Skip to content

chore(deps-dev): Bump @biomejs/biome from 2.5.4 to 2.5.5 in the npm-dev group - #28

Closed
dependabot[bot] wants to merge 19 commits into
mainfrom
dependabot/npm_and_yarn/npm-dev-2c95e5faeb
Closed

chore(deps-dev): Bump @biomejs/biome from 2.5.4 to 2.5.5 in the npm-dev group#28
dependabot[bot] wants to merge 19 commits into
mainfrom
dependabot/npm_and_yarn/npm-dev-2c95e5faeb

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-dev group with 1 update: @biomejs/biome.

Updates @biomejs/biome from 2.5.4 to 2.5.5

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.5

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
    switch (value) {
      case 1n:
        break;
    }
  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
    declare const value: Recursive;
    String(value);
    value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
    + A:hover { color: initial; }
    - @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
    + @keyframes :GLOBAL KeepFrames { from { color: RED; } }
    - @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
    + @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }
  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
    +a { color: /* before */ red /* after */ !important; }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
    switch (value) {
      case 1n:
        break;
    }
  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
    declare const value: Recursive;
    String(value);
    value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
    + A:hover { color: initial; }
    - @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
    + @keyframes :GLOBAL KeepFrames { from { color: RED; } }
    - @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
    + @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }
  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
    +a { color: /* before */ red /* after */ !important; }

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

macanderson and others added 17 commits July 12, 2026 13:13
Adapters for Claude Code, Gemini CLI, Oxagen, Stella (+ mock for CI);
held-out verification the agent can never author; normalized token and
uniform cost accounting; matched-config enforcement with unmatched-model
warnings; agent-error quarantine; Wilson/McNemar/seeded-bootstrap stats;
per-run manifests, transcripts, diffs, and reproduce commands.
Repo moved to github.com/oxageninc/arena. Updates the package name,
repository URL, README title + clone command, harness self-name in the run
manifest and CLI banner, and the Stella link (now oxageninc/stella).
Adds harbor/ — a Python Harbor adapter (BaseInstalledAgent) that runs your
coding agent through Harbor's containerized SWE-bench / Terminal-Bench verifier
head-to-head against the agents Harbor already ships (Claude Code, Gemini,
Codex, Cursor, Aider, ...), all scored by the same repo-native test suite.

- ByoAgent: wire up your own agent from a TOML/JSON spec — no Python.
- OxagenAgent / StellaAgent: specs for agents Harbor lacks; worked examples.
- Spec-driven install (binary upload or script) + one-shot run + best-effort
  token/cost parsing with the same cache-aware normalization as the TS side.
- A non-zero agent exit never aborts scoring — the verifier decides pass/fail.
- Pure logic (spec/metrics/command) is Harbor-free and unit-tested; agent tests
  run against real Harbor 0.6.1 (39 tests green) and verify Harbor's factory
  loads each agent by import path.
- Docs + run.sh + a CI job (pip install -e .; pytest).

Main README + METHODOLOGY now point at this adapter as the scale-up path.
Harbor requires Python >=3.12, so the CI job used 3.11 and could not resolve
harbor. Bump CI to 3.12, set requires-python accordingly, and pin the dep to
the tested 0.6.x line.
Snapshot a run's per-agent metrics as a committed baseline, then fail CI when
a later run regresses:

- arena baseline save <runDir> [--agent A] -> arena-baseline.json
- arena baseline show
- arena gate <runDir> [--require-significant] [--allow-task-mismatch] [...]
  exits non-zero on regression.

Checks per agent: resolve-rate drop (strict, or only when it clears 95% CI
noise with --require-significant), median token/cost increase past thresholds,
wall-clock (reported; enforced with --speed-increase). Refuses to compare
across different task sets unless --allow-task-mismatch. Thresholds via flags
or arena-gate.json.

src/summary.ts factors the per-agent aggregation into one source of truth
shared by report + baseline + gate. 14 new unit tests (51 total); example CI
workflow + gate config under examples/. README + METHODOLOGY document it.
…, dependency review

Quality:
- Add Biome (lint + format), pinned devDep, as a CI gate (pnpm lint).
  Normalized formatting across src/test; removed dead code Biome caught
  (unused pricing local in orchestrator; unused test locals).

Supply chain / security (standard for popular OSS repos):
- .github/dependabot.yml — weekly npm + pip + github-actions updates.
- dependency-review workflow — blocks PRs adding high-severity vulns.
- OpenSSF Scorecard workflow — security-posture scoring to the Security tab.
- SECURITY.md — private vulnerability reporting policy.
- CODEOWNERS — routes review to the maintainer.
- Least-privilege 'permissions: contents: read' on CI.

typecheck + 51 tests + biome ci all green.
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.5 to 26.1.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updates the requirements on [harbor](https://github.com/harbor-framework/harbor-cookbook) to permit the latest version.
- [Commits](https://github.com/harbor-framework/harbor-cookbook/commits)

---
updated-dependencies:
- dependency-name: harbor
  dependency-version: 0.19.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.9.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
Bumps the actions group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4` | `7` |
| [pnpm/action-setup](https://github.com/pnpm/action-setup) | `4` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node) | `4` | `6` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5` | `6` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4` | `5` |
| [ossf/scorecard-action](https://github.com/ossf/scorecard-action) | `2.4.0` | `2.4.3` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |


Updates `actions/checkout` from 4 to 7
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@v4...v7)

Updates `pnpm/action-setup` from 4 to 6
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

Updates `actions/setup-node` from 4 to 6
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

Updates `actions/setup-python` from 5 to 6
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v5...v6)

Updates `actions/dependency-review-action` from 4 to 5
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](actions/dependency-review-action@v4...v5)

Updates `ossf/scorecard-action` from 2.4.0 to 2.4.3
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](ossf/scorecard-action@v2.4.0...v2.4.3)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/setup-python
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: actions/dependency-review-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
- dependency-name: ossf/scorecard-action
  dependency-version: 2.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
- dependency-name: github/codeql-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
* chore(deps-dev): Bump vitest from 2.1.9 to 3.2.6

Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 2.1.9 to 3.2.6.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 3.2.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix

* fix

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mac Anderson <mac@oxagen.sh>
Replaces #18 — the Dependabot branch accumulated lockfile conflicts after
the vitest-3.x and typescript-7 merges landed on main. This reapplies the
same two patch bumps (biome 2.5.2->2.5.4, tsx 4.19.2->4.23.1) on a clean
base with a freshly-regenerated lockfile.
…end (#20)

Harness (TypeScript):
- parse: brace-matched envelope scan so pretty-printed JSON (gemini-cli)
  parses; line-based JSONL scan kept as the first pass
- adapters/base: kill the whole process group on timeout (agents spawn
  subprocesses that held the stdio pipes open past the cap); settle on
  "exit" with a drain grace; cache version (was two spawns per trial)
- orchestrator: drop dead loadPricing call and module-level pricing
  cache (load once, pass down); timeout now takes precedence over a
  post-kill test pass; pass taskDir through AdapterRunArgs instead of
  the MockAdapter.currentTaskDir mutable static
- workspace: async fs/child_process APIs (no event-loop blocking inside
  the async run loop); disable commit.gpgsign in seeded repos
- report: aggregate via perAgentSummary (was duplicated inline math that
  contradicted summary.ts's single-source-of-truth contract); no more
  NaN cells when an agent has zero scored trials
- cli: validate numeric flags instead of silently running with NaN
- METHODOLOGY: document timeout precedence

Harbor adapter (Python):
- remove dead tomli fallback (package requires Python >= 3.12)
- frozen dataclasses for specs and parsed metrics; validate metrics.kind
- collections.abc.Mapping; class-level _agent_output/_spec defaults;
  tolerate float ARENA_TIMEOUT values
- add ruff (lint config in pyproject, run in CI); fix all findings

Branding + site:
- black & white stadium mark (nested geometric stadium shapes), IBM Plex
  type, all-neutral palette; static site under web/ for arena.oxagen.sh
- logo assets in assets/, logo in README
The arena and stella repositories moved from the oxageninc org to the
macanderson account; point all badges, links, and package metadata at
the new home.
…ch paper (#22)

* fix: verification integrity, metric honesty, and CLI hardening

Highest-severity first:
- Timeouts kill the agent's whole process tree (POSIX process groups);
  trials can no longer hang on pipes held by orphaned grandchildren,
  and survivors can no longer tamper with held-out verification.
- Zero-token (unparseable-envelope) trials are excluded from token/cost
  medians and deltas instead of dragging them toward zero past the gate.
- claude-code preserves full model ids (no floating "sonnet" alias), so
  version pinning, matchedModels, and pricing lookups hold.
- Gemini normalization counts thoughts (reasoning) and tool tokens.
- Pretty-printed JSON envelopes parse (TS + Harbor Python mirror).
- Per-trial error containment + incremental results.json; wall clock
  measures spawn-to-exit only; git-diff failure is "unknown", never
  "empty"; report table shares perAgentSummary with the gate (no NaN).
- CLI: -o short flag (as documented), strict numeric flags, unknown
  verify ids error, duplicate agent specs rejected, typo'd gate
  thresholds error instead of silently disabling the check.
- Cost with unpriced cache writes is null, never guessed.
- Harbor: float-tolerant ARENA_TIMEOUT (never silently unbounded),
  loud empty-{budget} failure, metrics.kind validated at load.


* feat(site): arena.oxagen.sh landing page + Agent Benchmark Protocol draft

Static site (site/) for arena.oxagen.sh: landing page with the
matched-model scoreboard, and the ABP design spec. Spec source lives at
docs/agent-benchmark-protocol.md: four interchange schemas (task, run,
trace, verdict), the live GitHub-issue task pipeline with golden traces,
smallest-normalized-diff scoring, conformance levels, and roadmap.


* docs: The State of Agent Benchmarking (paper) + site rendering

Research paper surveying the July 2026 agent-benchmark landscape through
the engine-vs-model lens: 28 cited references, gap analysis of four
capabilities (matched-model isolation, efficiency grading, statistical
CI gating, live tasks with golden traces), COI disclosed. Markdown
source in docs/, rendered at arena.oxagen.sh/paper/. README links the
site, paper, and spec.


* docs: architecture map (module graph, trial data flow, contracts)
Bumps the npm-dev group with 1 update: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@biomejs/biome` from 2.5.4 to 2.5.5
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.5/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dev
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 26, 2026
@dependabot
dependabot Bot requested a review from macanderson as a code owner July 26, 2026 22:52
@dependabot dependabot Bot added the javascript Pull requests that update javascript code label Jul 26, 2026

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @dependabot[bot], you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

dependabot Bot and others added 2 commits July 29, 2026 21:09
Updates the requirements on [harbor](https://github.com/harbor-framework/harbor-cookbook) to permit the latest version.
- [Commits](https://github.com/harbor-framework/harbor-cookbook/commits)

---
updated-dependencies:
- dependency-name: harbor
  dependency-version: 0.20.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@macanderson
macanderson enabled auto-merge (squash) July 30, 2026 04:09
auto-merge was automatically disabled July 30, 2026 04:10

Invalid email address

@macanderson
macanderson force-pushed the dependabot/npm_and_yarn/npm-dev-2c95e5faeb branch from 30e4450 to 416dcbc Compare July 30, 2026 21:58
@dependabot @github

dependabot Bot commented on behalf of github Jul 30, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/npm-dev-2c95e5faeb branch July 30, 2026 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant