fix(deps): update all non-major dependencies by AdamXweb · Pull Request #125 · privacykey/privacytracker

AdamXweb · 2026-07-12T21:58:58Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@biomejs/biome (source)	`2.5.2` → `2.5.5`	devDependencies	patch
@playwright/test (source)	`1.61.1` → `1.62.0`	devDependencies	minor
@storybook/addon-a11y (source)	`10.5.0` → `10.5.4`	devDependencies	patch
@storybook/addon-docs (source)	`10.5.0` → `10.5.4`	devDependencies	patch
@storybook/nextjs (source)	`10.5.0` → `10.5.4`	devDependencies	patch
actions/checkout	`v7.0.0` → `v7.0.1`	action	patch
actions/setup-node (changelog)	`48b55a0` → `2499707`	action	digest
crowdin/github-action (changelog)	`52aa776` → `c7af9bc`	action	digest
docker/build-push-action (changelog)	`f9f3042` → `53b7df9`	action	digest
docker/login-action (changelog)	`650006c` → `abd2ef4`	action	digest
docker/metadata-action (changelog)	`80c7e94` → `dc80280`	action	digest
docker/setup-buildx-action (changelog)	`d7f5e7f` → `bb05f3f`	action	digest
github/codeql-action (changelog)	`5e31633` → `e4fba86`	action	digest
libc	`0.2.186` → `0.2.189`	dependencies	patch
marked (source)	`18.0.6` → `18.0.7`	dependencies	patch
next (source)	`16.2.11` → `16.2.12`	dependencies	patch
next-intl (source)	`4.13.0` → `4.13.4`	dependencies	patch
node (source)	`24.15.0-alpine` → `24.18.0-alpine`	final	minor
node (source)	`24.15.0-alpine` → `24.18.0-alpine`	stage	minor
pnpm (source)	`11.1.2` → `11.17.0`		minor
pnpm (source)	`11.1.2` → `11.17.0`	packageManager	minor
pnpm (source)	`11.1.2` → `11.17.0`	uses-with	minor
react (source)	`19.2.7` → `19.2.8`	dependencies	patch
react-dom (source)	`19.2.7` → `19.2.8`	dependencies	patch
renovatebot/github-action	`v46.1.18` → `v46.1.20`	action	patch
serde (source)	`1.0.228` → `1.0.229`	dependencies	patch
serde_json	`1.0.150` → `1.0.151`	dependencies	patch
storybook (source)	`10.5.0` → `10.5.4`	devDependencies	patch
tauri-plugin-log	`2.8.0` → `2.9.0`	dependencies	minor
tsx (source)	`4.23.0` → `4.23.1`	devDependencies	patch
ultracite (source)	`7.8.4` → `7.9.4`	devDependencies	minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.5`

Compare Source

Patch Changes

#10972 ab8c21b Thanks @ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:
```
declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}
```
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:
```
type Recursive = Recursive;
declare const value: Recursive;

String(value);
value || "fallback";
```
#10977 0bf7486 Thanks @ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.
#10957 cf263c4 Thanks @dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.
#10983 edc0ed7 Thanks @ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

#10889 89526e3 Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

- A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @&#8203;KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @&#8203;keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @&#8203;CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @&#8203;container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

#10964 794ccd0 Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.
```
-a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }
```
#10993 b7a9694 Thanks @denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.
```
-.before > /* comment */ .after {}
+.before /* comment */ > .after {}
```
It now also keeps selectors with escaped newlines in attribute values inline when they fit.
```
-div
-  span[foo="bar\
+div span[foo="bar\
 value"] {}
```
#10978 8ebafe1 Thanks @ematipico! - Fixed #10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".
#10901 68c10e6 Thanks @Socialpranker! - Fixed #10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.
#10936 7df46f5 Thanks @ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.
#10941 f787725 Thanks @siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.
#10969 72d309b Thanks @ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.
e62f6b6 Thanks @ematipico! - Fixed #10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.
#10931 899c60d Thanks @ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.
#10904 ceee4f4 Thanks @qzwxsaedc! - Fixed #10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:
```
import type Types from "./types";

declare function parse(): Types.Result<string>;
const result = parse();
if (!result.success) {
}
```
#10962 f0a67f2 Thanks @ematipico! - Biome no longer removes embedded styles and scripts in HTML files.
#11000 5039a1e Thanks @ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.
#10957 cf263c4 Thanks @dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.
#10992 4bf9b21 Thanks @ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

For example, the following callback is now reported.
```
declare function consume(...args: [number, () => void]): void;
const prefix: [number] = [1];

consume(...prefix, async () => {});
```
#10915 b3b12b3 Thanks @Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

The rule provides an unsafe fix that flips the operator.
```
// Invalid
!foo === bar;
!foo !== bar;

// Valid
foo !== bar;
foo === bar;
```
#10970 bd1038b Thanks @ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:
```
declare function consume(kind: "async", callback: () => Promise<void>): void;
declare function consume(kind: "sync", callback: () => void): void;
consume("sync", async () => {});
```
#10933 48a4abb Thanks @ematipico! - Fixed useArrayFind to recognize bigint zero indexes.
#10931 899c60d Thanks @ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.
#10969 72d309b Thanks @ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:
```
declare const value: unknown;

async function consume() {
  await value;
}
```

`v2.5.4`

Compare Source

Patch Changes

#10665 55ff995 Thanks @dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.
#10894 f4fb10e Thanks @ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.
#10939 f2799db Thanks @Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.
#10945 ae15d98 Thanks @Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.
#10842 5e1abfe Thanks @JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.
#10891 ecca79e Thanks @ematipico! - Fixed #10885: prevented a module-inference regression introduced by a housekeeping change.

#10886 60c8043 Thanks @dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

- test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

#10895 01a85f0 Thanks @ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

`v2.5.3`

Compare Source

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.
#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.
#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().
#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.
#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0]() more accurately.
#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.
#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.
#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.
#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.
#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.
#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.
#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

microsoft/playwright (@playwright/test)

`v1.62.0`

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

New apiResponse.timing() returns resource timing information for an API response.

Evaluation

New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
page.evaluate() and related methods now accept functions as evaluate arguments.
page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

⚠️ Debian 11 is not supported anymore.

Browser Versions

Chromium 151.0.7922.34
Mozilla Firefox 153.0
WebKit 26.5

This version was also tested against the following stable channels:

Google Chrome 151
Microsoft Edge 151

storybookjs/storybook (@storybook/addon-a11y)

`v10.5.4`

Compare Source

ReactNative: Telemetry framework detection fix - #35560, thanks @ndelangen!
SyntaxHighlighter: Fix PrismJS dark mode mismatch - #35541, thanks @hxy-asdw!

`v10.5.3`

Compare Source

Dependencies: Upgrade TypeScript to 6.0.3 - #34971, thanks @valentinpalkovic!

`v10.5.2`

Compare Source

TanStack: Fix createServerFn validator mock - #35185, thanks @sjh9714!
TanStack: Support pathless layout routes (id-only) in story routing - #35465, thanks @unpunnyfuns!
Tanstack-react: Add missing Hydrate export - #35111, thanks @arun-357!
Tanstack-react: Keep JSX-only component references during dead-code elimination - #35206, thanks @yatishgoel!
Vitest: Fix coverage toggle crash on Vite 6 by clearing closed Vitest instance on restart - #35461, thanks @yannbf!

`v10.5.1`

Compare Source

Angular-Vite: Drop @angular/platform-browser-dynamic peer dependency - #35457, thanks @valentinpalkovic!
Angular-Vite: Widen TypeScript peer dependency range to support TypeScript 6 - #35455, thanks @valentinpalkovic!
Core: Include chromatic packages in ecosystem identifier - #35170, thanks @yannbf!

actions/checkout (actions/checkout)

`v7.0.1`

Compare Source

Skip running unsafe pr check if input is default by @aiqiaoy in #2518
Trim only ascii whitespace for branch by @aiqiaoy in #2521
Escape values passed to --unset by @aiqiaoy in #2530
Various dependency updates

rust-lang/libc (libc)

`v0.2.189`

Compare Source

Added

Emscripten: Add pthread_sigmask, sigwait, sigwaitinfo, sigtimedwait, faccessat, and pthread_kill (#5270)
Linux SPARC: Enable the clone3 syscall (#4980)
Solarish: Add CLOCK_PROCESS_CPUTIME_ID and CLOCK_THREAD_CPUTIME_ID (#5274)

Deprecated

Deprecate CLONE_INTO_CGROUP and CLONE_CLEAR_SIGHAND. These overflow their types and will be changed to a larger size in the future. (8c6e6710458d)

Fixed

Musl riscv32: Rename padding fields to avoid a conflict and fix the build (2499ff0ad993)
NuttX: Fix wchar_t definition under Arm (#5245)
Windows: Add back link names for time-related symbols (#5300)

`v0.2.188`

Compare Source

Changed

Restore Send and Sync for DIR (35b062263401)

These were removed in 0.2.187 because libc does not actually make Send and Sync
guarantees about DIR (or other extern types), but this caused some crates to break.
The traits are added back for now to allow time to migrate, but will be removed again
in the future; please make sure your crates are not relying on libc::DIR: Send or
libc::DIR: Sync.

`v0.2.187`

Compare Source

This release contains a number of improvements related to 64-bit time_t configuration.
Of note the existing RUST_LIBC_UNSTABLE_* environment variables have been replaced
with configuration options. The new way to use these is:

RUSTFLAGS='--cfg=libc_unstable_musl_v1_2_3' cargo ...
RUSTFLAGS='--cfg=libc_unstable_gnu_time_bits="64"' cargo ...

Being able to set this via RUSTFLAGS makes it easier to only apply configuration to
specific targets (and notably, not the host if build scripts are used).

There are two other notable changes:

The 32-bit windows-gnu targets now respect libc_unstable_gnu_time_bits
uClibc now supports a similar configuration option:
```
RUSTFLAGS='--cfg=libc_unstable_uclibc_time64'
```

As a reminder, these options are under active development and may change in the future
(hence the "unstable" in the name). It likely that we will harmonize everything under a
single configuration option before considering them stable.

Support

Add support for aarch64-unknown-linux-pauthtest (#5065)
Add support for new QNX targets (#5241)
Better document breaking change policy and recommended usage (#5179)

Added

Android: Add POSIX_SPAWN_* constants (#5104)
Android: Add getpwent, setpwent, and endpwent (#5160)
Android: Add preadv2 and pwritev2 (#5157)
Android: Add seccomp_notif* structures (#5224)
Android: Add timer_[create, delete, getoverrun, gettime, settime] (#5108)
Apple: Add PROC_PIDT_SHORTBSDINFO and proc_bsdshortinfo (#5110)
Apple: Add SIOC* constants from sockio.h (#5263)
Apple: Add _IOR, _IOW, _IOWR (#5264)
Apple: Add bpf_program and bpf_insn (#5235)
Apple: Add additional kqueue constants (#5077)
Apple: Update vm_statistics64 with recently added fields (#5253)
Apple: add IN6_IFF_* and SIOCGIFAFLAG_IN6 (#5239)
Dragonfly: Add O_*, POSIX_FADV_*, NI*, and a few other missing constants (#5116)
Dragonfly: add fdatasync, dlvsym, reallocarray, qsort_r, pthread_*affinity_np, ftok, extattr_*, and dup3 (#5116)
Emscripten: Add in6_pktinfo (#5256)
FreeBSD: Add SOL_LOCAL (#5185)
FreeBSD: Add DLT_* constants (#5235)
FreeBSD: Add PROC_LOGSIGEXIT_* and PPROT_* (#4657)
FreeBSD: Add SO_RERROR (#5260)
FreeBSD: add IN6_IFF_*, in6_ifreq, and SIOCGIFAFLAG_IN6 (#5239)
FreeBSD: add _IO* helpers from sys/ioccom.h (#5239)
Glibc: Add PTHREAD_*_MUTEX_INITIALIZER_NP for riscv64 (#5094)
Glibc: Add new fields to struct tcp_info (#5215)
Linux: Add OPEN_TREE_NAMESPACE (#5145)
Linux: Add SECCOMP_IOCTL_* constants (#5224)
Linux: Add SO_DETACH_REUSEPORT_BPF (#5081)
Linux: Add futex_waitv (#5125)
Linux: Add constants for fsopen, fsconfig, fsmount, and fspick (#5145)
Linux: Add fields to statx present since 6.16 (#4621)
Linux: Add network entry API (#5049)
Linux: add ifaddrmsg and rtattr (#5234)
Linux: add sockaddr_iucv (#5041)
MacOS: Add ENOTCAPABLE (#4925)
Musl: Add renameat2 (#5113)
NuttX: Add F_SETFD (#5258)
NuttX: Add POLLRD* and POLLWR* constants (#5258)
NuttX: Add SO_KEEPALIVE and TCP keepalive constants (#5111)
NuttX: Add TCP_MAXSEG (#5258)
NuttX: Add eventfd and EFD_* constants (#5258)
NuttX: Add pipe2 (#5258)
NuttX: Add strerror_r (#5258)
NuttX: Add netinet structs and constants (#5258)
NuttX: Add socket structs, functions and constants (#5258)
QuRT: Add POSIX timer functions (#5091)
QuRT: Add missing pthread functions from QuRT SDK headers (#5091)
QuRT: Add missing unistd process and file functions (#5091)
QuRT: Add mqueue subsystem (message queues, select/pselect) (#5091)
Redox: Add *at and dirent functions (#5117)
Solarish: Add IP TTL and IPv6 Hop Limit consts (#5089)
Solarish: Add port_alert and PORT_ALERT* constants (#5203)
Solarish: add AI_CANONNAME (#5085)
aarch64: Add SYS_sendfile and SYS_fadvise64 constants (#5133)

Deprecated

Dragonfly: Deprecate compatibility aliases CPUCTL_RSMSR and UTX_DB_LASTLOG ([#5116](https://redirect.github.com/rust-la

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Australia/Melbourne)

Branch creation
- "before 9am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

adamXbot · 2026-07-18T16:07:39Z

⚠️ Hold — don't merge while this pins pnpm 11.12.0. The dependency payload itself tests fine (details below); the problem is that pnpm@11.12.0 turned out to be a broken upstream release, and it's the single root cause of every red check on this PR.

Diagnosis

quality / storybook / CodeQL-JS / preview-image all die during pnpm bootstrap with [ERROR] Cannot use 'in' operator to search for 'integrity' in undefined — before any project code runs. I re-ran the failed jobs today: identical failure, so it's deterministic, not flaky.
Reproduced locally: any other pnpm version that reads "packageManager": "pnpm@11.12.0" crashes while self-switching to it. Switch-target matrix (from pnpm 11.1.2): 11.11.0 ✅ · 11.12.0 ❌ · 11.13.0 ✅ · 11.13.1 ✅ · 11.14.0 ✅
pnpm ≥ 11.14 now refuses it outright: "pnpm v11.12.0 is a broken release and cannot be installed. Its @pnpm/exe build shipped without a binary."
Merged as-is, this would also break local dev (any pnpm command crashes unless you're already on exactly 11.12.0) and Docker builds (the Dockerfile bootstraps ARG PNPM_VERSION=11.1.2, which then crashes switching to 11.12.0).

The actual updates are healthy — verified locally by invoking pnpm 11.12.0 directly (the release works once running; only switching to it is broken): frozen install ✅ · lint on biome 2.5.3 + ultracite 7.9.3 ✅ · typecheck ✅ · i18n parity ✅ · 442 tests, 0 fail ✅ · production build on next 16.2.10 ✅ · cargo metadata --locked OK (tauri 2.11.5) ✅. Note: this PR bumps js-yaml to 4.3.0 (fixes alert #18) but does not touch serde_with — alert #19 is fixed by #126.

Path forward: tonight's scheduled Renovate run (cron 0 21 * * 0, Sun 21:00 UTC) should refresh this branch to pnpm 11.14.0 — merge once CI goes green after that. To force it sooner: tick the rebase checkbox above and dispatch the Renovate workflow with dryRun: null. Either way, merge #126 first; this PR will be rebased over it automatically.

Follow-up worth filing: Renovate doesn't manage ARG PNPM_VERSION in the Dockerfile (left at 11.1.2 while packageManager/workflows moved to 11.12.0 — exactly the drift the Dockerfile's own comment warns against). A customManagers regex in renovate.json would keep it in lockstep.

Tested via Claude Code

adamXbot · 2026-07-23T04:06:30Z

❌ Not ready to merge — but the deps themselves are healthy

Tested locally on macOS (Node 26.3.1): pnpm install --frozen-lockfile ✅ (lockfile is consistent), pnpm typecheck ✅, pnpm test ✅ 438/438. The failing quality job is not a dependency regression — it dies at the lint step.

1. Lint failure: ultracite 7.8.4 → 7.9.4 enables new rules (5,537 errors)

The new preset turns on rules the codebase doesn't conform to:

rule	count
`assist/source/useSortedKeys`	3,526
`lint/performance/noJsxPropsBind`	682
`lint/suspicious/noLeakedRender`	434
`lint/suspicious/noUnnecessaryConditions`	405
`noIncrementDecrement`, `useDestructuring`, `noAwaitInLoops`, …	~450

Control run: same file set on main's ultracite 7.8.4 → 0 errors. Only part of these are safe-autofixable (useSortedKeys); noJsxPropsBind/noLeakedRender would need real refactors. Decision needed: either add the new rules as off overrides in biome.jsonc (matching the existing documented-override pattern there), or pin ultracite back with a Renovate packageRule. Until then this PR can't go green.

2. Branch is stale in ways that matter

next is bumped to 16.2.10, but 16.2.11 (published 2026-07-21) is a security release fixing 4 high + 5 moderate advisories (pnpm audit --prod flags them all: middleware/proxy bypass, SSRF in Server Actions, DoS, cache confusion). Merging as-is still leaves us vulnerable.
Dockerfile ARG PNPM_VERSION stays 11.1.2 while everything else moves to 11.15.0 — the exact drift f07e0e8 guards against; that fix only reached main today (via ci: teach Renovate to bump the Dockerfile ARG PNPM_VERSION #128), after this branch was last regenerated.
The actions/cache "digest update" here is actually a downgrade. Main's pin 55cc834 is mislabeled # v5 — it's really the v6.1.0 commit. Renovate trusts the comment, so this PR "updates" it to caa2961 (v5.1.0), i.e. backwards. Merging chore(deps): update actions/cache action to v6 #129 first (comment-only fix) makes this entry disappear on the next rebase.

Suggested path

Merge chore(deps): update actions/cache action to v6 #129 first.
Decide the ultracite rule policy on main (biome.jsonc overrides or version pin).
Trigger a live Renovate run (Actions ▸ Renovate ▸ Run workflow with dryRun: null) rather than waiting for Sunday's cron — the regenerated PR picks up next 16.2.11, the Dockerfile ARG bump, and drops the cache downgrade in one go.

🤖 Generated with Claude Code

adamXbot · 2026-07-28T11:59:50Z

Tested this locally against main. The dependency payload is healthy — the blocker is the lint bump inside it, which I've split out to #142.

What passes (merged main in locally, only pnpm-lock.yaml conflicted; pnpm resolves lock conflicts natively and the postcss ^8.5.18 override survives):

pnpm 11.17.0 self-switches cleanly — worth stating explicitly given 11.12.0 was a broken upstream release
Resolved: next 16.2.12, next-intl 4.13.4, postcss 8.5.23, sharp 0.35.3; pnpm audit --prod clean
typecheck, 441 unit tests, i18n parity, production build, cargo check --locked
Full Playwright suite 41/41
The app runs: all five /api/ready checks ok, /welcome serves 200, fonts + brand icon serve, zero errors in the server log. Drove the reset/focus/seed/profile/flag-override APIs end-to-end and the UI renders correctly.

The blocker: ultracite 7.8.4 → 7.9.4 and Biome 2.5.2 → 2.5.5 enable 15 new rules → 5,532 diagnostics across 609 files, so the quality job fails at "Lint and format check". Nothing to do with the packages this PR is actually here to update.

#142 adopts those two versions on their own, fixes the 2 genuine defects they caught (an unsafe optional chain that would throw instead of failing an assertion), and documents a per-rule policy for the rest — including two that are actively unsafe to auto-apply here (useSortedKeys would break snapshot byte-identity; noAwaitInLoops would parallelise deliberately rate-limited scraping).

Once #142 merges, rebase this — its Biome/ultracite entries become a no-op and the rest should go green on its own.

🤖 Generated with Claude Code

# Conflicts: # pnpm-lock.yaml

adamXbot · 2026-07-29T14:25:50Z

Re-tested against current main (now including #142 and #143). The lint blocker is gone — this is clean and just needs a rebase.

Merged main in locally: only pnpm-lock.yaml conflicted, and pnpm resolved it natively. Notably .github/workflows/macos-release.yml auto-merged cleanly — this PR's action-SHA bumps and #143's tauri-action v1 migration don't collide, and I confirmed the v1 pin plus uploadUpdaterJson: false / uploadUpdaterSignatures: false all survive.

Your @biomejs/biome (2.5.5) and ultracite (7.9.4) entries now match main exactly, so they become no-ops on rebase — exactly as intended when #142 split them out.

Full results on the merged tree:

Check	Result
`biome check` (609 files)	exit 0 — was 5,532 diagnostics
`pnpm typecheck`	clean
`pnpm test`	441 pass / 0 fail
`pnpm lint:i18n`	parity, 4,763 keys
`pnpm audit --prod`	no known vulnerabilities
`cargo check --locked`	clean
Production build	succeeds
Playwright suite	41/41 pass
App boots	all 5 `/api/ready` checks ok, `/welcome` 200, assets 200, zero server errors

Resolved versions: next 16.2.12, next-intl 4.13.4, postcss 8.5.23, sharp 0.35.3. pnpm 11.17.0 self-switches cleanly (worth stating given 11.12.0 was a broken upstream release).

Please rebase — I deliberately haven't pushed to this branch, since a foreign commit would stop Renovate from managing it. Tick the rebase box in the PR description, or let the next scheduled run pick it up.

🤖 Generated with Claude Code

adamXbot · 2026-07-30T08:32:37Z

Pushed 706b08d — main merged in, conflict resolved. This PR is now mergeable.

To be transparent about touching a Renovate-managed branch: I'd initially held off because a foreign commit stops Renovate refreshing a branch. That reasoning doesn't apply here — once this merges the branch is consumed, Renovate sees the deps are current in main, and anything newer arrives as a fresh PR on a fresh branch. The earlier caution was from when this PR still needed Renovate to keep updating it.

The pushed commit is the exact tree I tested in the previous comment — not a re-resolution — so CI is validating the same bytes. Only pnpm-lock.yaml conflicted; pnpm regenerated it. .github/workflows/macos-release.yml auto-merged cleanly, and I verified #143's tauri-action v1 pin plus uploadUpdaterJson: false / uploadUpdaterSignatures: false all survive.

Resolved: next 16.2.12, next-intl 4.13.4, biome 2.5.5, ultracite 7.9.4, pnpm 11.17.0, postcss 8.5.23, sharp 0.35.3.

🤖 Generated with Claude Code

AdamXweb added the dependencies Pull requests that update a dependency file label Jul 12, 2026

adamXbot mentioned this pull request Jul 18, 2026

chore(deps): lock file maintenance #126

Merged

1 task

adamXbot mentioned this pull request Jul 19, 2026

ci: teach Renovate to bump the Dockerfile ARG PNPM_VERSION #128

Merged

AdamXweb force-pushed the renovate/all-non-major branch from add64b9 to d97fe4e Compare July 19, 2026 21:59

adamXbot mentioned this pull request Jul 23, 2026

chore(deps): update actions/cache action to v6 #129

Merged

1 task

fix(deps): update all non-major dependencies

27da1c3

AdamXweb force-pushed the renovate/all-non-major branch from d97fe4e to 27da1c3 Compare July 26, 2026 22:03

This was referenced Jul 28, 2026

fix(deps): raise the postcss floor to 8.5.18 (unblocks all CI) #141

Merged

chore(lint): adopt Biome 2.5.5 / ultracite 7.9.4 and set policy for its new rules #142

Merged

Merge remote-tracking branch 'origin/main' into test/pr125-v2

706b08d

# Conflicts: # pnpm-lock.yaml

AdamXweb merged commit d058464 into main Jul 30, 2026
16 checks passed

Navigation Menu

Uh oh!

fix(deps): update all non-major dependencies - #125

fix(deps): update all non-major dependencies#125
AdamXweb merged 2 commits into
mainfrom
renovate/all-non-major

AdamXweb commented Jul 12, 2026 •

edited

Loading

Uh oh!

adamXbot commented Jul 18, 2026

Uh oh!

adamXbot commented Jul 23, 2026

Uh oh!

adamXbot commented Jul 28, 2026 •

edited

Loading

Uh oh!

adamXbot commented Jul 29, 2026

Uh oh!

adamXbot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

AdamXweb commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

🧱 New component testing model

🛑 Cancel operations with AbortSignal

🖼️ WebP screenshots

🧩 Custom test filtering with Reporter.preprocess()

🔁 Isolated retries

New APIs

Browser and Context

Actions

Network

Evaluation

Command line & MCP

Reporters

Announcements

Browser Versions

Added

Deprecated

Fixed

Changed

Support

Added

Deprecated

Configuration

Uh oh!

adamXbot commented Jul 18, 2026

Uh oh!

adamXbot commented Jul 23, 2026

❌ Not ready to merge — but the deps themselves are healthy

1. Lint failure: ultracite 7.8.4 → 7.9.4 enables new rules (5,537 errors)

2. Branch is stale in ways that matter

Suggested path

Uh oh!

adamXbot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

adamXbot commented Jul 29, 2026

Uh oh!

adamXbot commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

AdamXweb commented Jul 12, 2026 •

edited

Loading

adamXbot commented Jul 28, 2026 •

edited

Loading