Bump the npm group across 1 directory with 12 updates by dependabot[bot] · Pull Request #66 · shellicar/ecosystem

dependabot · 2026-07-29T16:38:35Z

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

Bumps the npm group with 12 updates in the / directory:

Package	From	To
@biomejs/biome	`2.4.15`	`2.4.16`
@vitest/coverage-v8	`4.1.6`	`4.1.10`
lefthook	`2.1.6`	`2.1.10`
turbo	`2.9.14`	`2.9.18`
vitest	`4.1.6`	`4.1.10`
@nuxt/kit	`4.4.5`	`4.4.8`
@nuxt/schema	`3.21.5`	`3.21.10`
graphql	`16.14.0`	`16.14.2`
rollup	`4.62.2`	`4.62.3`
tsx	`4.22.0`	`4.22.5`
semver	`7.8.0`	`7.8.5`
svelte	`5.55.7`	`5.55.10`

Updates @biomejs/biome from 2.4.15 to 2.4.16

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes
#10329 ef764d5 Thanks @Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.
#10363 50aa415 Thanks @dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

Input:
ab
Output:
  a</span >bab
#10465 0c718da Thanks @dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

#10358 05c2617 Thanks @dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

#10300 950247c Thanks @dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

#9786 e71f584 Thanks @MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

#10425 1948b72 Thanks @sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

#10442 001f94f Thanks @ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

#10318 9b1577f Thanks @dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

#10319 2e37709 Thanks @dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.4.16

Patch Changes
#10329 ef764d5 Thanks @Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.
#10363 50aa415 Thanks @dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

Input:
ab
Output:
  a</span >bab
#10465 0c718da Thanks @dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

#10358 05c2617 Thanks @dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

#10300 950247c Thanks @dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

#9786 e71f584 Thanks @MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

#10425 1948b72 Thanks @sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

#10442 001f94f Thanks @ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

#10318 9b1577f Thanks @dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.
#10319 2e37709 Thanks @dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Commits

5f4ea56 ci: release (#10326)
de2a33c fix(core): regression in emitted types (#10478)
d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
4f1aaf2 fix: incorrect build when using build or test (#10426)
dc73b6b refactor: make plugins opt-in via feature gate (#10418)
e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
9b1577f fix(config): support trailingCommas in overrides (#10318)
See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.6 to 4.1.10

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

Commits

db616d2 chore: release v4.1.10 (#10718)
a7a61e7 chore: release v4.1.9 (#10598)
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
See full diff in compare view

Updates lefthook from 2.1.6 to 2.1.10

Release notes

Sourced from lefthook's releases.

v2.1.10

Changelog

c0a32e900407bf3e2e97c99a7dd2e3f2864ba13a deps: July 2026 (#1463)

0b87ca6dc643dab804a1aad59c24003ef147c11a deps: June 2026 (#1447)

afce7244cf02abaf996ebe87bb557a725e46993e deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)

fbb61b369b57a17469bd6997d1624608ce977f61 feat: AI coding agents integration (#1448)

cbfb4a5db29b46ac8bf399665cd9ada81022b848 fix: make test suite stable when NO_COLOR is set (#1449)

v2.1.9

Changelog

1d35cbabe1ebaf2a5ed4d2186caa0402de6448e2 chore: add pretty gradient (#1432)

22be6c50e1412c748f3c6b60e9c61cd056dc693b deps: May 2026 (#1415)

1bae568f03dfb88af9185031fa44e9fee285e917 fix: update hooks path after resetting (#1431)

v2.1.8

Changelog

488a5f99a5a496e5837f757f8ce3e6c6d1415792 fix: do not warn if local hooks path is equal to default hooks path (#1421)

v2.1.7

Changelog

f415a9d3fce1d4f6af62622cf96c72e04ecf7bd3 chore: go mod tidy

cf4ab9ea4580f5aeb0d4b61d4dd169533e5bb0c9 fix: always restore unstaged changes (#1416)

4c0e000d6fe9f35f42efefb9263b0b4cb5dfbd49 fix: apply stage_fixed only if it is safe (#1418)

76aa843ef5ceb6970f61cd2ff28d16dd2ec82272 fix: linter, sacrifice optimization for readability

9d53c36ed9a26d3bf66e341a9650a0ecac9b6a37 fix: separate fallback push branch from pathspecs (#1396)

22c9f773cf93b59005bd244c5b00caab2947a755 fix: try to always restore unstaged changes (#1417)

37d83986d8e6d6bf6792f57e22e7cbb1a9e28064 fix: use contrast colors (#1420)

eb1064d0b8c6248627960bea1abf6891db5a21b1 refactor: add new logger without a global state (#1385)

Changelog

Sourced from lefthook's changelog.

2.1.10 (2026-07-08)

deps: July 2026 (#1463) by @mrexox

feat: AI coding agents integration (#1448) by @viralpraxis

docs: fix language (#1453) by @pflanze

fix: make test suite stable when NO_COLOR is set (#1449) by @viralpraxis

deps: June 2026 (#1447) by @mrexox

deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443) by @maguowei

docs: upgrade docmd (#1442) by @mrexox

docs: use single quotes in example to handle filepaths with $ by @mrexox

2.1.9 (2026-05-29)

fix: update hooks path after resetting (#1431) by @mrexox

deps: May 2026 (#1415) by @mrexox

2.1.8 (2026-05-19)

fix: do not warn if local hooks path is equal to default hooks path (#1421) by @mrexox

2.1.7 (2026-05-19)

fix: use contrast colors (#1420) by @mrexox

fix: apply stage_fixed only if it is safe (#1418) by @mrexox

fix: try to always restore unstaged changes (#1417) by @mrexox

fix: always restore unstaged changes (#1416) by @mrexox

refactor: add new logger without a global state (#1385) by @mrexox

fix: linter, sacrifice optimization for readability by @mrexox

fix: separate fallback push branch from pathspecs (#1396) by @lawrence3699

Commits

8d9cfec 2.1.10: add experimental ai hooks
c0a32e9 deps: July 2026 (#1463)
2ceca38 docs: fix links to new beta feature
fbb61b3 feat: AI coding agents integration (#1448)
82a794f docs: fix language (#1453)
cbfb4a5 fix: make test suite stable when NO_COLOR is set (#1449)
0b87ca6 deps: June 2026 (#1447)
afce724 deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)
b9549b8 docs: upgrade docmd (#1442)
0bffc85 docs: use single quotes in example to handle filepaths with $
Additional commits viewable in compare view

Updates turbo from 2.9.14 to 2.9.18

Release notes

Sourced from turbo's releases.

Turborepo v2.9.18

What's Changed

Changelog

release(turborepo): 2.9.17 by @github-actions[bot] in vercel/turborepo#13047

ci: Fetch version.txt via API in docs alias failure notification by @anthonyshew in vercel/turborepo#13050

fix: Harden cache archive symlink restore by @anthonyshew in vercel/turborepo#13051

chore: Remove web UI mode by @anthonyshew in vercel/turborepo#13052

fix: Harden query server file access by @anthonyshew in vercel/turborepo#13053

fix: Confine prune patch paths by @anthonyshew in vercel/turborepo#13054

fix: Prevent git argument injection in SCM refs by @anthonyshew in vercel/turborepo#13055

fix: Strip special mode bits from cache restore by @anthonyshew in vercel/turborepo#13056

fix: Contain incremental cache outputs by @anthonyshew in vercel/turborepo#13057

fix(turborepo): Normalize Windows daemon path hash by @Balance8 in vercel/turborepo#13020

fix: Preserve vt100 cell byte counts by @anthonyshew in vercel/turborepo#13058

fix: Separate artifact signature fields by @anthonyshew in vercel/turborepo#13059

fix: Validate OidHash hex buffers by @anthonyshew in vercel/turborepo#13060

fix: Block self-hosted login URLs from attempting to use Vercel's SSO by @anthonyshew in vercel/turborepo#13061

New Contributors

@Balance8 made their first contribution in vercel/turborepo#13020

Full Changelog: vercel/turborepo@v2.9.17...v2.9.18

Turborepo v2.9.17

What's Changed

Changelog

fix: Keep non-PTY stdin alive for persistent tasks by @anthonyshew in vercel/turborepo#12972

release(turborepo): 2.9.16 by @github-actions[bot] in vercel/turborepo#12970

release(turborepo): 2.9.17-canary.1 by @github-actions[bot] in vercel/turborepo#12973

fix: Add auth HTTP timeouts by @anthonyshew in vercel/turborepo#12976

fix: Detect affected root tasks in query by @anthonyshew in vercel/turborepo#12977

fix: Wait for Windows graceful shutdown by @anthonyshew in vercel/turborepo#12979

release(turborepo): 2.9.17-canary.2 by @github-actions[bot] in vercel/turborepo#12980

test: Skip installs for JSON output fixtures by @anthonyshew in vercel/turborepo#12981

feat: Add Rsbuild examples by @Nsttt in vercel/turborepo#12942

test: Skip installs for single package dry runs by @anthonyshew in vercel/turborepo#12982

test: Skip Corepack setup without installs by @anthonyshew in vercel/turborepo#12983

test: Skip installs for metadata-only Rust tests by @anthonyshew in vercel/turborepo#12985

test: Skip remaining unnecessary fixture installs by @anthonyshew in vercel/turborepo#12986

test: Add final hash contract snapshots by @anthonyshew in vercel/turborepo#12984

test: Trim run logging integration matrix by @anthonyshew in vercel/turborepo#12987

test: Trim affected query integration matrix by @anthonyshew in vercel/turborepo#12988

test: Narrow Windows integration test group by @anthonyshew in vercel/turborepo#12989

test: Trim task dependency integration coverage by @anthonyshew in vercel/turborepo#12990

test: Trim affected integration coverage by @anthonyshew in vercel/turborepo#12991

test: Collapse integration test matrices by @anthonyshew in vercel/turborepo#12992

... (truncated)

Commits

3bdce32 publish 2.9.18 to registry
2a76556 fix: Block self-hosted login URLs from attempting to use Vercel's SSO (#13061)
da8e348 fix: Validate OidHash hex buffers (#13060)
3018717 fix: Separate artifact signature fields (#13059)
34514e2 fix: Preserve vt100 cell byte counts (#13058)
24e2d34 fix(turborepo): Normalize Windows daemon path hash (#13020)
16dc881 fix: Contain incremental cache outputs (#13057)
92e1f8e fix: Strip special mode bits from cache restore (#13056)
f46f896 fix: Prevent git argument injection in SCM refs (#13055)
7f353ca fix: Confine prune patch paths (#13054)
Additional commits viewable in compare view

Updates vitest from 4.1.6 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

browser: Check fs access in builtin commands [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)

vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by @SveLil and @hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in vitest-dev/vitest#10546 (a5180)

browser:

Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10555 (7fb29)

Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in vitest-dev/vitest#10497 and vitest-dev/vitest#10556 (fbc62)

mocker:

Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in vitest-dev/vitest#10548 (2c955)

pool:

Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in vitest-dev/vitest#10543 and vitest-dev/vitest#10564 (934b0)

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

browser:

Disable client cdp API when allowWrite/allowExec: false [backport to v4] - by @hi-ogawa and Codex in vitest-dev/vitest#10450 (e4067)

Remove orphaned Playwright route when same module is mocked via multiple ids [backport to v4] - by @toxik and @Zelys-DFKH in vitest-dev/vitest#10474 (675b4)

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

runner: Limit concurrency per task branch in addition to per leaf callbacks (backport) - by @hi-ogawa in vitest-dev/vitest#10384 (4f0f2)

    View changes on GitHub

Commits

db616d2 chore: release v4.1.10 (#10718)
bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
a7a61e7 chore: release v4.1.9 (#10598)
934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
e61f2dd chore: release v4.1.8
e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
a09d472 chore: release v4.1.7
See full diff in compare view

Updates @nuxt/kit from 4.4.5 to 4.4.8

Release notes

Sourced from @nuxt/kit's releases.

v4.4.8

4.4.8 is a hotfix release to address an issue running the dev server on MacOS.

👉 Changelog

compare changes

🩹 Fixes

vite: Shorter socket name for macOs with tmp fallback (#35265)

kit: Respect type option in findPath (#35272)

deps: Update nuxt/scripts presets (905621594)

nuxt: Revert unhead dependency back to v2 (e6d578fea)

📖 Documentation

Fix many typos (#35266)

Explain static fallback pages (#35277)

Change null to undefined in data-fetching docs to match actual types (#35301)

Fix broken internal links, useAsyncData watch type, and NuxtError type (#35303)

❤️ Contributors

Daniel Roe (@danielroe)

Ali Mahmmoud (@AliMahmoudDev)

Quentin Macq (@quentinmcq)

Pranav Rajeshirke (@Pranav188)

Eduardo San Martin Morote (@posva)

v4.4.7

4.4.7 is a security hotfix release.

👉 make sure to check https://github.com/nuxt/nuxt/security/advisories to view open advisories resolved by this release.

👉 Changelog

compare changes

🩹 Fixes

nitro: Assign noSSR before deciding payload extraction (#35108)

vite: Avoid filtering out dirs with shared prefix from allowDirs (#35112)

nuxt: Use resolve from pathe for buildCache path boundary check (#35111)

nuxt: Prevent sibling-directory traversal in test component wrapper (#35110)

nitro: Pass event data to isValid in dev clipboard-copy listener (#35109)

nuxt: Validate protocols in reloadNuxtApp path before reload (#35115)

vite: Prefix public asset virtuals with null byte (9e303b438)

nuxt: Re-run getCachedData after initial fetch (#35122)

nuxt: Propagate useFetch/useAsyncData factory types (#35133)

vite: Close vite dev server on nuxt close (a10a68abc)

kit,nuxt: Handle cancelling prompts to install packages (e84813229)

kit: Avoid excluding node-context files in legacy tsconfig (#35152)

nuxt: Handle missing payload in chunkError listener (#35155)

nuxt: Await in-lifght template generation when closing nuxt (#35181)

nuxt: Clarify page and layout usage warnings (#35184)

webpack: Surface compilation errors when stats.toString is empty (073b07851)

nuxt: Reject prototype-chain keys in the island registry (#35205)

... (truncated)

Commits

2bfc2c8 v4.4.8
b2ffea3 fix(kit): respect type option in findPath (#35272)
b7d5790 v4.4.7
cf41e1a fix(kit): improve TS extension stripping/substitutions (#35233)
3ec51bb fix(kit): avoid excluding node-context files in legacy tsconfig (#35152)
73525dc chore(deps): update all non-major dependencies (4.x) (#35240)
557ad9d chore(deps): update all non-major dependencies (4.x) (#35180)
5b2c3fc chore(deps): update rolldown (4.x) (#35176)
3ff4065 chore(deps): update all non-major dependencies (4.x) (#35117)
18fb86e refactor(kit,nuxt,vite): use es2023 array methods (#34980)
Additional commits viewable in compare view

Updates @nuxt/schema from 3.21.5 to 3.21.10

Release notes

Sourced from @nuxt/schema's releases.

v3.21.10

⚠️ This is a security release. We recommend upgrading as soon as possible with npx nuxt upgrade --dedupe.

It fixes server-side RCE and unauthorized component instantiation via server island props, a route rule authorization bypass, server component DoS, and dev server path disclosure. Refreshing your lockfile also pulls in @nuxt/devtools@3.3.1, which fixes a separate critical development-only RCE.

If you already upgraded for the earlier route rule advisory (CVE-2026-53721), you still need this release: one of the fixes addresses a regression introduced by that fix.

Full details: Nuxt Security Patch Releases and GitHub Security Advisories.

👉 Changelog

compare changes

🩹 Fixes

nuxt: Clear hide/reset timeouts in set() (#35534)

nuxt: Preserve trailing slash in NuxtLink href when unset (#35501)

vite: Resolve SSR inlined CSS module class name mismatch (#35610)

nuxt: Sync layout meta during middleware on SSR (#35633)

nuxt: Update client URL to match SSR on fatal middleware error (#35637)

nuxt: Watch external component directories in development (#35652)

nuxt: Don't cross-pollute useAsyncData cache on reactive key change (#35656)

nuxt: Return global route for useRoute in detached effect scope (#35659)

nuxt: Ignore custom name or path when reusing an existing page in pages:extend (#35661)

nuxt: Preserve explicit useFetch method inference (#35671)

nuxt: Correct default export detection in plugin metadata (#35676)

nuxt: Reload real page module on HMR of JSX render-function pages (#35678)

vite: Ensure server sourcemap-preserver plugin actually runs (#35680)

nuxt: Resolve @unhead/vue/* from nuxt's dependency tree (#35690)

nuxt: Don't apply scroll behaviour after a subsequent nav (#35719)

vite: Preserve css suffix when extracting ssr inline styles (#35714)

nuxt: Don't exclude client entry module from style extraction (#35720)

kit: Avoid mutating layer configs when resolving options (#35729)

nuxt: Generate layout types even when pages module is disabled (#35717)

nitro: Skip resource hints for stylesheets already rendered as blocking links (#35691)

nuxt: Revalidate cached route payloads instead of using force-cache (#35672)

nuxt: Preserve query params in cached payload extraction (#35696)

rspack,webpack: Resolve loaders and runtime deps from nuxt dirs (#35568)

nuxt: Render client components in nested server components (#35669)

nuxt: Remove dev error overlay when error is cleared (#35821)

rspack,webpack: Resolve bundled postcss defaults from builder (#35823)

schema: Normalise slashes in app.buildAssetsDir (#35833)

nuxt: Case-fold route rule keys to match folded lookups (619963309)

nitro: Require loopback peer for chrome devtools workspace endpoint (00f71bb65)

nitro: Bound island props and v-for to prevent unauthenticated DoS (668cdfdfd)

nuxt: Reject reserved template island prop under runtime compiler (5b60017f7)

nuxt: Reject top-level as prop for islands (00a2b0494)

📖 Documentation

Document relative baseURL workarounds (#34004)

Warn about runtimeCompiler security best practices (b76c1a8bd)

Warn about validating server component props (f6d72628d)

✅ Tests

... (truncated)

Commits

deafc94 v3.21.10
b76c1a8 docs: warn about runtimeCompiler security best practices
0704254 docs: document relative baseURL workarounds (#34004)
591154c fix(schema): normalise slashes in app.buildAssetsDir (#35833)
a2271cc chore(deps): update all non-major dependencies (3.x) (

Bumps the npm group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.4.16` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.6` | `4.1.10` | | [lefthook](https://github.com/evilmartians/lefthook) | `2.1.6` | `2.1.10` | | [turbo](https://github.com/vercel/turborepo) | `2.9.14` | `2.9.18` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.6` | `4.1.10` | | [@nuxt/kit](https://github.com/nuxt/nuxt/tree/HEAD/packages/kit) | `4.4.5` | `4.4.8` | | [@nuxt/schema](https://github.com/nuxt/nuxt/tree/HEAD/packages/schema) | `3.21.5` | `3.21.10` | | [graphql](https://github.com/graphql/graphql-js) | `16.14.0` | `16.14.2` | | [rollup](https://github.com/rollup/rollup) | `4.62.2` | `4.62.3` | | [tsx](https://github.com/privatenumber/tsx) | `4.22.0` | `4.22.5` | | [semver](https://github.com/npm/node-semver) | `7.8.0` | `7.8.5` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.7` | `5.55.10` | Updates `@biomejs/biome` from 2.4.15 to 2.4.16 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.16/packages/@biomejs/biome) Updates `@vitest/coverage-v8` from 4.1.6 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8) Updates `lefthook` from 2.1.6 to 2.1.10 - [Release notes](https://github.com/evilmartians/lefthook/releases) - [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md) - [Commits](evilmartians/lefthook@v2.1.6...v2.1.10) Updates `turbo` from 2.9.14 to 2.9.18 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.9.14...v2.9.18) Updates `vitest` from 4.1.6 to 4.1.10 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest) Updates `@nuxt/kit` from 4.4.5 to 4.4.8 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v4.4.8/packages/kit) Updates `@nuxt/schema` from 3.21.5 to 3.21.10 - [Release notes](https://github.com/nuxt/nuxt/releases) - [Commits](https://github.com/nuxt/nuxt/commits/v3.21.10/packages/schema) Updates `graphql` from 16.14.0 to 16.14.2 - [Release notes](https://github.com/graphql/graphql-js/releases) - [Commits](graphql/graphql-js@v16.14.0...v16.14.2) Updates `rollup` from 4.62.2 to 4.62.3 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.62.2...v4.62.3) Updates `tsx` from 4.22.0 to 4.22.5 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.22.0...v4.22.5) Updates `semver` from 7.8.0 to 7.8.5 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.8.0...v7.8.5) Updates `svelte` from 5.55.7 to 5.55.10 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.55.10/packages/svelte) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: lefthook dependency-version: 2.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: turbo dependency-version: 2.9.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vitest dependency-version: 4.1.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@nuxt/kit" dependency-version: 4.4.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@nuxt/schema" dependency-version: 3.21.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: graphql dependency-version: 16.14.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: rollup dependency-version: 4.62.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: tsx dependency-version: 4.22.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: semver dependency-version: 7.8.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: svelte dependency-version: 5.55.10 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Dependency updates javascript Pull requests that update javascript code labels Jul 29, 2026

Navigation Menu

Bump the npm group across 1 directory with 12 updates - #66

Bump the npm group across 1 directory with 12 updates#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-211b441867

dependabot Bot commented on behalf of github Jul 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.4.16

2.4.16

Patch Changes

2.4.16

Patch Changes

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v2.1.10

Changelog

v2.1.9

Changelog

v2.1.8

Changelog

v2.1.7

Changelog

2.1.10 (2026-07-08)

2.1.9 (2026-05-29)

2.1.8 (2026-05-19)

2.1.7 (2026-05-19)

Turborepo v2.9.18

What's Changed

Changelog

New Contributors

Turborepo v2.9.17

What's Changed

Changelog

v4.1.10

🐞 Bug Fixes

v4.1.9

🐞 Bug Fixes

v4.1.8

🐞 Bug Fixes

v4.1.7

🐞 Bug Fixes

v4.4.8

👉 Changelog

🩹 Fixes

📖 Documentation

❤️ Contributors

v4.4.7

👉 Changelog

🩹 Fixes

v3.21.10

👉 Changelog

🩹 Fixes

📖 Documentation

✅ Tests

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 29, 2026 •

edited

Loading