chore(deps): update dev dependencies (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	^2.5.2 → ^2.5.4
@commitlint/cli (source)	^21.2.0 → ^21.2.1
@docusaurus/core (source)	^3.10.1 → ^3.10.2
@docusaurus/faster (source)	^3.10.1 → ^3.10.2
@docusaurus/module-type-aliases (source)	3.10.1 → 3.10.2
@docusaurus/preset-classic (source)	^3.10.1 → ^3.10.2
@docusaurus/tsconfig (source)	3.10.1 → 3.10.2
@docusaurus/types (source)	3.10.1 → 3.10.2
@hono/node-server	^2.0.8 → ^2.0.10
@tailwindcss/cli (source)	^4.3.2 → ^4.3.3
@tailwindcss/vite (source)	^4.3.2 → ^4.3.3
@vitest/coverage-v8 (source)	^4.1.9 → ^4.1.10
autoprefixer	^10.5.2 → ^10.5.4
hono (source)	^4.12.27 → ^4.12.30
postcss (source)	^8.5.16 → ^8.5.19
semantic-release	^25.0.5 → ^25.0.7
tailwindcss (source)	^4.3.2 → ^4.3.3
tsx (source)	^4.22.5 → ^4.23.1
typedoc (source)	^0.28.19 → ^0.28.20
vite (source)	^8.1.3 → ^8.1.5
vitest (source)	^4.1.9 → ^4.1.10

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.4

Compare Source

Patch Changes

• #​10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #​10894 f4fb10e Thanks @​ematipico! - Fixed #​6392: On-type formatting no longer moves comments before an if statement into its body.

• #​10939 f2799db Thanks @​Netail! - Fixed #​10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #​10945 ae15d98 Thanks @​Netail! - Fixed #​10942: Svelte directives don't throw an accidental debug log anymore.

• #​10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #​9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #​10891 ecca79e Thanks @​ematipico! - Fixed #10885: prevented a module-inference regression introduced by a housekeeping change.

• #​10886 60c8043 Thanks @​dyc3! - Fixed #​10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #​10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

v2.5.3

Compare Source

Patch Changes

• #​10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #​10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #​10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #​10827 098ba41 Thanks @​Aqu1bp! - Fixed #​10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #​10773 3c6513d Thanks @​otkrickey! - Fixed #​10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @&#8203;click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #​10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0]() more accurately.

• #​10865 6450276 Thanks @​ematipico! - Fixed #​10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

• #​10853 93d8e53 Thanks @​Netail! - Fixed #​10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

• #​10820 bba3092 Thanks @​JamBalaya56562! - Fixed #​10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

• #​10835 3447b2f Thanks @​dyc3! - Fixed #​10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

• #​10875 b12e486 Thanks @​dyc3! - Fixed #​10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

• #​10877 d6bc447 Thanks @​ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

• #​10867 a21463e Thanks @​dyc3! - Fixed #​10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.1

Compare Source

Note: Version bump only for package @​commitlint/cli

facebook/docusaurus (@​docusaurus/core)

v3.10.2

Compare Source

Backport and cherry-pick commits from main for v3.10.2 patch release:

• fix(bundler): do not import @swc/html, fix StackBlitz playground #​12055
• fix(core): use locale url in site config #​12054
• fix(theme-classic): remove redundant sidebar label titles #​11966
• fix(mdx-loader): avoid transforming dotted directory links into asset… #​11944
• fix(dev-server): for HTTPS, support non-RSA TLS certs #​12065
• fix(utils): fix extractLeadingEmoji() edge cases #​12100
• fix(gtag.js, faster): Fix StackBlitz, vendor @types/gtag.js, upgrade @swc/html #​12080
• fix(create-docusaurus): init template README should use npm commands by default #​12138
• fix(cli): docusaurus serve should pass --host to server.listen() #​12127
• fix(core): bump detect-port to v2.1, fix pnpm trustPolicy downgrade issue #​12012
• fix(i18n): complete Spanish translations for theme-common and theme-l… #​12180
• chore(deps): migrate to @11ty/gray-matter #​12181
• fix(core): fix BaseUrlIssueBanner little security issue #​12260
• fix(core): accept boolean attributes in headTags config validation #​12238
• fix(sitemap): don't drop lastmod for an epoch (0) timestamp #​12212
• fix(utils): preserve author names containing commas in git log parsing #​12069

honojs/node-server (@​hono/node-server)

v2.0.10

Compare Source

Security fixes

This release includes a fix for the following security issue:

Unauthenticated memory-leak DoS via aborted WebSocket handshake

Affects: upgradeWebSocket. A WebSocket upgrade request with a missing or malformed Sec-WebSocket-Key header leaked the request's IncomingMessage and left a promise pending, even though no connection was established. Since the route is reachable pre-handshake without authentication, an attacker could flood it to gradually exhaust memory. GHSA-9mqv-5hh9-4cgg

---

Users of upgradeWebSocket are encouraged to upgrade to this version.

v2.0.9

Compare Source

What's Changed

• fix(websocket): polyfill missing ErrorEvent global by @​otnc in #​371
• fix(serve-static): correct Range header parsing edge cases by @​otnc in #​372
• fix: recover complete request bodies after client disconnect by @​usualoma in #​375

New Contributors

• @​otnc made their first contribution in #​371

Full Changelog: honojs/node-server@v2.0.8...v2.0.9

tailwindlabs/tailwindcss (@​tailwindcss/cli)

v4.3.3

Compare Source

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

postcss/autoprefixer (autoprefixer)

v10.5.4

Compare Source

• Fixed prefixed rule duplication (by @​xianjianlf2).

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

honojs/hono (hono)

v4.12.30

Compare Source

What's Changed

• chore(benchmark/routers): bump deps in #​5107
• chore(benchmark): remove not used benchmarks in #​5108
• chore: update to ts6 in prep for ts7 in #​5104
• fix(cache): deduplicate Cache-Control directives case-insensitively in #​5025
• fix(compress): do not compress 206 Partial Content responses in #​5020
• fix(client): replaceUrlParam should not match a param that prefixes another in #​5096
• fix(method-override): set duplex when forwarding a stream body in query mode in #​5110

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

Compare Source

What's Changed

• fix(client): merge function headers with per-request headers by @​yusukebe in #​5092
• chore: fix no-op tsc in test script by @​yusukebe in #​5093
• fix(lambda-edge): resolve the handler with the value passed to the callback by @​yusukebe in #​5094
• docs(language): add JSDoc @​example to languageDetector by @​codebybilal18 in #​5081
• test(workerd): add compatibilityDate by @​yusukebe in #​5100
• fix(lambda-edge): base64 encode content-encoded response bodies by @​yusukebe in #​5099
• fix(aws-lambda): treat any non-identity content-encoding as binary by @​yusukebe in #​5101
• fix(types): strip extra properties from array types in JSONParsed by @​Arman-Luthra in #​5103
• fix(trie-router): match empty wildcard remainder after regexp param by @​usualoma in #​5102
• fix(etag): treat If-None-Match: * as a match by @​yusukebe in #​5084

New Contributors

• @​codebybilal18 made their first contribution in #​5081
• @​Arman-Luthra made their first contribution in #​5103

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

Compare Source

What's Changed

• fix(serve-static): treat empty string content as found by @​yusukebe in #​5062
• docs(MIGRATION): fix req.raw.headers reference (property, not method) by @​EduardF1 in #​5047
• chore: don't publish *.tsbuildinfo by @​yusukebe in #​5066
• fix(utils/body,validator): normalize Content-Type media type for case-insensitive matching by @​yusukebe in #​5067
• fix: avoid circular dependency between body.ts and request.ts by @​usualoma in #​5071
• fix(bun): report the requested subprotocol on WSContext.protocol by @​greymoth-jp in #​5059
• chore: bump devDependencies by @​yusukebe in #​5085
• fix(aws-lambda): detect V2 events by request context, not rawPath alone by @​VihaanAgarwal in #​5033
• docs(context-storage): fix JSDoc by @​yusukebe in #​5086

New Contributors

• @​EduardF1 made their first contribution in #​5047
• @​greymoth-jp made their first contribution in #​5059
• @​VihaanAgarwal made their first contribution in #​5033

Full Changelog: honojs/hono@v4.12.27...v4.12.28

postcss/postcss (postcss)

v8.5.19

Compare Source

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

v8.5.18

Compare Source

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

v8.5.17

Compare Source

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

semantic-release/semantic-release (semantic-release)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

privatenumber/tsx (tsx)

v4.23.1

Compare Source

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

TypeStrong/TypeDoc (typedoc)

v0.28.20

Compare Source

Features

• Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #​3029.
• Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #​3096.
• API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

• When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #​3078.
• Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #​3103.
• A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #​3111.
• Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #​3120.

Thanks!

• @​greymoth-jp
• @​jonathanhefner
• @​kcastellino
• @​Metbcy
• @​StoneCypher
• @​wotan-allfather

vitejs/vite (vite)

v8.1.5

Compare Source

Please refer to CHANGELOG.md for details.

v8.1.4

Compare Source

Features

• legacy: prefer oxc as minifier (fix #​21973) (#​22468) (ab5dafa)

Bug Fixes

• build: add workaround for building on stackblitz (#​22840) (575c32c)
• build: keep import.meta.url in preload function as-is (#​22839) (f1f90ed)
• deps: update all non-major dependencies (#​22865) (d4295a9)
• deps: update rolldown-related dependencies (#​22866) (7cf07e4)
• html: avoid backtracking in import-only check (#​22848) (b5868c0)
• optimizer: avoid optimizer run for transform request before init (#​22852) (72a5e21)
• ssr: align named export function call stacktrace column with Node (#​22829) (173a1b6)
• strip pure CSS chunk imports when chunkImportMap is enabled (#​22841) (648bd04)

Documentation

• fix incorrect @default for server.cors (#​22859) (70435b2)

Miscellaneous Chores

• deps: update dependency postcss-modules to v9 (#​22867) (a9539d6)

Code Refactoring

• eliminate ineffectiveDynamicImport warn (#​22876) (ea22fb3)

Tests

• avoid warnings (#​22851) (af21ab6)

Build System

• remove the custom onLog function (#​22878) (2c4a217)
• replace deprecated onwarn with onLog (#​22741) (c581b55)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 5am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🎉 This PR is included in version @rotorsoft/act-http-v1.8.10 🎉

The release is available on:

• @rotorsoft/act-http-v1.8.10
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version @rotorsoft/act-diagram-v1.0.10 🎉

The release is available on:

• @rotorsoft/act-diagram-v1.0.10
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version @rotorsoft/act-tck-v1.27.15 🎉

The release is available on:

• @rotorsoft/act-tck-v1.27.15
• GitHub release

Your semantic-release bot 📦🚀