[dependabot]

Bumps the minor-and-patch group with 4 updates in the /frontend directory: @tanstack/react-router, @biomejs/biome, @tanstack/router-plugin and vite.

Updates @tanstack/react-router from 1.170.45 to 1.170.46

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.46

Patch Changes

• #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

• Updated dependencies [32a3360]:

  • @​tanstack/router-core@​1.171.39

Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.46

Patch Changes

• #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

• Updated dependencies [32a3360]:

  • @​tanstack/router-core@​1.171.39

Commits

• 6b9fe6d ci: Version Packages (#8745)
• 32a3360 docs(skills): reference cross-package skills by intent ID (#8670)
• 689a7c5 fix(react-router): publish agent skills (#8671)
• See full diff in compare view

Updates @biomejs/biome from 2.5.15 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

• #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

  console.log("abc ", "def");

• #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

  const items = array.flat(2);

• #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

  let foo = null;

• #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

  function add(item) {
    return items.push(item);
  }

• #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

  const foo = (bar => (bar ? bar.baz : baz))(getBar());

• #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

  function findRoot(node) {
      if (node.parent) {
          return findRoot(node.parent);
      }
      return node;
  }

• #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

• 5653874 ci: release (#12647)
• 824df15 feat(lint): add noVueDeprecatedDeleteSet (#12586)
• 861b288 feat(lint): add noVueUnusedRefs (#12603)
• 2eddda9 feat(lint): add noVueComputedPropertiesInData (#12554)
• 5d7553b feat(lint): add noVueMultipleSlotArgs (#12562)
• de1188f feat(lint): add noVueDeprecatedScopeAttribute (#12631)
• 2e520d8 feat(lint): add noVueMutatingProps (#12513)
• ade9845 feat(lint): add useVueDefineOptions (#12615)
• 6fc1a51 feat(lint): add noVueDeprecatedRouterLinkTagProp (#12648)
• a810209 feat(lint): add useVueValidDefineEmits (#12591)
• Additional commits viewable in compare view

Updates @tanstack/router-plugin from 1.168.47 to 1.168.48

Release notes

Sourced from @​tanstack/router-plugin's releases.

@​tanstack/router-plugin@​1.168.48

Patch Changes

• #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #8737 647cb73 - Remove the enableRouteGeneration option. Route generation now always runs, so autoCodeSplitting always has the route metadata it needs.

• Updated dependencies [32a3360, 689a7c5]:

  • @​tanstack/react-router@​1.170.46
  • @​tanstack/router-core@​1.171.39
  • @​tanstack/router-generator@​1.167.46

Changelog

Sourced from @​tanstack/router-plugin's changelog.

1.168.48

Patch Changes

• #8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

• #8737 647cb73 - Remove the enableRouteGeneration option. Route generation now always runs, so autoCodeSplitting always has the route metadata it needs.

• Updated dependencies [32a3360, 689a7c5]:

  • @​tanstack/react-router@​1.170.46
  • @​tanstack/router-core@​1.171.39
  • @​tanstack/router-generator@​1.167.46

Commits

• 6b9fe6d ci: Version Packages (#8745)
• 647cb73 refactor(router-plugin): remove enableRouteGeneration option (#8737)
• 32a3360 docs(skills): reference cross-package skills by intent ID (#8670)
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view