Skip to content

deps: bump the npm-minor-patch group across 1 directory with 7 updates#23

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1e39d0730f
Closed

deps: bump the npm-minor-patch group across 1 directory with 7 updates#23
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1e39d0730f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm-minor-patch group with 7 updates in the / directory:

Package From To
@biomejs/biome 2.4.12 2.4.16
ipaddr.js 2.3.0 2.4.0
@vitest/coverage-v8 4.1.5 4.1.8
tsx 4.21.0 4.22.4
vitest 4.1.5 4.1.8
yaml 2.8.3 2.9.0
fastmcp 4.0.1 4.0.2

Updates @biomejs/biome from 2.4.12 to 2.4.16

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes

  • #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

  • #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

    Input:

    <span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

    Output:

      <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

  • #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

  • #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

  • #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

  • #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

  • #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

  • #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

  • #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

  • #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.16

Patch Changes

  • #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

  • #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

    Input:

    <span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

    Output:

      <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

  • #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

  • #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

  • #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

  • #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

  • #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

  • #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

  • #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

  • #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

    

    • 






... (truncated)





Commits






Updates ipaddr.js from 2.3.0 to 2.4.0



Changelog

Sourced from ipaddr.js's changelog.




2.4.0 - 2026-05-03


    

  • remove Bower support
    • 

  • add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges
    • 








Commits

    

  • 61bd6df Bump version.
    • 

  • f563e5c Add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges.
    • 

  • 9992db9 Rename 2001:10::/28 from deprecated to deprecatedOrchid.
    • 

  • 5686480 Indicate which RFCs reserved some IPv6 ranges.
    • 

  • 9199d3f Remove bower.json
    • 

  • 1915d22 spelling: string
    • 

  • 85eb23c spelling: javascript
    • 

  • 4222342 spelling: ip v6
    • 

  • 1c76a35 spelling: hexadecimal
    • 

  • 82e4b6d spelling: addresses
    • 

  • Additional commits viewable in compare view
    • 







Updates @vitest/coverage-v8 from 4.1.5 to 4.1.8



Release notes

Sourced from @​vitest/coverage-v8's releases.




v4.1.8


   🐞 Bug Fixes



    View changes on GitHub


v4.1.7


   🐞 Bug Fixes



    View changes on GitHub


v4.1.6


   🐞 Bug Fixes



   🏎 Performance



    View changes on GitHub







Commits

    

  • e61f2dd chore: release v4.1.8
    • 

  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
    • 

  • a09d472 chore: release v4.1.7
    • 

  • a8fd24c chore: release v4.1.6
    • 

  • See full diff in compare view
    • 







Updates tsx from 4.21.0 to 4.22.4



Release notes

Sourced from tsx's releases.




v4.22.4


4.22.4 (2026-05-31)


Bug Fixes


    

  • resolve CommonJS directory requires inside dependencies (#803) (1ce8463)
    • 





This release is also available on:



v4.22.3


4.22.3 (2026-05-19)


Bug Fixes


    

  • decode typed loader source (dce02fc)
    • 

  • preserve entrypoint with TypeScript preload hooks (68f72f3)
    • 





This release is also available on:



v4.22.2


4.22.2 (2026-05-18)


Bug Fixes


    

  • preserve CJS JSON require in ESM hooks (35b700b)
    • 

  • preserve named exports from CommonJS TypeScript (11de737)
    • 

  • support module.exports require(esm) interop (cf8f199)
    • 





This release is also available on:



v4.22.1


4.22.1 (2026-05-17)


Bug Fixes


    

  • resolve tsconfig path aliases containing a colon (#780) (6979f28)
    • 





This release is also available on:






... (truncated)





Commits

    

  • 1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
    • 

  • dce02fc fix: decode typed loader source
    • 

  • 68f72f3 fix: preserve entrypoint with TypeScript preload hooks
    • 

  • 69455cf test: cover package exports for ambiguous ESM reexports
    • 

  • 35b700b fix: preserve CJS JSON require in ESM hooks
    • 

  • ef807db chore: update testing dependencies
    • 

  • 3917090 test: document compatibility test taxonomy
    • 

  • de8113f refactor: centralize Node capability facts
    • 

  • c1f62db test: consolidate tsconfig path edge coverage
    • 

  • 4e08174 test: consolidate loader hook coverage
    • 

  • Additional commits viewable in compare view
    • 






Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tsx since your current version.






Updates vitest from 4.1.5 to 4.1.8



Release notes

Sourced from vitest's releases.




v4.1.8


   🐞 Bug Fixes



    View changes on GitHub


v4.1.7


   🐞 Bug Fixes



    View changes on GitHub


v4.1.6


   🐞 Bug Fixes



   🏎 Performance



    View changes on GitHub







Commits

    

  • e61f2dd chore: release v4.1.8
    • 

  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
    • 

  • a09d472 chore: release v4.1.7
    • 

  • a8fd24c chore: release v4.1.6
    • 

  • 18af98c fix(browser): simplify orchestrator otel carrier (#10285)
    • 

  • 3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
    • 

  • See full diff in compare view
    • 







Updates yaml from 2.8.3 to 2.9.0



Release notes

Sourced from yaml's releases.




v2.9.0


The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".


It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.


Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.


    

  • fix: Avoid calling Array.prototype.push.apply() with large source array
    • 

  • fix(lexer): Avoid recursive calls that may exhaust the call stack
    • 



v2.8.4


    

  • Disable alias resolution with maxAliasCount:0 (#677)
    • 

  • Handle invalid unicode escapes (e1a1a77)
    • 

  • Apply minFractionDigits only to decimal strings (#676)
    • 








Commits

    

  • ddb21b0 2.9.0
    • 

  • 167365b docs: Clarify that not all errors can be avoided
    • 

  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
    • 

  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
    • 

  • ccdf743 2.8.4
    • 

  • f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
    • 

  • e1a1a77 fix: Handle invalid unicode escapes
    • 

  • a163ea0 style: Satify Prettier
    • 

  • b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
    • 

  • 93c951b chore: Bump JSR version to v2.8.3 (#673)
    • 

  • Additional commits viewable in compare view
    • 







Updates fastmcp from 4.0.1 to 4.0.2



Release notes

Sourced from fastmcp's releases.




v4.0.2


4.0.2 (2026-06-06)


Bug Fixes


    

  • auth: fix OAuthProxy credential leak and redirect_uri validation (#262) (43f5f2e)
    • 








Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

        
          @dependabot
  




      

        
          deps: bump the npm-minor-patch group across 1 directory with 7 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          32ea3bf
        
      

    

  

    

      
Bumps the npm-minor-patch group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.12` | `2.4.16` |
| [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.3.0` | `2.4.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.5` | `4.1.8` |
| [tsx](https://github.com/privatenumber/tsx) | `4.21.0` | `4.22.4` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.5` | `4.1.8` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `4.0.1` | `4.0.2` |



Updates `@biomejs/biome` from 2.4.12 to 2.4.16
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.16/packages/@biomejs/biome)

Updates `ipaddr.js` from 2.3.0 to 2.4.0
- [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md)
- [Commits](whitequark/ipaddr.js@v2.3.0...v2.4.0)

Updates `@vitest/coverage-v8` from 4.1.5 to 4.1.8
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/coverage-v8)

Updates `tsx` from 4.21.0 to 4.22.4
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.21.0...v4.22.4)

Updates `vitest` from 4.1.5 to 4.1.8
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest)

Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.3...v2.9.0)

Updates `fastmcp` from 4.0.1 to 4.0.2
- [Release notes](https://github.com/punkpeye/fastmcp/releases)
- [Commits](punkpeye/fastmcp@v4.0.1...v4.0.2)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: ipaddr.js
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.22.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: fastmcp
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency

      

  typescript

  Related to the TypeScript packages or toolchain

  labels


      Jun 8, 2026

    

  



  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

              requested a review
  from a team
    as a code owner


        June 8, 2026 12:27        
        
      

    





    

    

      
    

    


      


          @dependabot
dependabot
Bot



            added
      

  dependencies

  Pull requests that update a dependency

      

  typescript

  Related to the TypeScript packages or toolchain

  labels


      Jun 8, 2026

    

  








      

  
      



  

  @dependabot


    @github




  



    

      

  

    

      
          
      

      
            dependabot
  Bot

      

      

      commented

        on behalf of github

        Jun 12, 2026



      
    


  


  

    

      

          
    
    

  


        
            
  
      
              Copy link

  

              
  
      
                Copy Markdown

  

        
      

    


    

        



        

  Author


    

  





      


        



  
    

      
          
Looks like these dependencies are updatable in another way, so this is no longer needed.


      		
    

  





        


            

            
            

              
            

        

      


      

            
  
  

    
  
    
    

  

  

  


    












      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



          closed this


      Jun 12, 2026

    

  


    


  

  
  

  
    

        

              @dependabot


        

      

            dependabot
Bot

        
    deleted the
    
      
        dependabot/npm_and_yarn/npm-minor-patch-1e39d0730f
    
    branch

        June 12, 2026 15:21        
        
      

    














  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    

    No reviews





  




    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency
  

    typescript

  Related to the TypeScript packages or toolchain








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants