chore(deps): update non-major dependencies#63
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
📝 WalkthroughWalkthroughDev tooling and metadata were updated: multiple devDependencies bumped ( 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #63 +/- ##
=======================================
Coverage 95.24% 95.24%
=======================================
Files 25 25
Lines 715 715
Branches 207 207
=======================================
Hits 681 681
Misses 34 34 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json(1 hunks)
🔇 Additional comments (1)
package.json (1)
49-49: lint-staged patch update is safe.The 16.2.6 bump fixes a bug in --continue-on-error task handling—low risk.
package.json
Outdated
There was a problem hiding this comment.
🧩 Analysis chain
Verify biome 2.3.0 compatibility with existing linting/formatting.
The bump to 2.3.0 introduces new lint rules and formatting options (lineEnding: auto, indentScriptAndStyle). Confirm the pipeline passes linting and formatting checks.
🏁 Script executed:
#!/bin/bash
# Verify lock file is updated and biome configuration remains compatible
# Check if pnpm-lock.yaml exists and contains the updated biome version
fd "pnpm-lock.yaml" -x grep -q "@biomejs/biome@2.3.0" && echo "✓ Lock file contains biome 2.3.0" || echo "✗ Lock file may need update"
# Check for biome config file and its content
fd "biome.json|biome.jsonc" -x catLength of output: 3953
Update biome.json schema reference to match 2.3.0 version.
Lock file is properly updated, but the schema URL still references 2.2.7. Update "$schema" in biome.json to https://biomejs.dev/schemas/2.3.0/schema.json to avoid validation mismatches.
Also confirm whether the new formatting options (lineEnding: auto, indentScriptAndStyle) mentioned in the PR should be adopted or remain as-is.
🤖 Prompt for AI Agents
In package.json around line 43 (the Biome dependency bump to 2.3.0), update the
"$schema" field in biome.json from the old 2.2.7 URL to
https://biomejs.dev/schemas/2.3.0/schema.json so the schema version matches the
installed biome package; open biome.json, replace the schema URL accordingly,
and then run biome/format or validation to ensure no schema errors. While here,
confirm whether to adopt the new formatting options (lineEnding: "auto" and
indentScriptAndStyle) by either adding them to biome.json if you want those
behaviors or leaving them out to preserve current formatting, and run the
formatter to verify the resulting diffs are acceptable.
e1d63fb to
81f4f99
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json(1 hunks)
🔇 Additional comments (2)
package.json (2)
49-49: Confirm lint-staged 16.2.6 patch resolves --continue-on-error issue.The patch addresses task failures with the
--continue-on-errorflag. If your CI/hooks use this flag, verify it now works as expected.
52-52: LGTM.tsdown 0.15.10 patch is low-risk (rolldown-plugin-dts upgrade, nested index fix).
81f4f99 to
e517470
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (3)
.nvmrc (1)
1-1: LGTM!Node patch version bump (22.21.0 → 22.21.1) is routine and safe.
package.json (2)
49-49: LGTM!lint-staged 16.2.5 → 16.2.6 is a patch fix for --continue-on-error task handling. No breaking changes.
52-52: LGTM!tsdown 0.15.9 → 0.15.11 (per AI summary; PR objectives mention 0.15.10) includes rolldown-plugin-dts upgrade and index file export fixes. Routine patch bump.
package.json
Outdated
There was a problem hiding this comment.
🧩 Analysis chain
Dependency update approved; schema URL verification required.
@biomejs/biome 2.2.7 → 2.3.1 looks good. However, previous reviews flagged that biome.json's "$schema" URL still referenced 2.2.7. Confirm the schema URL has been updated to match 2.3.1.
🏁 Script executed:
#!/bin/bash
# Verify biome.json schema URL matches installed version and lock file is current
echo "=== biome.json schema URL ==="
fd "biome.json|biome.jsonc" -x grep '"$schema"' || echo "No biome config found"
echo -e "\n=== pnpm-lock.yaml @biomejs/biome version ==="
grep -A 2 '"@biomejs/biome":' pnpm-lock.yaml | head -5 || echo "biome not found in lock file"
echo -e "\n=== Confirm schema matches package.json version ==="
SCHEMA=$(fd "biome.json|biome.jsonc" -x grep -oP '(?<=schemas/)[^/]+' || echo "not found")
echo "Schema version from biome.json: $SCHEMA (should be 2.3.1)"Length of output: 247
biome.json schema URL must be updated to 2.3.1.
The schema URL in biome.json is still 2.2.7 but the package is 2.3.1. Update to https://biomejs.dev/schemas/2.3.1/schema.json.
🤖 Prompt for AI Agents
In package.json around line 43, the project depends on "@biomejs/biome": "2.3.1"
but the biome.json schema URL still points to 2.2.7; update the schema URL in
biome.json to "https://biomejs.dev/schemas/2.3.1/schema.json" so it matches the
installed biome version, ensuring the schema version string and path reflect
2.3.1.
e517470 to
8982ea7
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (5)
.nvmrc (1)
1-1: Routine patch bump; no concerns.Node.js 22.21.1 is a patch release with minor fixes and improvements. Safe to update.
package.json (4)
44-44: Approve @types/node patch bump.Update from 22.18.12 to 22.18.13 is a safe patch with type corrections.
49-49: Approve lint-staged patch bump.Update from 16.2.5 to 16.2.6 fixes --continue-on-error task handling. No breaking changes.
52-52: Approve tsdown patch bumps.Updates from 0.15.9 to 0.15.11 include rolldown-plugin-dts upgrade and export path fixes. No concerns.
56-56: Approve pnpm packageManager update.Bump from 10.19.0 to 10.20.0 is a minor release. Ensure lock file is regenerated with
pnpm installor equivalent if needed.
8982ea7 to
1e78a91
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (1)
.nvmrc (1)
1-1: Node.js patch bump approved.Routine runtime update; no issues.
1e78a91 to
32c61f3
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (1)
.nvmrc (1)
1-1: Node patch update looks good.Straightforward patch version bump that aligns with the broader toolchain updates.
239fb8f to
1e0991c
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (1)
.nvmrc (1)
1-1: Node version patch bump is safe.Straightforward patch version update; no behavioral changes.
1e0991c to
e319653
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (1)
.nvmrc (1)
1-1: Node.js patch update approved.Straightforward patch bump (22.21.0 → 22.21.1) aligned with the PR strategy.
e319653 to
57b736a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.nvmrc(1 hunks)package.json(1 hunks)
🔇 Additional comments (3)
package.json (2)
56-56: pnpm version bump is safe.The packageManager field correctly pins pnpm to 10.20.0 (minor bump from 10.19.0). This ensures consistent builds across environments and includes patch fixes.
43-44: Lock file is properly updated.All four version bumps are confirmed in pnpm-lock.yaml and maintain non-major semantics (no breaking changes).
.nvmrc (1)
1-1: Node.js patch version aligned with package.json engines constraint.The .nvmrc update from 22.21.0 to 22.21.1 is a safe patch-level bump and satisfies the
engines.nodeconstraint (≥22.14.0) in package.json. No behavioral changes expected.
57b736a to
c838298
Compare
63ae458 to
b92bae4
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@package.json`:
- Line 57: The package.json packageManager field was updated to "pnpm@10.28.2"
but the lockfile metadata wasn't regenerated; run pnpm using that exact version
to regenerate the lockfile (e.g., install with pnpm v10.28.2 or run `pnpm
install` after switching to 10.28.2) so pnpm-lock.yaml includes the matching
pnpmVersion, then commit the updated lockfile alongside the packageManager
change; reference the packageManager field in package.json and the pnpm lockfile
(pnpm-lock.yaml) when making this fix.
b92bae4 to
f8703a9
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@package.json`:
- Around line 43-55: package.json was updated to "@biomejs/biome": "2.3.13" but
biome.json still references the old schema version; update the "$schema" value
in biome.json to "https://biomejs.dev/schemas/2.3.13/schema.json" so the schema
matches the `@biomejs/biome` dependency; locate the $schema key in biome.json and
replace the 2.2.7 URL with the 2.3.13 URL, then run biome lint/validate if
available to confirm compatibility.
package.json
Outdated
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -e
echo "=== Checking package.json ==="
if [ -f "package.json" ]; then
echo "package.json exists"
# Extract devDependencies section around the mentioned lines
cat -n package.json | sed -n '40,60p'
else
echo "package.json not found"
fi
echo ""
echo "=== Checking biome.json schema ==="
if [ -f "biome.json" ]; then
echo "biome.json found:"
cat biome.json | head -10
echo ""
SCHEMA=$(grep -o '"$schema"[^}]*' biome.json | head -1)
echo "Schema entry: $SCHEMA"
else
echo "biome.json not found"
fiRepository: deepnote/deepnote
Length of output: 1269
Update biome.json schema URL to match @biomejs/biome@2.3.13.
The schema is currently pinned to 2.2.7 but needs 2.3.13:
"$schema": "https://biomejs.dev/schemas/2.3.13/schema.json"All other devDependency bumps are semver-safe (patch/minor).
🤖 Prompt for AI Agents
In `@package.json` around lines 43 - 55, package.json was updated to
"@biomejs/biome": "2.3.13" but biome.json still references the old schema
version; update the "$schema" value in biome.json to
"https://biomejs.dev/schemas/2.3.13/schema.json" so the schema matches the
`@biomejs/biome` dependency; locate the $schema key in biome.json and replace the
2.2.7 URL with the 2.3.13 URL, then run biome lint/validate if available to
confirm compatibility.
4d15854 to
984a430
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@package.json`:
- Line 57: The packageManager field was updated to "pnpm@10.28.2" but the
lockfile wasn’t regenerated with that pnpm version; run pnpm@10.28.2 locally
(e.g., using pnpm env use 10.28.2 or npx pnpm@10.28.2) and run pnpm install to
regenerate the lockfile so it matches version 10 and includes the GTSA fix for
directories.bin; while doing so, ensure any packages that require
lifecycle/build scripts are added to pnpm.onlyBuiltDependencies (or adjusted per
pnpm v10 behavior) so installs still build needed packages.
package.json
Outdated
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check lockfile metadata
echo "=== pnpm-lock.yaml header ==="
head -10 pnpm-lock.yamlRepository: deepnote/deepnote
Length of output: 260
🌐 Web query:
pnpm 10.28.2 changelog security fix path traversal
💡 Result:
pnpm 10.28.2 includes a security fix for a path traversal issue in the package.json directories.bin field:
- Changelog / release notes (v10.28.2): “Security fix: prevent path traversal in
directories.binfield.” [1] - What was fixed: pnpm previously used
path.join(pkgPath, manifest.directories.bin)without validating the resulting path stayed inside the package root; a malicious package could use values like../../../../tmpto escape the directory and cause pnpm to chmod 755 arbitrary files (Unix-like systems only). [2] - Tracking IDs: GHSA-v253-rj99-jwpq and CVE-2026-24131; affected versions are pnpm < 10.28.2, patched in >= 10.28.2. [2][3]
Sources: [1] pnpm GitHub release v10.28.2 (github.com), [2] GitHub Security Advisory GHSA-v253-rj99-jwpq (github.com), [3] NVD entry for CVE-2026-24131 (nvd.nist.gov)
Citations:
- 1: https://github.com/pnpm/pnpm/releases/tag/v10.28.2
- 2: GHSA-v253-rj99-jwpq
- 3: https://nvd.nist.gov/vuln/detail/CVE-2026-24131?utm_source=openai
🌐 Web query:
pnpm 10 lifecycle scripts blocking default onlyBuiltDependencies
💡 Result:
In pnpm v10, dependency lifecycle scripts (not your project’s scripts) are blocked by default during pnpm install as a security breaking change. To let specific dependencies run preinstall/install/postinstall, you must explicitly allow them (originally via pnpm.onlyBuiltDependencies). [1][2]
How to allow builds (common options)
-
Allowlist specific packages (package.json):
{ "pnpm": { "onlyBuiltDependencies": ["esbuild", "sharp"] } }Only packages listed can run install-time lifecycle scripts; if you don’t configure an allowlist (or related file/list), pnpm defaults to blocking install scripts. [1][2]
-
Workspace/CI policy file:
onlyBuiltDependenciesFilecan point to a JSON allowlist file. [2] -
Newer preferred config:
allowBuilds(introduced later in pnpm v10.x) is a more flexible replacement foronlyBuiltDependencies/ignoredBuiltDependencies. [3] -
Restore “old behavior” (unsafe):
dangerouslyAllowAllBuilds=trueallows all dependency build scripts to run automatically. [2]
Note: This applies to dependencies’ scripts; your project scripts can still run unless you also set ignoreScripts. [2]
Sources: pnpm v10 announcement/discussion [1], pnpm settings docs [2], pnpm 10.26 release notes (adds allowBuilds) [3].
Regenerate lockfile with pnpm 10.28.2. Lockfile is still at version 9.0 and was not regenerated with the version bump.
The security fix for path traversal in directories.bin (GHSA-v253-rj99-jwpq) is valid. Also note that pnpm 10 blocks dependency lifecycle scripts by default; packages needing build scripts must be listed in pnpm.onlyBuiltDependencies.
Run pnpm install using 10.28.2 to regenerate the lockfile.
🤖 Prompt for AI Agents
In `@package.json` at line 57, The packageManager field was updated to
"pnpm@10.28.2" but the lockfile wasn’t regenerated with that pnpm version; run
pnpm@10.28.2 locally (e.g., using pnpm env use 10.28.2 or npx pnpm@10.28.2) and
run pnpm install to regenerate the lockfile so it matches version 10 and
includes the GTSA fix for directories.bin; while doing so, ensure any packages
that require lifecycle/build scripts are added to pnpm.onlyBuiltDependencies (or
adjusted per pnpm v10 behavior) so installs still build needed packages.
9e33bb6 to
a2fee6a
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@package.json`:
- Line 52: The tsdown upgrade to 0.20.2 introduces breaking config changes;
update all four tsdown.config.ts files (cli, convert, reactivity, runtime-core)
to be compatible: verify whether the existing dts: true still works—if not,
migrate to the new dts plugin and replace dts: true with the plugin
configuration; explicitly set fixedExtension (to true/false as appropriate for
node platform) and failOnWarn to the desired value to override new defaults;
rename any debugLogs keys to debug and remove any silent keys, and review
exports-related settings to match the new exports behavior in v0.20.2; finally
run a full build/CI to confirm no failing warnings or extension/output
regressions and adjust configs accordingly.
package.json
Outdated
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
echo "=== Looking for tsdown config files ==="
fd -t f "tsdown\.config\.(json|js|ts|mjs)" 2>/dev/null || echo "None found"
echo ""
echo "=== Checking package.json for tsdown script usage ==="
cat -n package.json | grep -A 2 -B 2 "tsdown"
echo ""
echo "=== Checking for tsdown imports/usage in codebase ==="
rg "tsdown" --type ts --type js --type json -g '!node_modules' -A 1 2>/dev/null || echo "None found"
echo ""
echo "=== Checking npm registry for tsdown versions ==="
npm info tsdown 2>/dev/null | head -30 || echo "Could not fetch npm info"Repository: deepnote/deepnote
Length of output: 3287
🌐 Web query:
tsdown 0.20.2 breaking changes from 0.15.9 changelog
💡 Result:
Breaking changes between tsdown v0.15.9 → v0.20.2
v0.16.0 (Nov 4, 2025)
- Config API renames: split
Options→UserConfig+InlineConfig(oldOptionsbecomesInlineConfig); renameNormalizedUserConfig→UserConfig; renameResolvedOptions→ResolvedConfig. [1] - Default
fixedExtensionchange (node platform): now defaults totruewhenplatformisnode, which can change output extensions to.mjs/.cjsand therefore affectpackage.jsonfields likemain/module/types/exports/bin. [1] - CLI flag rename:
--debug→--debug-logs. [1]
v0.17.0 (Dec 4, 2025)
- Native watcher / config loader / CI behavior changes (listed as breaking): Rolldown native watcher;
failOnWarnenabled by default in CI; removedunconfigfromconfigLoader; multi-config support for exports/publint/attw. [2] - attw option value rename:
attw.profile: "esmOnly"→"esm-only". [2]
v0.18.0 (Dec 15, 2025)
- copy plugin behavior rework: “sync behavior of
rollup-plugin-copy” (marked breaking). [3]
v0.19.0 (Jan 10, 2026)
- Option rename:
debugLogs→debug. [4] - Remove deprecated option:
silentremoved. [4] - devtools options renamed:
debug→devtools, anddebug.devtools→devtools.ui. [4] - exports behavior/options:
- add
exports.legacy; removemain&modulefields if pure ESM exports.excludenow excludes extension name- only auto-fill
typeswhenexports.legacyis enabled. [4]
- add
v0.20.0-beta.1 (Jan 12, 2026)
- dts option removed: upgrade dts plugin and remove
dts.resolve. [5]
v0.20.2 (Feb 4, 2026)
- Release notes show features/bugfixes only (no “Breaking Changes” section), e.g. rolldown upgrade + option validations/exports ordering fixes. [6]
Sources: [1] v0.16.0 release notes, [2] v0.17.0 release notes, [3] v0.18.0 release notes, [4] v0.19.0 release notes, [5] v0.20.0-beta.1 release notes, [6] v0.20.2 release notes.
🏁 Script executed:
#!/bin/bash
echo "=== Checking tsdown config files for deprecated options ==="
for file in packages/cli/tsdown.config.ts packages/convert/tsdown.config.ts packages/reactivity/tsdown.config.ts packages/runtime-core/tsdown.config.ts; do
if [ -f "$file" ]; then
echo ""
echo "--- $file ---"
cat -n "$file"
fi
doneRepository: deepnote/deepnote
Length of output: 1154
Config migration required for tsdown 0.15.9 → 0.20.2.
Five minor versions in pre-1.0 semver include substantial breaking changes:
- v0.16.0: config API renames,
fixedExtensionnow defaultstruefor node platform (affects output extensions.mjs/.cjs) - v0.17.0:
failOnWarnenabled by default in CI - v0.19.0:
debugLogs→debug,silentremoved, exports field behavior changed - v0.20.0:
dtsoption handling changed
All 4 tsdown.config.ts files (cli, convert, reactivity, runtime-core) use dts: true and may need updates. Verify whether dts option still works in v0.20.2 or requires migration to dts plugin; confirm fixedExtension and failOnWarn defaults don't break builds.
🤖 Prompt for AI Agents
In `@package.json` at line 52, The tsdown upgrade to 0.20.2 introduces breaking
config changes; update all four tsdown.config.ts files (cli, convert,
reactivity, runtime-core) to be compatible: verify whether the existing dts:
true still works—if not, migrate to the new dts plugin and replace dts: true
with the plugin configuration; explicitly set fixedExtension (to true/false as
appropriate for node platform) and failOnWarn to the desired value to override
new defaults; rename any debugLogs keys to debug and remove any silent keys, and
review exports-related settings to match the new exports behavior in v0.20.2;
finally run a full build/CI to confirm no failing warnings or extension/output
regressions and adjust configs accordingly.
a2fee6a to
081abd0
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@package.json`:
- Around line 43-55: biome.json's $schema version is out of sync with the
installed `@biomejs/biome` (package.json lists 2.3.14); update the schema
reference in biome.json to match (e.g.
"https://biomejs.dev/schemas/2.3.14/schema.json") or point it to the local
package schema ("./node_modules/@biomejs/biome/configuration_schema.json"), then
run the CLI migration to apply any config changes (biome migrate --write) so the
schema and the installed CLI/plugin version align.
| "@biomejs/biome": "2.3.14", | ||
| "@types/node": "22.19.8", | ||
| "@vitest/coverage-v8": "4.0.18", | ||
| "cspell": "9.6.4", | ||
| "husky": "9.1.7", | ||
| "license-checker-rseidelsohn": "4.4.2", | ||
| "lint-staged": "16.2.5", | ||
| "prettier": "3.6.2", | ||
| "sort-package-json": "3.4.0", | ||
| "tsdown": "0.15.9", | ||
| "lint-staged": "16.2.7", | ||
| "prettier": "3.8.1", | ||
| "sort-package-json": "3.6.1", | ||
| "tsdown": "0.20.3", | ||
| "typescript": "5.9.3", | ||
| "vite-tsconfig-paths": "^6.0.0", | ||
| "vitest": "4.0.5" | ||
| "vitest": "4.0.18" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
npm view "@biomejs/biome@2.3.14" version 2>&1 | head -5Repository: deepnote/deepnote
Length of output: 67
🏁 Script executed:
npm view "vitest@4.0.18" version 2>&1 | head -5Repository: deepnote/deepnote
Length of output: 67
🏁 Script executed:
npm view "@vitest/coverage-v8@4.0.18" version 2>&1 | head -5Repository: deepnote/deepnote
Length of output: 67
🏁 Script executed:
npm view "prettier@3.8.1" version 2>&1 | head -5Repository: deepnote/deepnote
Length of output: 66
🏁 Script executed:
npm view "typescript@5.9.3" version 2>&1 | head -5Repository: deepnote/deepnote
Length of output: 66
🏁 Script executed:
# Check if biome.json exists
if [ -f "biome.json" ]; then
echo "=== biome.json found ===" && head -10 biome.json
else
echo "=== biome.json not found ==="
fiRepository: deepnote/deepnote
Length of output: 405
🏁 Script executed:
# List files in root to understand context
git ls-files | grep -E "^(package\.json|biome\.json|\.npmrc)" | head -20Repository: deepnote/deepnote
Length of output: 84
🏁 Script executed:
# Check package.json for version history/comments and full devDependencies context
sed -n '30,60p' package.jsonRepository: deepnote/deepnote
Length of output: 861
🌐 Web query:
vitest 4.0.18 security vulnerabilities CVE
💡 Result:
Vitest 4.0.18: no known CVE security vulnerabilities currently reported as affecting this version (e.g., Snyk shows “No vulnerabilities found in the latest version 4.0.18”). [1]
Relevant recent Vitest CVEs (affect older versions, not 4.0.18):
- CVE-2025-24964 (Critical, RCE via CSWSH in Vitest API/WebSocket server) — affected versions are reported as up to/including 3.0.4, patched in 3.0.5 (and also in 1.6.1 and 2.1.9 for those release lines). Therefore 4.0.18 is not affected. [2][3]
- CVE-2025-24963 (Path traversal / arbitrary file read in browser mode server handler) — fixed in 2.1.9 and 3.0.4; affected versions are below those fixes, so 4.0.18 is not affected. [4]
Sources: [1] [2] [3] [4]
🌐 Web query:
biome schema version compatibility 2.2.7 2.3.14
💡 Result:
Biome treats the config JSON schema as versioned and expects the $schema version to match the Biome CLI version. If you run Biome 2.3.14 with a config that points at the 2.2.7 schema URL, Biome will report a schema/CLI version mismatch and tell you to run biome migrate (people hit this even for patch bumps like 2.3.0 → 2.3.1). [1], [2]
What to do for 2.2.7 ↔ 2.3.14
- If your CLI is 2.3.14, update
$schemato the 2.3.14 schema (or runbiome migrate --write). Biome explicitly recommends usingbiome migratewhen the schema is outdated. [1] - To avoid chasing schema URL versions entirely, point
$schemato the local schema shipped with your installed Biome:"$schema": "./node_modules/@biomejs/biome/configuration_schema.json"(documented option). [3]
Rule of thumb
- Older schema + newer CLI (2.2.7 schema with 2.3.14 CLI): expect a mismatch warning/error until you migrate/update. [1], [2]
- Newer schema + older CLI: also risky—your config may contain options the older CLI doesn’t understand; keep schema aligned with the CLI (or use the local schema path). [1], [3]
Sources
- Biome issue discussing mismatch detection + recommended fix via
biome migrate --write. [1] - Example mismatch report (2.3.1 CLI vs 2.3.0 schema) showing the warning/error. [2]
- Official config docs showing the local
configuration_schema.jsonpath (and the versioned URL alternative). [3]
Update biome.json schema to match CLI version.
biome.json points to schema 2.2.7 but @biomejs/biome is 2.3.14. Biome enforces schema/CLI alignment and will error on mismatch. Either update $schema to "https://biomejs.dev/schemas/2.3.14/schema.json", run biome migrate --write, or use the local schema path "./node_modules/@biomejs/biome/configuration_schema.json" to avoid manual version chasing.
All devDependency bumps are patch/minor (semver-safe). vitest 4.0.18 has no known CVEs.
🤖 Prompt for AI Agents
In `@package.json` around lines 43 - 55, biome.json's $schema version is out of
sync with the installed `@biomejs/biome` (package.json lists 2.3.14); update the
schema reference in biome.json to match (e.g.
"https://biomejs.dev/schemas/2.3.14/schema.json") or point it to the local
package schema ("./node_modules/@biomejs/biome/configuration_schema.json"), then
run the CLI migration to apply any config changes (biome migrate --write) so the
schema and the installed CLI/plugin version align.
b67023e to
95e47d8
Compare
95e47d8 to
10aff3a
Compare
This PR contains the following updates:
2.2.7→2.3.144.5.2→4.5.37.5.2→7.5.33.21.0→3.22.022.18.12→22.19.104.0.5→4.0.182.0.0→2.2.114.0.2→14.0.39.2.2→9.6.416.2.5→16.2.722.21.0→22.22.09.0.0→9.3.010.19.0→10.29.23.6.2→3.8.13.4.0→3.6.10.15.9→0.20.34.20.6→4.21.06.0.3→6.1.04.0.5→4.0.182.8.1→2.8.2Release Notes
biomejs/biome (@biomejs/biome)
v2.3.14Compare Source
Patch Changes
#8921
29e2435Thanks @siketyan! - Fixed #8759: TheuseConsistentTypeDefinitionsrule no longer converts empty object type declarations into interfaces, as it will conflict with thenoEmptyInterfacerule and can cause an infinite loop when both rules are enabled.#8928
ccaeac4Thanks @taga3s! - Added the nursery ruleuseGlobalThis. This rule enforces usingglobalThisoverwindow,selfandglobal.#8602
9a18daaThanks @dyc3! - Added the new nursery rulenoVueArrowFuncInWatch. This rule forbids using arrow functions in watchers in Vue components, because arrow functions do not give access to the component instance (viathis), while regular functions do.#8905
9b1eea8Thanks @ryan-m-walker! - Fixed #8428: Improved parsing recovery when encountering qualified rules inside CSS@pageat-rule blocks.#8900
f788cffThanks @mdevils! - Fixed #8802:useExhaustiveDependenciesnow correctly suggests dependencies without including callback-scoped variables or method names.When accessing object properties with a callback-scoped variable, only the object path is suggested:
When calling methods on objects, only the object is suggested as a dependency:
#8913
e1e20eaThanks @dyc3! - Fixed #8363: HTML parser no longer crashes when encountering a<character followed by a digit in text content (e.g.,<12 months). The parser now correctly emits an "Unescaped<bracket character" error instead of treating<12as a tag name and crashing.#8910
2fb63a4Thanks @dyc3! - Fixed #8774: Type aliases with generic parameters that haveextendsconstraints now properly indent comments after the equals sign.Previously, comments after the
=in type aliases withextendsconstraints were not indented:#8916
ea4bd04Thanks @ryan-m-walker! - Fixed #4013, where comments in member chains caused unnecessary line breaks.#8945
fa66fe3Thanks @fireairforce! - Fixed #8354: Don't remove quotes when type memeber is new.#8927
0ef3da5Thanks @littleKitchen! - Fixed #8907:useExhaustiveDependenciesnow correctly recognizes stable hook results (likeuseStatesetters anduseRefvalues) when declared withlet.#8931
4561751Thanks @koshin01! - Added the new nursery rulenoRedundantDefaultExport, which flags redundant default exports where the default export references the same identifier as a named export.#8900
f788cffThanks @mdevils! - Fixed #8883:useExhaustiveDependenciesno longer produces false positives when props are destructured in the function body of arrow function components without parentheses around the parameter.#8861
3531687Thanks @dyc3! - Added thenoDeprecatedMediaTypeCSS rule to flag deprecated media types liketvandhandheld.#8775
7ea71cdThanks @igas! - Fixed thenoUnnecessararyConditionsrule to prevent trigger for optional fallback patterns.#8860
95f1eeaThanks @dyc3! - Added the nursery rulenoHexColors, which flags the use of hexadecimal color codes in CSS and suggests using named colors or RGB/RGBA/HSL/HSLA formats instead.#8786
d876a38Thanks @Bertie690! - Added the nursery ruleuseConsistentMethodSignatures.Inspired by the similarly named version from
typescript-eslint, this rule aims to enforce a consistent style for methods used inside object types and interfaces.Examples
Invalid code with
styleset to"property"(the default):Invalid code with
styleset to"method":#8864
5e97119Thanks @dyc3! - Improved the summary provided bybiome migrate eslintto be clearer on why rules were not migrated. Biome now specifies a reason when a rule is not migrated, such as being incompatible with the formatter or not implemented yet. This helps users make more informed decisions when migrating their ESLint configurations to Biome.#8924
99b4cd1Thanks @tmohammad78! - Fixed #8920:noUnknownFunctionnow knows aboutsibling-count, andsibling-indexcss functions#8900
f788cffThanks @mdevils! - Fixed #8885:useExhaustiveDependenciesno longer incorrectly reports variables as unnecessary dependencies when they are derived from expressions containing post/pre-increment operators (++/--) or compound assignment operators (+=,-=, etc.).#8619
d78e01dThanks @Netail! - Added the nursery ruleuseInputName. Require mutation arguments to be called “input”, and the input type to be called Mutation name + “Input”.Invalid:
#8922
871b45eThanks @siketyan! - Fixed #8829: Revamped thenoGlobalDirnameFilenamerule to catch many false negatives that have not been reported.v2.3.13Compare Source
Patch Changes
#8815
f924f23Thanks @dyc3! - ImproveduseVueValidVOnto be more closely aligned with the source rule. It will now properly allow modifiers for all possible keyboard events. It should have better performance when there are no violations of the rule as well.Now treated valid:
#8856
85f81f9Thanks @dyc3! - Fixed #8710: Biome now parses Vue dynamic slot shorthand arguments that use template literals in[].#8850
2a190e0Thanks @dyc3! - Fixed #8708: Tailwind@utilitydirectives now parse functional utility names likepx-*when Tailwind directives are enabled.#8863
79386e0Thanks @dyc3! - Fixed an issue withbiome migrate eslintwhere it couldn't detect rules for CSS, GraphQL, and HTML.#8771
6f56b6eThanks @lghuahua! - Fix the--reporter=summaryoutput incorrectly merging and displaying wrong issue counts for different rules. Fixes #8730#8714
ac3a71fThanks @Netail! - Added new nursery ruleuse-consistent-enum-value-type. This rule disallows enums from having both number and string members.v2.3.12Compare Source
Patch Changes
#8653
047576dThanks @dyc3! - Added new nursery rulenoDuplicateAttributesto forbid duplicate attributes in HTML elements.#8648
96d09f4Thanks @BaeSeokJae! - Added a new nursery rulenoVueOptionsApi.Biome now reports Vue Options API usage, which is incompatible with Vue 3.6's Vapor Mode.
This rule detects Options API patterns in
<script>blocks,defineComponent(), andcreateApp()calls,helping prepare codebases for Vapor Mode adoption.
For example, the following now triggers this rule:
#8832
b08270bThanks @Exudev! - Fixed #8809, #7985, and #8136: thenoSecretsrule no longer reports false positives on common CamelCase identifiers likepaddingBottom,backgroundColor,unhandledRejection,uncaughtException, andIngestGatewayLogGroup.The entropy calculation algorithm now uses "average run length" to distinguish between legitimate CamelCase patterns (which have longer runs of same-case letters) and suspicious alternating case patterns (which have short runs).
#8793
c19fb0eThanks @TheBaconWizard! - Properly handleparametersmetavariables forarrow_functionGritQL queries. The followingbiome searchcommand no longer throws an error:biome search 'arrow_function(parameters=$parameters, body=$body)'#8561
981affbThanks @wataryooou! - FixednoUnusedVariablesto ignore type parameters declared in ambient contexts such asdeclare moduleblocks.#8817
652cfbbThanks @dyc3! - Fixed #8765: The HTML parser can now parse directive modifiers with a single colon, e.g.@keydown.:.#8704
a1914d4Thanks @Netail! - Added the nursery rulenoRootType.Disallow the usage of specified root types. (e.g.
mutationand/orsubscription)Invalid:
{ "options": { "disallow": ["mutation"] } }#8712
251b47bThanks @Netail! - Renamed the following GraphQL nursery rules to match the Biome standard:useUniqueArgumentNames->noDuplicateArgumentNamesuseUniqueFieldDefinitionNames->noDuplicateFieldDefinitionNamesuseUniqueGraphqlOperationName->noDuplicateGraphqlOperationNameuseUniqueInputFieldNames->noDuplicateInputFieldNamesuseUniqueVariableNames->noDuplicateVariableNamesRun the
biome migrate --writecommand to automatically update the configuration file.#7602
957cd8eThanks @kedevked! - Added the nursery lint ruleuseErrorCause.This rule enforces that errors caught in a
catchclause are not rethrown without wrapping them in a newErrorobject and specifying the original error as thecause. This helps preserve the error’s stack trace and context for better debugging.It can be configured with the following option:
requireCatchParameter: (default:true)true, the rule requires thatcatchclauses have a parameter. If athrowstatement appears inside acatchclause without a parameter, it will be flagged.Invalid examples:
Valid examples:
Valid example when
requireCatchParameterisfalse:Valid:
#8725
95aba98Thanks @dyc3! - Fixed #8715: The CSS parser will now recover slightly better if a semicolon is missing from Tailwind's@applyat-rule.#8616
4ee3bdaThanks @Netail! - Added the nursery ruleuseLoneAnonymousOperation. Disallow anonymous operations when more than one operation specified in document.Invalid:
#8624
291c9f2Thanks @taga3s! - Added the nursery ruleuseInlineScriptIdto the Next.js domain.This rule enforces
idattribute onnext/scriptcomponents with inline content ordangerouslySetInnerHTML.The following code is invalid:
#8767
0d15370Thanks @mdevils! - Fixed #3512:useExhaustiveDependenciesnow properly handles nested destructuring patternsfrom hook results.
#8757
17ed9d3Thanks @Netail! - Added the nursery rulenoDivRegex. Disallow equal signs explicitly at the beginning of regular expressions.Invalid:
#8836
aab1d17Thanks @dyc3! - Fixed #7858: Biome now parses Astro files with empty frontmatter blocks.#8755
3a15c29Thanks @arturalkaim! - Fixed #6670. The$filenamemetavariable can now be used in GritQLwhereclauses to filter matches by filename.#8821
63e68a1Thanks @playhardgopro! - Fixed several bugs in Vue conditional rules (useVueValidVIf,useVueValidVElse, anduseVueValidVElseIf) related to whitespace handling, newlines, and self-closing tags.#8767
0d15370Thanks @mdevils! - Fixed #3685:useExhaustiveDependenciesnow properly handles transparent expressionwrappers like non-null assertions and type assertions in dependency comparisons.
#8597
f764007Thanks @Netail! - Added the nursery rulenoDuplicateEnumValueNames. Enforce unique enum value names.Invalid:
#8679
33dfd7cThanks @ematipico! - Fixed #8678. Now Biome correctly parses components inside Vue, Svelte and Astro files when they have the same name of self-closing elements.#8617
31a9bfeThanks @Netail! - Added the nursery ruleuseLoneExecutableDefinition. Require queries, mutations, subscriptions or fragments to be located in separate files.Invalid:
#8697
8519669Thanks @Faizanq! - Added the nursery lint rulenoExcessiveLinesPerFileto CSS and GraphQL.#8711
365f7aaThanks @Netail! - Added new nursery rulenoDuplicateEnumValues, which disallows defining an enum with multiple members initialized to the same value.#8767
0d15370Thanks @mdevils! - Fixed #5914:useExhaustiveDependenciesnow properly handles variables declared in the samestatement.
#8767
0d15370Thanks @mdevils! - Fixed #8427:useExhaustiveDependenciesnow properly resolves variable references to detectcaptured dependencies.
#8767
0d15370Thanks @mdevils! - Fixed #8484:useExhaustiveDependenciesnow properly handles member access on stable hookresults.
#8767
0d15370Thanks @mdevils! - Fixed #7982:useExhaustiveDependenciesnow properly handles callback expressions with typeassertions.
#8766
39eb545Thanks @Netail! - Fixed #8761: Reverted wrapping the URL of rule descriptions with<>, causing broken URLs in VSCode.#8767
0d15370Thanks @mdevils! - Fixed #3080:useExhaustiveDependenciesnow properly analyzes captures within referencedfunctions passed to hooks.
#8740
4962ed0Thanks @Netail! - Extra rule source references.biome migrate eslintshould do a bit better detecting rules in your eslint configurations.#8776
395746fThanks @codiini! - Fixed #6003:noUselessUndefinedInitializationno longer reports exported variables initialized toundefined. In Svelte 4, this pattern is used to declare optional component props.#8767
0d15370Thanks @mdevils! - Fixed #4248:useExhaustiveDependenciesnow correctly handles function props passed ascallbacks.
#8819
bc191ffThanks @Netail! - Fixed #6567:noUnknownPropertynow ignores unknown properties in at-rules which support descriptors.#8787
adb652fThanks @tuyuritio! - Fixed #8777: Add support for:active-view-transitionpseudo-class.#8639
6577e32Thanks @ohnoah! - Added the nursery lint rulenoExcessiveLinesPerFile.Biome now reports files that exceed a configurable line limit.
#8753
71b5c6eThanks @Netail! - Added the nursery rulenoExcessiveClassesPerFile. Enforce a maximum number of classes per file.Invalid:
#8754
d6b2bdaThanks @Netail! - Added the nursery rulenoFloatingClasses. Disallownewoperators outside of assignments or comparisons.Invalid:
v2.3.11Compare Source
Patch Changes
#8583
83be210Thanks @dyc3! - Added the new nursery ruleuseVueValidTemplateRoot.This rule validates only root-level
<template>elements in Vue single-file components. If the<template>has asrcattribute, it must be empty. Otherwise, it must contain content.Invalid examples:
Valid examples:
#8586
df8fe06Thanks @dyc3! - Added a new nursery ruleuseVueConsistentVBindStyle. Enforces consistentv-bindstyle (:propshorthand vsv-bind:proplonghand). Default prefers shorthand; configurable via rule options.#8587
9a8c98dThanks @dyc3! - Added the ruleuseVueVForKey, which enforces that any element usingv-foralso specifies akey.Invalid
Valid
#8586
df8fe06Thanks @dyc3! - Added a new nursery ruleuseVueConsistentVOnStyle. Enforces consistentv-onstyle (@eventshorthand vsv-on:eventlonghand). Default prefers shorthand; configurable via rule options.#8583
83be210Thanks @dyc3! - Added the new nursery ruleuseVueValidVOnce. Enforces that usages of thev-oncedirective in Vue.js SFC are valid.#8498
d80fa41Thanks @tt-a1i! - Fixed #8494. ExtendednoUndeclaredEnvVarsto support bracket notation (process.env["VAR"],import.meta.env["VAR"]), Bun runtime (Bun.env.VAR,Bun.env["VAR"]), and Deno runtime (Deno.env.get("VAR")).#8509
574a909Thanks @ematipico! - Added support for parsing and formatting the Svelte{#await}syntax, whenhtml.experimentalFullSupportEnabledis set totrue.#8316
d64e92dThanks @washbin! - Added the new nursery rulenoMultiAssign. This rule helps to prevent multiple chained assignments.For example, the following code triggers because there are two assignment expressions in the same statement.
#8592
a5f59cdThanks @Netail! - Added the nursery ruleuseUniqueInputFieldNames. Require fields within an input object to be unique.Invalid:
#8524
17a6156Thanks @JacquesLeupin! - Fixed #8488: Relative plugin paths are now resolved from the configuration file directory, including when configurations are merged (e.g.extends: "//").#8655
3260ec9Thanks @JacquesLeupin! - Fixed #8636: Biome's CSS formatter now breaks comma-separated declaration values at top-level commas when wrapping.#8537
cc3e851Thanks @dibashthapa! - Fixed #8491: Resolved false positive errors for safe boolean expressions. There are still pending fixes. Head to #8491 (comment) for more detailsThis new change will check for safe boolean expressions in variable declarations.
For example,
Valid:
Invalid:
#8511
16a9036Thanks @ematipico! - Improved the diagnostics of the rulesuseSortedClassesandnoUnnecessaryConditions. The diagnostics now state that these rules are a work in progress and link to the relevant GitHub issue.#8521
a704be9Thanks @ToBinio! - Added the nursery ruleuseVueConsistentDefinePropsDeclaration, which enforces consistentdefinePropsdeclaration style.Invalid
Valid
#8595
7c85bf0Thanks @dyc3! - Fixed #8584: The HTML formatter will preserve whitespace after some elements and embedded expressions, which more closely aligns with Prettier's behavior.#8598
5e85d43Thanks @Netail! - Added the nursery ruleuseUniqueFieldDefinitionNames. Require all fields of a type to be unique.Invalid:
#8495
b573d14Thanks @taga3s! - Fixed #8405:noMisusedPromisesnow emits warnings/errors when a function returns union types such asT | Promise<T>which is used in conditionals.#8632
0be7d12Thanks @Bertie690! - The documentation & rule sources forlint/complexity/noBannedTypeshave been updated to fix a few oversights.In addition to some general typo fixes:
The rule now recommends
Record<keyof any, never>instead ofRecord<string, never>(the latter of which incorrectly allows symbol-keyed properties).The rule mentions an alternate method to enforce object emptiness involving
unique symbol-based guards used bytype-festand many other packages:The rule's listed sources have been updated as well to reflect the original source rule (
ban-types) having been split into 3 separate rules circa April 2024.#8580
a3a1ad2Thanks @taga3s! - Added the nursery rulenoBeforeInteractiveScriptOutsideDocumentto the Next.js domain.This rule prevents usage of
next/script'sbeforeInteractivestrategy outside ofpages/_document.js.#8493
5fc24f4Thanks @ematipico! - Added support for parsing and formatting the Svelte{#each}syntax, whenhtml.experimentalFullSupportEnabledis set totrue.#8546
0196c0eThanks @Zaczero! - Hardened union static-member type flattening in edge cases (e.g. unions containingunknownor inferred expression types). This keeps inference conservative and avoids unstable type growth innode = node.parent-style loops.[#8569](https://redirect.github.com/biomejs/biome/pull/85
Configuration
📅 Schedule: Branch creation - "before 9am on Monday" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.