chore(deps-dev): bump the development-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #9 · OpenPhysics/SolarSystemModels

dependabot · 2026-07-08T20:51:54Z

Bumps the development-dependencies group with 4 updates in the / directory: @biomejs/biome, @types/node, png-to-ico and vitest.

Updates @biomejs/biome from 2.5.2 to 2.5.3

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.3

2.5.3

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

What's Changed

fix(useVueValidVOn): allow verb-modifier-only handlers and object syntax by @otkrickey in biomejs/biome#10773

fix(css_parser): recover CSS Modules syntax at EOF by @WaterWhisperer in biomejs/biome#10815

feat(fmt/yaml): sequence mapping by @ematipico in biomejs/biome#10814

fix(lint): handle TypeScript wrappers in unsafe optional chains by @Aqu1bp in biomejs/biome#10827

fix(lint): report computed member access in noProcessEnv by @JamBalaya56562 in biomejs/biome#10820

ci: ignore quick-xml RustSec advisories by @JamBalaya56562 in biomejs/biome#10831

perf(core): embedded ranges plumbing by @ematipico in biomejs/biome#10836

feat(md/fmt): more compatibility gains by @ematipico in biomejs/biome#10833

chore(xtask): migrate Error global type by @minseong0324 in biomejs/biome#10721

fix(lint): suppress false positives in noUnusedVariables for Svelte store subscriptions and $bindable() props by @Mokto in biomejs/biome#10534

refactor(md/parse): reduce emitted nodes by @ematipico in biomejs/biome#10847

feat(md/fmt): quotes, thematic breaks and link definition by @ematipico in biomejs/biome#10844

refactor(md/parse): parse HTML into one single node by @ematipico in biomejs/biome#10848

docs(noMissingVarFunction): list container-name in ignored properties by @dfedoryshchev in biomejs/biome#10852

refactor(md/parse): fold code content lines and indentation runs by @ematipico in biomejs/biome#10851

fix: astro shorthand syntax embedded nodes by @Netail in biomejs/biome#10853

chore(xtask): migrate disposable global types by @minseong0324 in biomejs/biome#10841

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.3

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.

#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.

#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.

#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.

#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.

#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

Commits

9e1999f chore: revert the revert
0b0fd8d chore: revert
0afa35a ci: release (#10817)
3447b2f feat(useDomQuerySelector): add ignore option (#10835)
See full diff in compare view

Updates @types/node from 26.1.0 to 26.1.1

Commits

See full diff in compare view

Updates png-to-ico from 3.0.1 to 3.0.2

Commits

See full diff in compare view

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

View changes on GitHub

Commits

db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ectory with 4 updates Bumps the development-dependencies group with 4 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [png-to-ico](https://github.com/steambap/png-to-ico) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `@biomejs/biome` from 2.5.2 to 2.5.3 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.3/packages/@biomejs/biome) Updates `@types/node` from 26.1.0 to 26.1.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `png-to-ico` from 3.0.1 to 3.0.2 - [Commits](https://github.com/steambap/png-to-ico/commits) Updates `vitest` from 4.1.9 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: png-to-ico dependency-version: 3.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-07-08T20:51:55Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

github-actions · 2026-07-08T20:52:18Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

npm/@biomejs/biome

2.5.3

Unknown

npm/@biomejs/cli-darwin-arm64

2.5.3

Unknown

npm/@biomejs/cli-darwin-x64

2.5.3

Unknown

npm/@biomejs/cli-linux-arm64

2.5.3

Unknown

npm/@biomejs/cli-linux-arm64-musl

2.5.3

Unknown

npm/@biomejs/cli-linux-x64

2.5.3

Unknown

npm/@biomejs/cli-linux-x64-musl

2.5.3

Unknown

npm/@biomejs/cli-win32-arm64

2.5.3

Unknown

npm/@biomejs/cli-win32-x64

2.5.3

Unknown

npm/@types/node

26.1.1

🟢 6.5

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/29 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@types/node

25.9.5

🟢 6.5

Details

Check	Score	Reason
Code-Review	🟢 8	Found 26/29 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 8	dependency not pinned by hash detected -- score normalized to 8
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed

npm/@vitest/expect

4.1.10

Unknown

npm/@vitest/mocker

4.1.10

Unknown

npm/@vitest/pretty-format

4.1.10

Unknown

npm/@vitest/runner

4.1.10

Unknown

npm/@vitest/snapshot

4.1.10

Unknown

npm/@vitest/spy

4.1.10

Unknown

npm/@vitest/utils

4.1.10

Unknown

npm/png-to-ico

3.0.2

🟢 3.2

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 2/28 approved changesets -- score normalized to 0
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	⚠️ 0	0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
SAST	🟢 7	SAST tool detected but not run on all commits

npm/undici-types

7.24.6

🟢 8.2

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Dependency-Update-Tool	🟢 10	update tool detected
Maintained	🟢 10	30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Binary-Artifacts	🟢 8	binaries present in source code
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Pinned-Dependencies	🟢 6	dependency not pinned by hash detected -- score normalized to 6
Packaging	🟢 10	packaging workflow detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
SAST	🟢 10	SAST tool is run on all commits
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 76 contributing companies or organizations

npm/vitest

4.1.10

Unknown

Scanned Files

package-lock.json

veillette merged commit 6ec8f83 into main Jul 8, 2026
8 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/development-dependencies-4c40ce50ad branch July 8, 2026 21:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the development-dependencies group across 1 directory with 4 updates#9

chore(deps-dev): bump the development-dependencies group across 1 directory with 4 updates#9
veillette merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-4c40ce50ad

dependabot Bot commented on behalf of github Jul 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 8, 2026

Biome CLI v2.5.3

2.5.3

Patch Changes

What's Changed

2.5.3

Patch Changes

v4.1.10

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot Bot commented on behalf of github Jul 8, 2026

Labels

Uh oh!

github-actions Bot commented Jul 8, 2026

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant