chore(deps): update devdependencies (major)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@actions/cache (source)	^4.0.2 → ^6.0.0
@actions/core (source)	^1.11.1 → ^3.0.0
@actions/exec (source)	^1.1.1 → ^3.0.0
@actions/http-client (source)	2.2.3 → 4.0.1
@actions/io (source)	^1.1.3 → ^3.0.0
@actions/tool-cache (source)	^2.0.2 → ^4.0.0
@babel/core (source)	^7.26.9 → ^8.0.0
@babel/preset-typescript (source)	^7.27.1 → ^8.0.0
@biomejs/biome (source)	^1.9.4 → ^2.0.0
@octokit/openapi-types (source)	^25.0.0 → ^29.0.0
@octokit/plugin-paginate-rest	^13.0.0 → ^15.0.0
@octokit/plugin-rest-endpoint-methods	^16.0.0 → ^18.0.0
@octokit/types	^14.0.0 → ^18.0.0
@pnpm/patching.apply-patch (source)	^1000.0.7 → ^1100.0.0
@types/jest (source)	^29.5.14 → ^30.0.0
admina	^1.0.1 → ^2.0.0
cross-env	7.0.3 → 10.1.0
cspell (source)	^9.0.0 → ^10.0.0
eslint-config-atomic	^1.22.1 → ^2.0.0
jest (source)	^29.7.0 → ^30.0.0
npm-check-updates	^19.3.1 → ^23.0.0
npm-run-all2	^8.0.4 → ^9.0.0
p-timeout	^6.1.4 → ^7.0.0
typescript (source)	^5.8.2 → ^7.0.0
vite (source)	^7.3.1 → ^8.0.0

---

Release Notes

actions/toolkit (@​actions/cache)

v6.2.0

• Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
• Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

• Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

• Bump dependency versions (#​2393):
  • @actions/core to ^3.0.1
  • @actions/http-client to ^4.0.1
  • @actions/io to ^3.0.2
  • @azure/core-rest-pipeline to ^1.23.0
  • @azure/storage-blob to ^12.31.0
  • semver to ^7.7.4

v6.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v5.0.5

• Bump @actions/glob to 0.5.1

v5.0.4

• Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

• Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
• Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2 → whatwg-url@5 → tr46@0.0.3 that used the deprecated punycode module

v5.0.0

• Remove @azure/ms-rest-js dependency #​2197
  • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
• Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
• Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
• Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
• Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
• Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
• Add support for Node.js 24 #​2110
• Add node-fetch override to resolve audit vulnerabilities #​2110

actions/toolkit (@​actions/core)

v3.0.1

• Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

• Bump @actions/http-client to 3.0.2

v2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #​2199

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

actions/toolkit (@​actions/exec)

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/io dependency from ^1.0.1 to ^2.0.0

actions/toolkit (@​actions/http-client)

v4.0.1

• Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

• Bump undici from 5.28.5 to 6.23.0

v3.0.1

• Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

• Add support for Node 24 #​2110

actions/toolkit (@​actions/io)

v3.0.2

• Fix: update lock file version

v3.0.1

• Fix: export @actions/io/lib/io-util

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Ensures consistent behavior for paths on Node 24 with Windows

actions/toolkit (@​actions/tool-cache)

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

3.0.1

• Bump @actions/http-client to 3.0.2

3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

2.0.2

• Update @actions/core to v1.11.1 #​1872
• Remove dependency on uuid package #​1824, #​1842

2.0.1

• Update to v2.0.1 of @actions/http-client #​1087

2.0.0

• Update to v2.0.0 of @actions/http-client
• The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
  This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.

1.7.2

• Update lockfileVersion to v2 in package-lock.json #​1025

1.7.1

• Fallback to os-releases file to get linux version
• Update to latest @​actions/io verison

1.7.0

• Allow arbirtary headers when downloading tools to the tc
• Export isExplicitVersion and evaluateVersions functions
• Force overwrite on default when extracted compressed files

1.6.1

• Update @​actions/core version

1.6.0

• Add extractXar function to extract XAR files

1.3.5

• Check if tool path exists before executing
• Make extract functions quiet by default

1.3.4

• Update the http-client to 1.0.8 which had a security fix

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3

• Update downloadTool to only retry 500s and 408 and 429

1.3.2

• Update downloadTool with better error handling and retries

1.3.1

• Increase http-client min version

1.3.0

• Uses @​actions/http-client

1.2.0

• Overload downloadTool to accept destination path
• Fix extractTar on Windows
• Add "types" to package.json

1.1.2

• Use zip and unzip from PATH
• Support custom flags for extractTar

1.0.0

• Initial release

v3.0.1

• Bump @actions/http-client to 3.0.2

v3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

babel/babel (@​babel/core)

v8.0.5

👓 Spec Compliance

• babel-parser
  • #​18218 fix(parser): do not form html entity for invalid codepoint (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​18215 fix(parser): remove non-decimal prefix from bigint (@​JLHwung)
  • #​18063 Disallow new import prop access (@​JLHwung)
• babel-plugin-transform-destructuring
  • #​18214 fix: only collapse the empty-object check when it targets the declared binding (@​Kjubikstronk)
• babel-plugin-transform-typescript
  • #​18190 fix(ts): improve variable handling in namespace (@​JLHwung)
  • #​18207 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-node
  • #​18217 Fix import path for babel-node.js (@​drubetti)
• babel-plugin-bugfix-safari-rest-destructuring-rhs-array
  • #​18213 fix(bugfix): bound check before array access (@​JLHwung)
• babel-traverse
  • #​18183 fix(remove): unwrap single sequence expression (@​JLHwung)
  • #​18153 Handle null in getAll{Prev,Next}Siblings (@​JLHwung)
• babel-plugin-transform-block-scoping
  • #​18194 fix: improve for loop closure environment check (@​JLHwung)
  • #​18193 fix: assign closure body after handling return (@​JLHwung)
  • #​18088 Fix initialization of nested for loop head declarations (@​journey-ad)
• babel-generator
  • #​18202 fix(generator): keep parens for ?. chain in tag (@​JLHwung)
• babel-register
  • #​18137 fix(babel-register): preserve app-managed graceful shutdown (@​jibin7jose)
• Other
  • #​18140 chore: fix @​babel/eslint-plugin peer deps (@​JLHwung)
• babel-cli, babel-helper-transform-fixture-test-runner, babel-register
  • #​18131 fix(register): do not inherit parent execArgv (@​JLHwung)
• babel-standalone
  • #​18095 Add types for @babel/standalone (@​liuxingbaoyu)

📝 Documentation

• #​18187 Add AI policy (@​nicolo-ribaudo)

🏠 Internal

• babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • #​18145 refactor: replace semver with verkit (@​sxzz)
• babel-node
  • #​18177 Update node flags list (@​nicolo-ribaudo)
• babel-types
  • #​18103 Simplify AST validators (@​fisker)

🏃‍♀️ Performance

• babel-parser
  • #​18176 perf: Improve @babel/parser (@​liuxingbaoyu)

v8.0.1

Compare Source

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #​18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0

Compare Source

👓 Spec Compliance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #​18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #​18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #​18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #​18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #​18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #​18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

biomejs/biome (@​biomejs/biome)

v2.5.13

Compare Source

Patch Changes

• #​11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  
  .my-style {
    color: red;
  }
  
  /* Valid */
  @import 'foo.css' layer(base);
  
  @layer base {
    .my-style {
      color: red;
    }
  }

• #​11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #​11620 20e513a Thanks @​jakeleventhal! - Fixed #​11610, #​11611, #​11612, #​11615, and #​11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #​11657 e322040 Thanks @​ematipico! - Fixed #​7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #​11627 23aad6d Thanks @​ematipico! - Fixed #​6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #​11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #​11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

• #​11676 840a52a Thanks @​dyc3! - Fixed #​11672 and #​11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.

• #​11660 49485ed Thanks @​ematipico! - Fixed #​11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.

• #​11664 9a73b9c Thanks @​dyc3! - Improved the performance of useRegexpExec.

• #​11661 5341b3f Thanks @​ematipico! - Fixed #​7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

• #​11630 62e1fc5 Thanks @​dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

   <span>
  -  {head.median - base.median >= 0 ? "+" : "−"}
  -  {formatMs(Math.abs(head.median - base.median))}
  +  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
   </span>

• #​11658 ed4bfa4 Thanks @​fredrikblau! - Fixed #​11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.

  <h1 set:html={heading} />
  <h2 set:text={heading}></h2>

  <template>
    <h1 v-html="heading"></h1>
    <h2 v-text="heading"></h2>
  </template>

• #​11613 47d7383 Thanks @​ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.

• #​11618 21a10cf Thanks @​siketyan! - Fixed #​11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:

  interface Context {
    doSomething(): Promise<void>;
  }
  
  declare function test(callback: (ctx: Context) => Promise<void>): void;
  
  test(async (ctx) => {
  	ctx.doSomething(); // now reported as a floating promise
  });

• #​11698 b019982 Thanks @​denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.

  -background-image: url(image\);
  +background-image: url(image\ );

• #​11622 c23e4c7 Thanks @​Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.

  <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />

• #​11606 de0528f Thanks @​dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.

• #​11687 09d97d9 Thanks @​hori-design! - Fixed #​11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.

• #​11595 a64d757 Thanks @​dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.

• #​11675 353cbae Thanks @​dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.

• #​11625 ea20e5a Thanks @​denbezrukov! - Improved linting performance for large CSS and JSON files.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.

• #​11669 579f401 Thanks @​denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

v2.5.12

Compare Source

Patch Changes

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #​11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #​11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #​11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #​11585 c5c8315 Thanks @​Netail! - Fixed #​11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

• #​11368 52a57b3 Thanks @​Austin1serb! - Fixed #​6830: Biome now reports a diagnostic for excessively deep syntax instead of overflowing the native stack while releasing the parsed tree.

• #​11596 1fc42ed Thanks @​dyc3! - Added the nursery rule noThisOutsideOfClass. The rule reports this outside class members and TypeScript functions with an explicit this parameter.

  function Person(name) {
      this.name = name;
  }

• #​11555 2516335 Thanks @​dyc3! - Fixed #​11529, where noFloatingPromises missed unhandled Promise chains when the imported function's module belonged to an import cycle. Cyclic modules now preserve types for exports that do not participate in recursive type dependencies.

• #​11518 0fee70c Thanks @​HarperZ9! - Fixed #​11500: the formatter now prints the declare modifier before accessibility modifiers on class properties. private declare readonly name: string is now formatted as declare private readonly name: string, matching Prettier and TypeScript's canonical modifier order.

• #​11580 1277af2 Thanks @​ematipico! - Fixed #​5091: Biome no longer moves comments next to the < of a generic, which causes invalid TypeScript syntax:

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every weekend"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.