Update frontend dependencies (dev) by renovate[bot] · Pull Request #375 · DefGuard/proxy

renovate · 2026-08-15T05:03:20Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@biomejs/biome (source)	`2.3.14` → `2.5.10`	devDependencies	minor	`2.5.11`
@floating-ui/react (source)	`0.27.19` → `0.27.20`	dependencies	patch
@inlang/paraglide-js (source)	`2.15.1` → `2.24.1`	devDependencies	minor	`2.25.0`
@inlang/paraglide-js (source)	`2.20.0` → `2.24.1`	dependencies	minor	`2.25.0`
@tanstack/devtools-vite (source)	`^0.5.5` → `0.5.5`	devDependencies	pin
@tanstack/devtools-vite (source)	`^0.3.12` → `0.3.12`	devDependencies	pin
@tanstack/react-devtools (source)	`^0.9.13` → `^0.10.0`	dependencies	minor
@tanstack/react-form (source)	`1.33.0` → `1.33.5`	dependencies	patch
@tanstack/react-query (source)	`5.101.0` → `5.101.4`	dependencies	patch	`5.102.8` (+8)
@tanstack/react-query-devtools (source)	`5.101.0` → `5.101.4`	dependencies	patch	`5.102.8` (+8)
@tanstack/react-router (source)	`1.170.16` → `1.170.31`	dependencies	patch	`1.170.32`
@tanstack/react-router-devtools (source)	`1.167.0` → `1.167.1`	dependencies	patch
@tanstack/router-plugin (source)	`^1.168.18` → `1.168.18`	devDependencies	pin
@types/lodash-es (source)	`^4.17.12` → `4.17.12`	devDependencies	pin
@types/node (source)	`^25.9.4` → `25.9.4`	devDependencies	pin
@types/qs (source)	`^6.15.1` → `6.15.1`	devDependencies	pin
@types/react (source)	`^19.2.17` → `19.2.17`	devDependencies	pin
@types/react-dom (source)	`^19.2.3` → `19.2.3`	devDependencies	pin
@vitejs/plugin-react-swc (source)	`^4.3.1` → `4.3.1`	devDependencies	pin
axios (source)	`1.18.0` → `1.19.0`	dependencies	minor	`1.20.0`
dayjs (source)	`1.11.21` → `1.11.23`	dependencies	patch
globals	`^17.6.0` → `17.6.0`	devDependencies	pin
motion	`12.40.0` → `12.43.0`	dependencies	minor
pnpm (source)	`11.9.0` → `11.22.0`	packageManager	minor	`11.24.0` (+1)
prettier (source)	`^3.8.4` → `3.8.4`	devDependencies	pin
qs	`6.15.2` → `6.15.3`	dependencies	patch
react (source)	`19.2.7` → `19.2.8`	dependencies	patch
react-dom (source)	`19.2.7` → `19.2.8`	dependencies	patch
sass	`^1.101.0` → `1.101.0`	devDependencies	pin
seroval (source)	`1.5.4` → `1.6.2`	pnpm-workspace.overrides	minor	`1.6.4` (+1)
sharp (source, changelog)	`^0.35.0` → `0.35.3`	devDependencies	pin
stylelint (source)	`^17.13.0` → `17.13.0`	devDependencies	pin
stylelint-config-standard-scss	`^17.0.0` → `17.0.0`	devDependencies	pin
stylelint-scss	`^7.2.0` → `7.2.0`	devDependencies	pin
typescript (source)	`~5.9.3` → `5.9.3`	devDependencies	pin
typescript-eslint (source)	`^8.61.1` → `8.61.1`	devDependencies	pin
vite (source)	`^7.3.5` → `7.3.5`	devDependencies	pin
vite-plugin-image-optimizer	`^2.0.3` → `2.0.3`	devDependencies	pin
zustand	`5.0.14` → `5.0.15`	dependencies	patch

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.10`

Compare Source

Patch Changes

#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.
```
<div /* block comment */ class="something"></div>
<Component /* c */ client:load />
```
#11403 8f7786f Thanks @Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.
#11438 3133ffa Thanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.
```
<div>{/* a note */}</div>
<div class={/* a note */}>x</div>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.
```
<div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>
```
#11403 8f7786f Thanks @Princesseuh! - Added support for Astro's fragment shorthand.
```
<>
  <p>a</p>
</>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.
```
---
const a = "</script>";
// </script> in a comment
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.
```

---
this is text, not frontmatter
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block ending early on a line that merely starts with a dash.
```
---
--count;
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed the children of an Astro element carrying is:raw being parsed as markup instead of raw text. This now also covers <script> and <style>, whose contents Astro emits verbatim rather than processing, so they are no longer linted as JavaScript or CSS.
```
<article is:raw><% awesome %></article>
<script is:raw>{{ mustache }}</script>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting attribute names that start with a colon, such as :href.
#11403 8f7786f Thanks @Princesseuh! - Fixed the Astro parser failing to recover from a malformed closing tag such as <div></{<//, so that a later mistake is reported where it happens rather than cascading.
#11403 8f7786f Thanks @Princesseuh! - Fixed { inside an Astro <math> element opening an expression. MathML is foreign content where Astro parses no expressions, so LaTeX such as R^{2x} now survives as text. <svg> is unaffected.
#11403 8f7786f Thanks @Princesseuh! - Fixed {{ at the start of an Astro expression being read as an interpolation. Astro has no {{ }} syntax, so {{ a: 1 }} and <Comp a={{ b: 1 }} /> are object literals.
#11403 8f7786f Thanks @Princesseuh! - Fixed expressions inside an Astro <pre> or <textarea> being read as raw text. Astro parses both as ordinary elements, so their markup and interpolations are now parsed, and a variable used only inside one is no longer reported as unused.
```
<pre>{value}</pre>
<textarea><div>{value}</div></textarea>
```
#11403 8f7786f Thanks @Princesseuh! - Added support for template literal attribute values in Astro, such as <div class=`a ${b} c`>.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting HTML5 unquoted attribute values that contain `, =, ' or ", such as <a href=a=b> and <a href=a'b>.
#11393 dec5a8f Thanks @1678092075! - Fixed #11207: useStrictMode no longer reports Vue event handlers such as @click="count++".
#11431 c065f99 Thanks @levrik! - Fixed #11429: Variables and imports used by Vue same-name bindings such as :disabled or v-bind:disabled are no longer reported as unused.
#11409 405dedb Thanks @ematipico! - Fixed a memory leak in the LSP server where memory usage kept growing over long editor sessions.
#11422 a51eff7 Thanks @dyc3! - Fixed #11416: Biome no longer crashes when parsing incomplete {let} or {const} declarations in Svelte files.
#11378 34b715c Thanks @Netail! - Added extra rule sources from @eslint/css. biome migrate eslint detects rules in your eslint configurations more reliably.
#11403 8f7786f Thanks @Princesseuh! - Fixed {#, {/, {: and {@ being read as Svelte block openings in every HTML-like file. They are now Svelte-only, so in HTML, Vue and Angular files a sequence such as {#if x} is ordinary text instead of a parse error.
#11443 8d45229 Thanks @ematipico! - Fixed #11390: noFloatingPromises no longer performs unnecessary type inference on call arguments when checking methods of non-generic class instances created with new.
#11425 9c2667b Thanks @dyc3! - Fixed #6426: GritQL plugins now match and rewrite metavariables embedded in quoted strings.
#11441 00317c3 Thanks @dyc3! - Improved performance of useNamedCaptureGroup, noMisplacedAssertion, noSkippedTests, noExportsInTest, noDuplicateTestHooks, noIdenticalTestTitle, useTestHooksInOrder, and useTestHooksOnTop.

`v2.5.9`

Compare Source

Patch Changes

#11321 41386f3 Thanks @dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.
#11248 57b197e Thanks @yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.
#11377 a8798ea Thanks @Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.
```
@layer {
  a {
    color: red;
  }
}
```
#11327 6771cf5 Thanks @dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.
```
 <div>
   
+
   
 </div>
```
#10312 ba8aa18 Thanks @dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.
#11333 715e0cd Thanks @kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.
#11343 9b98211 Thanks @johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.
```
@variant @xl {
  div {
    background: red;
  }
}
```
#11220 3e8c488 Thanks @santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

For example, Biome no longer reports greet as undeclared in the following Svelte component:
```
<script module>
  export function greet() {
    console.log("Hello!");
  }
</script>

<script>
  greet();
</script>
```

#11300 36430eb Thanks @dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

- <marquee behavior="alternate"> This text will bounce </marquee>
+ <marquee behavior="alternate">This text will bounce</marquee>

#11299 6559e6c Thanks @jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

For example, <Component client:only /> triggers the rule.
#11365 7529811 Thanks @MHJahanbakhsh! - Fixed #11229: The useGenericFontNames rule now treats math as a valid generic font family.

#11346 674f5f4 Thanks @Jayllyz! - Fixed #11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

function factory() {
  const useColors = true; // no longer reported
  const useStore = createStore({ count: 0 }); // no longer reported
  const useData = () => useState(null); // still reported
  return useColors;
}

#11334 c87c46a Thanks @zkasuran! - Fixed #11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).
#11364 13853b1 Thanks @ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.
#11321 41386f3 Thanks @dyc3! - Fixed #11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

#11325 67c3bf0 Thanks @dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

 <a-long-long-long-element
-  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
+  >foo bar foo bar foo bar foo bar foo bar foo
+  bar</a-long-long-long-element
 >

#11367 fe5b5d4 Thanks @ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.
#11316 17e48d6 Thanks @wanxiankai! - Fixed #11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.
#11254 d25d113 Thanks @dyc3! - Fixed #11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.
#11221 85aac73 Thanks @freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.
```
const value = input as SomeType;
```
#11314 7ffb677 Thanks @ematipico! - Fixed #11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.
#11356 6cd3263 Thanks @johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).
#11318 76059e9 Thanks @johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).
#11357 faa2074 Thanks @johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).
#11344 f34e15c Thanks @johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).
#11324 2f5d452 Thanks @dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.
```
  <div>
-   before<meter value=".5"></meter>
-   after
+   before<meter value=".5"></meter
+   >after
  </div>
```
#11312 e65f07e Thanks @xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.
```
<button />
```
#11364 13853b1 Thanks @ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

#11301 610ee28 Thanks @dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

- <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
+ <video src="brave.webm">
+   <track kind="subtitles" src="brave.en.vtt">
+ </video>

`v2.5.8`

Compare Source

Patch Changes

#10710 0a0fbc1 Thanks @dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.
#11251 ea9dd8a Thanks @dyc3! - Improved performance of noImportCycles.

#11247 52b44d6 Thanks @dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

Invalid:

{#each boxes as box}
  {@const area = box.width * box.height}
  <p>{area}</p>
{/each}

Valid:

{#each boxes as box}
  {const area = $derived(box.width * box.height)}
  <p>{area}</p>
{/each}

#11252 d5f5704 Thanks @Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.
#11143 6be7be1 Thanks @vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.
#11234 caefe39 Thanks @subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.
```
 :root {
   --font-stack:
-/* comment */
+    /* comment */
     system-ui;
 }
```
#11285 bca1f73 Thanks @denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.
```
-:/* comment */ where(div) {}
+:where(/* comment */ div) {}
```
#11080 af16a0b Thanks @dyc3! - HTML style attribute values are now parsed as CSS. All Biome CSS lint rules are applied to the style attributes.
#11195 6a85588 Thanks @dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.

Now the following snippet is correctly parsed:
```
<p>{{ a: true }}</p>
<div class={{ active: isActive }}></div>
```
#11173 481d008 Thanks @Austin1serb! - Fixed #10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.
#11187 23c0369 Thanks @ematipico! - Added the nursery rule noInvalidPropertyInitValue, which reports an @property whose initial-value does not match its syntax descriptor. For example, the following declaration triggers the rule because red is not a <length>:
```
@property --size {
  syntax: "<length>";
  inherits: false;
  initial-value: red;
}
```
#11272 73896e6 Thanks @ematipico! - Improved the diagnostic emitted by noRootType.
#11240 bd0b68d Thanks @ematipico! - Fixed #11223: Improved the
performance of noMisusedPromises
when analyzing async class methods that call other methods through this.
#11172 4a0bc5c Thanks @saberoueslati! - Fixed #10806: noUselessFragments no longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.
#11227 4d603b0 Thanks @saberoueslati! - Fixed #11178: noUndeclaredVariables no longer reports Vue's built-in instance properties, such as $slots and $attrs, in template expressions or $event in inline event-handler expressions. The instance properties are still reported inside <script setup>, where they are not defined.
#11187 23c0369 Thanks @ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

`v2.5.7`

Compare Source

Patch Changes

#10822 c171b3b Thanks @pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.
#11136 e63354c Thanks @AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.
#10094 e007143 Thanks @THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.
#11184 135f476 Thanks @subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.
#8239 a519f9d Thanks @cormacrelf! - Fixed #8233, where Biome CLI in
stdin mode didn't work correctly when handling files in projects with nested
configurations. For example, with the following structure,
--stdin-file-path=subdirectory/... would not use the nested configuration in
subdirectory/biome.json:
```
├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js
```
```
biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js
```
Now, the nested configuration is correctly picked up and applied.

In addition, Biome now shows a warning if --stdin-file-path is provided but
that path is ignored and therefore not formatted or fixed.
#11138 8c2c6bd Thanks @ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:
```
declare function schedule(handler: () => void): string;
declare function
```

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

Branch creation
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added dependencies Pull requests that update a dependency file renovate labels Aug 15, 2026

renovate Bot force-pushed the renovate/dev-frontend-dependencies branch 12 times, most recently from b99dd9f to 5d294d3 Compare August 22, 2026 21:27

renovate Bot force-pushed the renovate/dev-frontend-dependencies branch 4 times, most recently from a64e487 to 525be0b Compare August 26, 2026 17:55

Update frontend dependencies

97beff7

renovate Bot force-pushed the renovate/dev-frontend-dependencies branch 2 times, most recently from 525be0b to 97beff7 Compare August 28, 2026 19:37

Navigation Menu

Uh oh!

Update frontend dependencies (dev) - #375

Update frontend dependencies (dev)#375
renovate[bot] wants to merge 1 commit into
devfrom
renovate/dev-frontend-dependencies

renovate Bot commented Aug 15, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.10

Patch Changes

v2.5.9

Patch Changes

v2.5.8

Patch Changes

v2.5.7

Patch Changes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 15, 2026 •

edited

Loading

`v2.5.10`

`v2.5.9`

`v2.5.8`

`v2.5.7`