chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@biomejs/biome (source)	^2.5.5 → ^2.5.6			devDependencies	patch
@types/react (source)	^19.2.17 → ^19.2.18			devDependencies	patch
@types/react-dom (source)	^19.2.3 → ^19.2.4			devDependencies	patch
area44/workflows	v5.0.2 → v5.1.0			action	minor
fumadocs-core	^16.12.1 → ^16.14.0			dependencies	minor
fumadocs-mdx	^15.2.0 → ^15.2.1			dependencies	patch
fumadocs-ui	^16.12.1 → ^16.14.0			dependencies	minor
lucide-react (source)	^1.26.0 → ^1.28.0			dependencies	minor
next (source)	^16.3.0-preview.9 → ^16.3.0-preview.10			dependencies	patch
postcss (source)	^8.5.23 → ^8.5.25			dependencies	patch

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.6

Compare Source

Patch Changes

• #​11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #​11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #​11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #​9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #​10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #​10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #​11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #​11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #​10533 5809875 Thanks @​Mokto! - Fixed #​10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #​11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@​const ...} or {@​debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #​10858 6d18204 Thanks @​ruidosujeira! - Fixed #​10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #​11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  
  [1, 2, 3].map(async (value) => value);

• #​10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

  function unresolvedReturnType(): MissingType {
    return "value" as const;
  }

• #​11071 15047a2 Thanks @​dyc3! - The HTML parser now accepts mixed-case doctype declarations.

• #​11030 cc90e65 Thanks @​marschattha! - The rdjson reporter now populates the severity field of each diagnostic (ERROR, WARNING, or INFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.

• #​11009 2c36626 Thanks @​ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.

• #​11056 903b177 Thanks @​dyc3! - Added support for Svelte declaration tags using let and const. Biome can now parse, format, and lint bindings declared in these tags.

• #​11045 89c27c6 Thanks @​ematipico! - Improved the performance of Biome formatter up to ~7% across the board.

• #​9806 781d68d Thanks @​dyc3! - Added the nursery rule noJsRestrictedProperties, which ports ESLint's no-restricted-properties rule. Biome now flags restricted member access and object destructuring, and biome migrate eslint preserves the rule's options.

area44/workflows (area44/workflows)

v5.1.0

Compare Source

What's Changed

Full Changelog: area44/workflows@v5.0.2...v5.1.0

lucide-icons/lucide (lucide-react)

v1.28.0

Compare Source

vercel/next.js (next)

v16.3.0-preview.10

Compare Source

Misc Changes

• Unify allow-runtime with Partial Prefetching: #​96106
• Attempt static prefetch before resorting to runtime: #​96095
• Block prefetch task until sufficient response is received: #​96017
• Use a safe clock for Request Insights bookkeeping: #​96274
• Count key length in remaining byte-budgeted LRUs: #​96231
• Serve cached misses from the filesystem route cache: #​96230
• Count URL key length in the filesystem route cache LRU: #​96229
• Turbopack: Only extend the watcher's batch window for unfiltered events: #​96186
• Turbopack: Store watcher batch state with bitflags instead of 4 different sets: #​96114
• docs: document query-only href resolution and fix with-vercel-blob : #​96280
• Micro-optimization for string format: #​95774
• Upgrade React from 28cd4bb0-20260723 to 756fdd47-20260727: #​96270
• [test] Unflake more tests: #​96081
• [test] Run the navigation e2e suite under cacheComponents: #​95877
• [test] Run more test suites under cacheComponents flag, again: #​96196
• [test] Unflake a prefetch-related race: #​96222
• docs(ai-agents): restructure as steps and close 16.2/16.3 coverage gaps: #​96247
• Replace vendored http-proxy with httpxy: #​96060
• Update vendored @mswjs/interceptors to 0.41.9: #​96059
• Track whether runtime data is accessed during prefetch: #​95964
• Add Instant Insights request timing: #​95958
• [turbopack] Tree-shake module.exports = {...} (CJS): #​95996
• [turbopack] Fix de-opt in getChunkRelativeUrl(): #​96183
• Add shell offset to static segment prefetches: #​95963
• Turbopack: support import.meta.glob caseSensitive option: #​96226
• fix(sandbox): release one-shot timeout ids after they run: #​96161
• Fix dev overlay symbolication for project paths needing percent-encoding: #​96221
• [internal] Add a skill for benching changes in a sandbox: #​95943
• Run dev validation in process when using Webpack: #​96219
• Read chunk source maps from disk in the dev validation worker: #​96218
• Retry the source map lookup with a plain path: #​96215
• Pass fallback params to the dev validation worker as maps: #​96210
• [sourcemaps] Reuse source map payloads and consumers across stack frames: #​96198
• fix: release compression stream when client disconnects mid-response: #​96173
• Run Cache Components dev validation on a worker thread: #​96153
• Add a benchmark for dev Cache Components validation on a worker thread: #​96152
• [test] Unflake the enabled-features-trace test suite: #​96175
• [refactor] Prepare dev validation for running on a worker thread: #​96151
• Add the experimental.devValidationWorker config flag: #​96150
• [refactor] Model dev validation render outputs as a discriminated union: #​96149
• Forward dev invalid dynamic usage errors from the render, not validation: #​96148
• Optimize implicit cache tag derivation: #​96120
• Avoid quadratic HMR queue shifts: #​96137
• [sourcemaps] Use file: sourcemaps for Turbopack to improve dev performance: #​95946
• Give RouteCacheEntry a single hidden class across its lifecycle: #​96164
• Keep optimistic-route param handling monomorphic: #​96169
• Store RouteTree slots in a Map to keep slot access monomorphic: #​96168
• Make reifyRouteTree object literals match the canonical RouteTree key order: #​96162
• Keep VaryPath monomorphic by making isRootParam required: #​96122
• docs: expand and modernize the Single-Page Applications guide: #​95860
• docs: navigation interrupts after streaming has started (notFound, forbidden, unauthorized): #​95851
• docs: reframe prefetching around automatic vs. controllable behavior: #​95896
• docs(view-transitions): fix the skill install command: #​96142
• Include additional prerender metadata about build-time routes: #​96080
• Optimize app page entry analysis: #​96058
• [ts-plugin] Preserve TypeScript quick info metadata: #​95863
• [turbopack] Import Webpack's tests for tree-shaking: #​95811
• [turbopack] Drop dead require() calls: #​95718
• [turbopack] Track usage of modules imported with require(): #​95717
• Return plain text 404 for non-document requests to unknown paths: #​95930
• [RSC HMR] Fix a flurry of refetches when a editing component imported from many routes: #​96102
• [turbopack] Track re-exports in import_usage inside of compute_import_usage: #​95989
• Turbopack: Very minor improvements for watcher loop: #​96103
• Turbopack: Refactor watcher event handling and batching logic: #​96087
• fix: remove deprecated url.parse() from custom-server example: #​96105
• Upgrade React from 711c445b-20260722 to 28cd4bb0-20260723: #​96100
• Throw for empty or incomplete generateStaticParams results with output: export: #​95969
• Throw when generateStaticParams returns invalid values: #​95968
• Remove inert experimental.viewTransition flag: #​96098
• Restore partial fallback shell upgrade coverage: #​96096
• fix(next/font/google): bound Google Fonts fetch timeout on Turbopack: #​95981
• Rewrite edge server source map sources in Rust, drop JS fallback: #​95980
• docs: view transitions guide — skill section, source-audit fixes, flag-removal docs: #​96097
• Restore canary version 16.3.0-canary.94 after v16.3.0-preview.9 preview release

Credits

Huge thanks to @​acdlite, @​DavidIlie, @​gaearon, @​bgw, @​icyJoseph, @​jimmyhmiller, @​vercel-release-bot, @​aurorascharff, @​eps1lon, @​timneutkens, @​sampoder, @​petehunt, @​unstubbable, @​marcoshernanz, @​gnoff, @​devjiwonchoi, @​wasim-builds, and @​lukesandberg for helping!

postcss/postcss (postcss)

v8.5.25

Compare Source

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

v8.5.24

Compare Source

• Preserve the BOM after the processing (by @​hdimer).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "on Saturday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.