chore(deps-dev): Bump the npm-minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the npm-minor-patch group with 5 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.6	2.5.11
publint	0.3.22	0.3.24
vitest	4.1.10	4.1.11
@types/node	26.1.2	26.4.0
tsx	4.23.1	4.23.13

Updates @biomejs/biome from 2.5.6 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates publint from 0.3.22 to 0.3.24

Release notes

Sourced from publint's releases.

publint@0.3.24

Patch Changes

• #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

publint@0.3.23

Patch Changes

• #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

• #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Changelog

Sourced from publint's changelog.

0.3.24

Patch Changes

• #257 7c4d25a - Check the repository.url value even when repository.type is omitted. type is optional and defaults to git, so packages using the object form without it were previously skipped for the deprecated-protocol, invalid-git-url, and shorthand-URL checks.

0.3.23

Patch Changes

• #248 9ff88ac - Recursively detect test files (e.g. *.test.js, *.spec.ts) for the USE_FILES suggestion.

• #245 ad737a3 - The USE_FILES message now reports which internal files or directories triggered it via args.internalFilePaths

Commits

• 4dc880a Release packages (#254)
• 7c4d25a Check repository.url when repository.type is omitted (#257)
• 6ef01d5 Update dependencies
• d228c3c Release packages (#247)
• 9ff88ac Detect nested test files in USE_FILES check (#248)
• ad737a3 Report which files triggered USE_FILES (#245)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates @types/node from 26.1.2 to 26.4.0

Commits

• See full diff in compare view

Updates tsx from 4.23.1 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[lukaso-bot]

Added a commit to green the osv dependency scan

osv dependency scan was the only failing check here (10 others pass). It was failing on fflate@0.7.4 — GHSA-px8p-9vwx-vf98, osv.dev CVSS 7.5, which scripts/osv-check.sh counts as High and therefore gates on.

This PR did not introduce it. fflate@0.7.4 is already on origin/main, so every open PR in the queue reds on its next re-run, not just this one. Merging this carries the fix to main.

The change (ed5a84a)

One line in pnpm.overrides:

"@shuding/opentype.js>fflate": ">=0.7.5 <0.8.0"

@shuding/opentype.js@1.4.0-beta.0 is the only consumer in the tree (satori → workers-og → web-og's PNG renderer) and it declares fflate: ^0.7.3. 0.7.5 is the highest 0.7.x published (2026-07-20; 0.7.4 is from 2022), so the lockfile was just holding a stale resolution — this is a refresh, not a version held back.

Two deliberate choices:

• Parent-scoped, not a bare fflate key. pnpm overrides are forcible replacements, not intersections, so a workspace-global cap would silently force a future ^0.8.3 requirer down to 0.7.5. The parent>child form confines it to the one real consumer — same shape as the jsdom>undici override directly above it.
• Upper bound at <0.8.0. The advisory has five vulnerable windows and 0.8.0–0.8.2 are vulnerable too (fixed at 0.8.3), so a bare >=0.7.5 would admit them. <0.8.0 also keeps resolution inside opentype.js's own ^0.7.3 contract.

Evidence

check	result
osv-check.sh before	✗ 0 Critical + 1 High (fflate 0.7.4)
osv-check.sh after	✓ no High/Critical
mutant — override forced back to 0.7.4	returns to ✗ ... 1 High
restore	package.json + pnpm-lock.yaml byte-identical (sha256) to the vetted tree
on-disk link	@shuding/opentype.js → fflate@0.7.5
pnpm install --frozen-lockfile	clean (no CI drift)
pnpm validate	pass
web-og workerd render suite	8/8 pass (real PNGs, the path that actually loads fflate)

The lockfile delta is 9 lines and touches nothing but fflate and the overrides: block — the five Dependabot bumps in fe4b816 are untouched.

The independent build review came back clean, no findings. It independently confirmed the gate goes green for the stated reason, that the override scope covers every fflate occurrence, and that every added lockfile resolution is a registry entry with a sha512 integrity hash.

Two things worth your attention

1. This is a hand-authored commit on a Dependabot-owned branch. Dependabot recreates these — it closed chore(deps-dev): Bump the npm-minor-patch group across 1 directory with 4 updates #153 and opened this PR with the same group earlier today. If it recreates the branch before you merge, ed5a84a is dropped and the gate reds again. Nothing breaks silently; the PR just goes red and gets re-applied.
2. hono 4.12.32 was left alone on purpose. Its four advisories are Medium/Low, so they do not gate, and hono is the runtime framework on both Workers — bumping it is a runtime-behaviour change that deserves its own PR and review surface, not a passenger on a dev-dependency bump. Tracked on Dependabot's weekly npm run wedges whenever a patch is 3-7 days old: cooldown default-days (7) exceeds semver-patch-days (3) #161.

After this merges

The other three open PRs (#144, #158, #163) each need a rebase onto main (or a re-run) to pick up the override; until then their next osv run reds on the same fflate finding.

[github-actions]

Preview deployed

• web: https://released-web-preview.lukaso.workers.dev
• og: https://released-web-og-preview.lukaso.workers.dev

Federated GitLab lookups (freedesktop / GNOME) degrade to the "use the CLI" card — the Anubis relay is off in preview. GitHub lookups, permalinks, and OG render work once INTERNAL_SECRET/GITHUB_TOKEN are set on the preview env.

[lukaso-bot]

Preview exercised — the fflate override renders fine in deployed workerd

fflate is not a dev-only dep here: it sits under @shuding/opentype.js, which
workers-og uses to decode fonts. So the override had to be checked in a real
Worker, not only in the local render suite. Ran all three OG paths against the
PR preview (released-web-og-preview.lukaso.workers.dev):

path	status	bytes	valid PNG
/placeholder.png	200	11757	yes
/r/honojs/hono/c/f82aba8e…png	200	14348	yes
/i/honojs/hono/11.png	200	12915	yes

Three distinct byte sizes means text is actually being drawn, so the
opentype.js → fflate@0.7.5 decode path works. A broken decode fails the render
outright, not subtly.

Sizes are below prod's (28899B / 35266B) because the preview og Worker renders
the neutral card — that is #148 (preview /internal unreachable), present before
this PR and unrelated to it.

Nothing else outstanding: 10/10 checks pass, MERGEABLE/CLEAN.

[lukaso-bot]

Review of record for ed5a84a

The pipeline's dispositions normally go in the PR body, but this PR is authored by
Dependabot, so the door could not write them there. Posting them here instead.

Build review: CLEAN, no findings (patch:ca79bcc). It independently re-derived the
advisory ranges rather than trusting my commit message: GHSA-px8p-9vwx-vf98 has five
disjoint vulnerable windows, of which [0.7.0, 0.7.5) and [0.8.0, 0.8.3) are the
relevant two — so >=0.7.5 <0.8.0 lands on a non-vulnerable version and the upper bound
is not over-tight. Verified --frozen-lockfile clean, 4/4 typecheck, 604 tests, build,
lint, and scripts/osv-check.sh green with fflate gone from the table.

Plan review: 5 rounds, 4 dispositions.

#	severity	finding	disposition
1	P1	The mutant step doesn't go red — removing the override leaves fflate at 0.7.5	withdrawn by the reviewer in the confirming round
2	P1	pnpm install --lockfile-only doesn't link, so verification runs against the old fflate	withdrawn by the reviewer in the confirming round
3	P1	Step 5 mutates to the vulnerable pin but never re-runs the gate on the restored tree	withdrawn by the reviewer in the confirming round
4	P2	"Mitigated structurally" overclaims — the cap does bind opentype.js itself	declined, reason below

Why #4 was declined. The finding is correct and the plan's wording overclaimed. It was
declined because every available fix is worse. pnpm overrides are forcible replacements,
not intersections, so widening to >=0.7.5 <0.8.0 || >=0.8.3 makes the resolver pick the
newest match (0.8.x), pushing opentype.js outside the ^0.7.3 it declares — the exact
cross-major jump the parent-scoped form exists to avoid. Dropping the cap re-admits the
vulnerable 0.8.0–0.8.2. The residual hazard needs a future opentype.js (pinned at
1.4.0-beta.0 under satori) to start requiring ^0.8.3. The override is short-lived by
design: 0.7.5 is the highest 0.7.x, so any routine lockfile refresh reaches it
naturally and the line can be deleted. That deletion is the recorded exit.

Two P3s were graded and dropped. One is worth repeating here because it is about the rest
of the queue, not this PR:

After this merges, #158 and #144 each need a branch update before their osv check
clears. They branch from a pre-fix main and carry fflate@0.7.4 in their own
lockfiles; the osv job scans the PR branch's pnpm-lock.yaml with no install, and GitHub
does not re-run a PR's checks when the base branch moves. #163 is github-actions-only and
touches no lockfile, so it is unaffected.