-05T09:47:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
calculation-source-object	Ready	Preview	Oct 5, 2026 9:47am UTC

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 5, 2026

vercel Bot deployed to Preview October 5, 2026 09:47 View deployment

Navigation Menu

build(deps): bump the npm group with 5 updates - #90

build(deps): bump the npm group with 5 updates#90
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-83a2f51378

dependabot Bot commented on behalf of github Oct 5, 2026

Uh oh!

vercel Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 5, 2026

Biome CLI v2.5.15

2.5.15

Patch Changes

2.5.15

Patch Changes

v5.0.3

🐞 Bug Fixes

View changes on GitHub

v16.3.8

v16.3.7

Core Changes

Credits

v8.3.2

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

8.3.2 (2026-10-01)

Bug Fixes

Performance Improvements

Documentation

Miscellaneous Chores

Code Refactoring

Tests

Uh oh!

vercel Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Oct 5, 2026 •

edited

Loading