Skip to content

fix(deps): update npm non-major dependencies#4093

Merged
oddvernes merged 3 commits intomainfrom
renovate/npm-minor-patch
Sep 25, 2025
Merged

fix(deps): update npm non-major dependencies#4093
oddvernes merged 3 commits intomainfrom
renovate/npm-minor-patch

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Sep 25, 2025

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package Change Age Confidence Type Update Pending
@biomejs/biome (source) 2.2.3 -> 2.2.4 age confidence devDependencies patch
@changesets/cli (source) ^2.29.6 -> ^2.29.7 age confidence devDependencies patch
@navikt/aksel-icons (source) ^7.29.1 -> ^7.30.1 age confidence dependencies minor 7.31.0
@navikt/aksel-icons (source) ^7.29.1 -> ^7.30.1 age confidence devDependencies minor 7.31.0
@react-router/dev (source) ^7.8.2 -> ^7.9.1 age confidence devDependencies minor 7.9.2
@react-router/node (source) ^7.8.2 -> ^7.9.1 age confidence dependencies minor 7.9.2
@react-router/serve (source) ^7.8.2 -> ^7.9.1 age confidence dependencies minor 7.9.2
@storybook/addon-a11y (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@storybook/addon-docs (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@storybook/addon-links (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@storybook/addon-themes (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@storybook/addon-vitest (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@storybook/react-vite (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
@types/node (source) ^22.18.1 -> ^22.18.6 age confidence devDependencies patch
@types/react (source) ^19.1.12 -> ^19.1.13 age confidence devDependencies patch
@vitejs/plugin-react (source) ^5.0.2 -> ^5.0.3 age confidence devDependencies patch
@vitejs/plugin-react-swc (source) ^4.0.1 -> ^4.1.0 age confidence devDependencies minor
axe-playwright ^2.1.0 -> ^2.2.2 age confidence devDependencies minor
chromatic (source) ^13.1.4 -> ^13.2.0 age confidence devDependencies minor
commander ^14.0.0 -> ^14.0.1 age confidence dependencies patch
fs-extra ^11.3.1 -> ^11.3.2 age confidence devDependencies patch
node (source) ^22 -> ^22.19.0 age confidence engines minor v22.20.0
react-router (source) ^7.8.2 -> ^7.9.1 age confidence dependencies minor 7.9.2
react-router-dom (source) ^7.8.2 -> ^7.9.1 age confidence dependencies minor 7.9.2
rollup (source) ^4.50.1 -> ^4.52.0 age confidence devDependencies minor 4.52.2 (+1)
storybook (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
storybook-addon-pseudo-states (source) ^9.1.5 -> ^9.1.7 age confidence devDependencies patch 9.1.8
vite (source) ^7.1.4 -> ^7.1.6 age confidence devDependencies patch 7.1.7
vite-plugin-react-rich-svg ^1.2.1 -> ^1.3.0 age confidence devDependencies minor
zod (source) ^4.1.5 -> ^4.1.11 age confidence dependencies patch
zod-validation-error ^4.0.1 -> ^4.0.2 age confidence dependencies patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.


Release Notes

biomejs/biome (@​biomejs/biome)

v2.2.4

Compare Source

Patch Changes
  • #​7453 aa8cea3 Thanks @​arendjr! - Fixed #​7242: Aliases specified in
    package.json's imports section now support having multiple targets as part of an array.

  • #​7454 ac17183 Thanks @​arendjr! - Greatly improved performance of
    noImportCycles by eliminating allocations.

    In one repository, the total runtime of Biome with only noImportCycles enabled went from ~23s down to ~4s.

  • #​7447 7139aad Thanks @​rriski! - Fixes #​7446. The GritQL
    $... spread metavariable now correctly matches members in object literals, aligning its behavior with arrays and function calls.

  • #​6710 98cf9af Thanks @​arendjr! - Fixed #​4723: Type inference now recognises
    index signatures and their accesses when they are being indexed as a string.

Example
type BagOfPromises = {
  // This is an index signature definition. It declares that instances of type
  // `BagOfPromises` can be indexed using arbitrary strings.
  [property: string]: Promise<void>;
};

let bag: BagOfPromises = {};
// Because `bag.iAmAPromise` is equivalent to `bag["iAmAPromise"]`, this is
// considered an access to the string index, and a Promise is expected.
bag.iAmAPromise;
  • #​7415 d042f18 Thanks @​qraqras! - Fixed #​7212, now the useOptionalChain rule recognizes optional chaining using
    typeof (e.g., typeof foo !== 'undefined' && foo.bar).

  • #​7419 576baf4 Thanks @​Conaclos! - Fixed #​7323. noUnusedPrivateClassMembers no longer reports as unused TypeScript
    private members if the rule encounters a computed access on this.

    In the following example, member as previously reported as unused. It is no longer reported.

    class TsBioo {
      private member: number;
    
      set_with_name(name: string, value: number) {
        this[name] = value;
      }
    }
  • 351bccd Thanks @​ematipico! - Added the new nursery lint rule
    noJsxLiterals, which disallows the use of string literals inside JSX.

    The rule catches these cases:

    <>
      <div>test</div> {/* test is invalid */}
      <>test</>
      <div>
        {/* this string is invalid */}
        asdjfl test foo
      </div>
    </>
  • #​7406 b906112 Thanks @​mdevils! - Fixed an issue (#​6393) where the useHookAtTopLevel rule reported excessive diagnostics for nested hook calls.

    The rule now reports only the offending top-level call site, not sub-hooks of composite hooks.

    // Before: reported twice (useFoo and useBar).
    function useFoo() {
      return useBar();
    }
    function Component() {
      if (cond) useFoo();
    }
    // After: reported once at the call to useFoo().
  • #​7461 ea585a9 Thanks @​arendjr! - Improved performance of
    noPrivateImports by eliminating allocations.

    In one repository, the total runtime of Biome with only noPrivateImports enabled went from ~3.2s down to ~1.4s.

  • 351bccd Thanks @​ematipico! - Fixed #​7411. The Biome Language Server had a regression where opening an editor with a file already open wouldn't load the project settings correctly.

  • #​7142 53ff5ae Thanks @​Netail! - Added the new nursery rule noDuplicateDependencies, which verifies that no dependencies are duplicated between the
    bundledDependencies, bundleDependencies, dependencies, devDependencies, overrides,
    optionalDependencies, and peerDependencies sections.

    For example, the following snippets will trigger the rule:

    {
      "dependencies": {
        "foo": ""
      },
      "devDependencies": {
        "foo": ""
      }
    }
    {
      "dependencies": {
        "foo": ""
      },
      "optionalDependencies": {
        "foo": ""
      }
    }
    {
      "dependencies": {
        "foo": ""
      },
      "peerDependencies": {
        "foo": ""
      }
    }
  • 351bccd Thanks @​ematipico! - Fixed #​3824. Now the option CLI
    --color is correctly applied to logging too.

changesets/changesets (@​changesets/cli)

v2.29.7

Compare Source

Patch Changes
navikt/aksel (@​navikt/aksel-icons)

v7.30.1

Compare Source

v7.30.0

Compare Source

remix-run/react-router (@​react-router/dev)

v7.9.1

Compare Source

Patch Changes
  • Fix internal Future interface naming from middleware -> v8_middleware (#​14327)
  • Updated dependencies:
    • react-router@7.9.1
    • @react-router/node@7.9.1
    • @react-router/serve@7.9.1

v7.9.0

Compare Source

Minor Changes
Patch Changes
  • Updated dependencies:
    • react-router@7.9.0
    • @react-router/node@7.9.0
    • @react-router/serve@7.9.0
remix-run/react-router (@​react-router/node)

v7.9.1

Compare Source

Patch Changes
  • Updated dependencies:
    • react-router@7.9.1

v7.9.0

Compare Source

Minor Changes
Patch Changes
  • Updated dependencies:
    • react-router@7.9.0
remix-run/react-router (@​react-router/serve)

v7.9.1

Compare Source

Patch Changes
  • Updated dependencies:
    • react-router@7.9.1
    • @react-router/node@7.9.1
    • @react-router/express@7.9.1

v7.9.0

Compare Source

Patch Changes
  • Updated dependencies:
    • react-router@7.9.0
    • @react-router/express@7.9.0
    • @react-router/node@7.9.0
storybookjs/storybook (@​storybook/addon-a11y)

v9.1.7

Compare Source

v9.1.6

Compare Source

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v5.0.3

Compare Source

HMR did not work for components imported with queries with rolldown-vite (#​872)
Perf: simplify refresh wrapper generation (#​835)
vitejs/vite-plugin-react (@​vitejs/plugin-react-swc)

v4.1.0

Compare Source

Set SWC cacheRoot options

This is set to {viteCacheDir}/swc and override the default of .swc.

Perf: simplify refresh wrapper generation (#​835)
abhinaba-ghosh/axe-playwright (axe-playwright)

v2.2.2

Compare Source

v2.2.1

Compare Source

v2.2.0

Compare Source

Features
Bug Fixes
  • change reporter conditionals in checkA11y() to fix skipFailure options not working when reporter is 'junit' (b4514d0)
chromaui/chromatic-cli (chromatic)

v13.2.0

Compare Source

🚀 Enhancement
Authors: 1

v13.1.5

Compare Source

🐛 Bug Fix
Authors: 1

tj/commander.js (commander)

v14.0.1

Compare Source

Fixed
  • broken markdown link in README ([#​2369])
Changed
  • improve code readability by using optional chaining ([#​2394])
  • use more idiomatic code with object spread instead of Object.assign() ([#​2395])
  • improve code readability using string.endsWith() instead of string.slice() ([#​2396])
  • refactor .parseOptions() to process args array in-place ([#​2409])
  • change private variadic support routines from ._concatValue() to ._collectValue() (change code from array.concat() to array.push()) ([#​2410])
  • update (dev) dependencies
jprichardson/node-fs-extra (fs-extra)

v11.3.2

Compare Source

  • Fix spurrious UnhandledPromiseRejectionWarning that could occur when calling .copy() in some cases (#​1056, #​1058)
nodejs/node (node)

v22.19.0

Compare Source

v22.18.0

Compare Source

v22.17.1

Compare Source

v22.17.0: 2025-06-24, Version 22.17.0 'Jod' (LTS), @​aduh95

Compare Source

Notable Changes
⚠️ Deprecations
Instantiating node:http classes without new

Constructing classes like IncomingMessage or ServerResponse without the new
keyword is now discouraged. This clarifies API expectations and aligns with standard
JavaScript behavior. It may warn or error in future versions.

Contributed by Yagiz Nizipli in #​58518.

options.shell = "" in node:child_process

Using an empty string for shell previously had undefined behavior. This change
encourages explicit choices (e.g., shell: true or a shell path) and avoids
relying on implementation quirks.

Contributed by Antoine du Hamel and Renegade334 #​58564.

HTTP/2 priority signaling

The HTTP/2 prioritization API (e.g., stream.priority) is now deprecated due to
poor real-world support. Applications should avoid using priority hints and expect future removal.

Contributed by Matteo Collina and Antoine du Hamel #​58313.

✅ Features graduated to stable
assert.partialDeepStrictEqual()

This method compares only a subset of properties in deep object comparisons,
useful for flexible test assertions. Its stabilization means it's now safe for
general use and won't change unexpectedly in future releases.

Contributed by Ruben Bridgewater in #​57370.

Miscellaneous
  • dirent.parentPath
  • filehandle.readableWebStream()
  • fs.glob()
  • fs.openAsBlob()
  • node:readline/promises
  • port.hasRef()
  • readable.compose()
  • readable.iterator()
  • readable.readableAborted
  • readable.readableDidRead
  • Duplex.fromWeb()
  • Duplex.toWeb()
  • Readable.fromWeb()
  • Readable.isDisturbed()
  • Readable.toWeb()
  • stream.isErrored()
  • stream.isReadable()
  • URL.createObjectURL()
  • URL.revokeObjectURL()
  • v8.setHeapSnapshotNearHeapLimit()
  • Writable.fromWeb()
  • Writable.toWeb()
  • writable.writableAborted
  • Startup Snapshot API
  • ERR_INPUT_TYPE_NOT_ALLOWED
  • ERR_UNKNOWN_FILE_EXTENSION
  • ERR_UNKNOWN_MODULE_FORMAT
  • ERR_USE_AFTER_CLOSE

Contributed by James M Snell in
#​57513 and
#​58541.

Semver-minor features
🔧 fs.FileHandle.readableWebStream gets autoClose option

This gives developers explicit control over whether the file descriptor should
be closed when the stream ends. Helps avoid subtle resource leaks.

Contributed by James M Snell in #​58548.

🔧 fs.Dir now supports explicit resource management

This improves ergonomics around async iteration of directories. Developers can
now manually control when a directory is closed using .close() or with Symbol.asyncDispose.

Contributed by Antoine du Hamel in #​58206.

📊 http2 gains diagnostics channel: http2.server.stream.finish

Adds observability support for when a stream finishes. Useful for logging,
monitoring, and debugging HTTP/2 behavior without patching internals.

Contributed by Darshan Sen in #​58560.

🔐 Permissions: implicit allow-fs-read to entrypoint

Node.js permissions model now allows read access to the entry file by default.
It makes running permission-restricted apps smoother while preserving security.

Contributed by Rafael Gonzaga in #​58579.

🎨 util.styleText() adds 'none' style

This lets developers remove styling cleanly without hacks. Useful for overriding
inherited terminal styles when composing styled strings.

Contributed by James M Snell in #​58437.

🧑‍💻 Community updates
Commits

Configuration

📅 Schedule: Branch creation - "before 07:00 on Thursday" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link

changeset-bot bot commented Sep 25, 2025

🦋 Changeset detected

Latest commit: 0ad7132

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages
Name Type
@digdir/designsystemet Patch
@digdir/designsystemet-react Patch
@digdir/designsystemet-theme Patch
@digdir/designsystemet-css Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions
Copy link
Contributor

github-actions bot commented Sep 25, 2025

Preview deployments for this pull request:

storybook - 25. Sep 2025 - 11:52

themebuilder - 25. Sep 2025 - 11:52

www - 25. Sep 2025 - 11:52

Copy link
Member

@Barsnes Barsnes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything seems fine

@renovate
Copy link
Contributor Author

renovate bot commented Sep 25, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@oddvernes
Copy link
Collaborator

I concur

@oddvernes oddvernes merged commit 97fce76 into main Sep 25, 2025
19 checks passed
@github-actions github-actions bot mentioned this pull request Sep 24, 2025
@Barsnes Barsnes deleted the renovate/npm-minor-patch branch September 29, 2025 07:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants