chore(deps-dev): bump @biomejs/biome from 2.4.15 to 2.5.10 in the biome group across 1 directory

[dependabot]

Bumps the biome group with 1 update in the / directory: @biomejs/biome.

Updates @biomejs/biome from 2.4.15 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

  <!-- c -->

... (truncated)

Commits

• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​biomejs/​biome@​2.4.15 ⏵ 2.5.10				+1

View full report

[tps-flint]

Diagnosis: this is a config migration plus three autofixes and one real finding

Build (TypeScript strict) is red on bun run lint, not on the compile. Biome 2.5.9 surfaces four things the 2.4.15 pin did not:

biome.json:2:14   $schema still points at 2.4.4        -> biome migrate
biome.json:22:13  "recommended" DEPRECATED, use preset -> biome migrate
test/shell/flair-provision.test.ts:101:24  useIndexOf         FIXABLE
src/capabilities/discord/capability.ts:139:9  useOptionalChain  FIXABLE
src/shell/run.ts:424:9                        useOptionalChain  FIXABLE
test/cli.test.ts:27:19  lint/suspicious/noExplicitAny        <- the only real error

Found 1 error. Found 3 warnings.

biome migrate handles the two config items. biome check --write handles the three marked FIXABLE. That leaves exactly one judgement call: the noExplicitAny in test/cli.test.ts:27.

Worth stating plainly: none of these are caused by the bump. They are pre-existing conditions in the code that the older Biome did not report. The bump is the messenger.

Ask

One explicit ask: land biome migrate + biome check --write, then fix test/cli.test.ts:27 by giving the value a real type. If that genuinely cannot be typed, a narrowly-scoped suppression with a reason is acceptable — a blanket rule disable is not.

Explicitly NOT an ask, so it does not become queued work: not asking for a lint-rule relaxation to make this pass, and not asking for unrelated cleanup in the touched files. Three autofixes and one type.

Check

bun run lint exits 0 and biome.json no longer names a 2.4.x schema — the second half matters because migrating the config is what stops this recurring on the next bump.

Positive control: the fix must not be "the rule stopped running". After the change, lint/suspicious/noExplicitAny must still be capable of failing — verify by confirming the rule remains enabled at error severity rather than downgraded or excluded.

[tps-flint]

Holding this bump — it's a config-compat issue, not a version-safety one (Socket + dependency audit are green; the version itself is fine).

biome 2.5.9 fails biome check . (the lint step in Build) because the repo config predates it:

• biome.json still declares "$schema": ".../2.4.4/schema.json" and uses the deprecated recommended field — needs biome migrate (which rewrites the schema pin + recommended → preset).
• New/changed 2.5.9 rules flag existing code: lint/complexity/useIndexOf, lint/complexity/useOptionalChain (×2), lint/suspicious/noExplicitAny, plus one formatter diff. Most are FIXABLE via biome check --write; noExplicitAny needs a manual touch or an explicit rule decision.

NON-ASK / track-in-the-open: this is blocked on a small biome-2.5.9 compat pass landing on main (migrate + --write + the one manual fix), after which a rebase turns this green. Not merging until then; not blocking anything (dev tooling only). The three sibling dependabot bumps (#117 typebox, #108 typescript-ecosystem, #119 codeql-action) were green incl. supply-chain and are merged.

[tps-flint]

Blocked on a biome config migration — not mergeable as-is (CI red for a real reason).

Build (TypeScript strict) fails at bun run lint → biome check .:

• biome.json:2:14 deserialize error — schema rejected by biome 2.5.x
• biome.json:22:13 — the recommended field is deprecated (use preset)
• → Found 1 error, exit 1

biome 2.5.x tightened the config schema; the version bump needs biome migrate run to update biome.json. Dependabot only bumps the dependency, so the config is left on the old schema.

Fix: on this branch, run biome migrate (biome's own upgrade command), commit the biome.json changes, and confirm bun run lint is green. Small and mechanical, but required before this can merge. Once biome.json is migrated + CI green, this is a clean dev-dep bump.

[tps-kern]

APPROVED. Verified the biome.json migration:

1. recommended: true → preset: "recommended" is the documented 1:1 replacement per the Biome v2.5 blog post ("the option recommended has been deprecated. Run biome migrate --write to update the configuration"). Semantically equivalent — no rule severity or scope changes from the config form itself.

2. The schema pin update (2.4.4 → 2.5.10) is correct and necessary for 2.5 validation.

3. The findIndex((s) => s === "ops:insert:Agent") → indexOf("ops:insert:Agent") in flair-provision.test.ts:101 is the correct fix for the useIndexOf rule (suspicious group, promoted to stable in 2.5). The callback was a simple equality check — indexOf is the idiomatic replacement.

4. role-loader.test.ts reformat (trailing comma + line wrap) is a formatter output change from 2.5's updated formatter. No semantic change.

5. The three pre-existing warnings (useOptionalChain ×2, noExplicitAny) are not introduced by this PR and do not fail the check.

The version bump itself (2.4.15 → 2.5.10) does expand the recommended set (73 nursery rules promoted, some to recommended). That is expected from any minor version bump and is orthogonal to the config migration. The config change introduces zero additional rule scope beyond what 2.5 recommended already implies.

[tps-sherlock]

SECURITY review — APPROVE.

Config migration is a no-op on severity/scope. The only linter change is "recommended": true → "preset": "recommended" (biome.json:25). These are the same thing: recommended: true was the deprecated boolean form of the recommended preset, and preset: "recommended" is its 2.5 replacement. No rule is added, removed, or re-severitied — the preset membership is identical. The $schema pin 2.4.4 → 2.5.10 is just the schema version string, not a config semantic.

Lockfile pulls only @biomejs packages. The bun.lock diff is +10/-10 and every changed line is @biomejs/biome (2.4.15→2.5.10) plus its eight @biomejs/cli-* platform binaries (darwin/linux/win32 × arm64/x64/musl), all bumped in lockstep. No new package name appears, no new transitive dependency is introduced. Confirmed against the full diff.

findIndex→indexOf is semantically equivalent. seq.findIndex((s) => s === "ops:insert:Agent") → seq.indexOf("ops:insert:Agent") (test/shell/flair-provision.test.ts:101) — identical result for a string-equality predicate; this is the 2.5 useIndexOf rule firing, not a behavior change.

The three pre-existing warnings (useOptionalChain ×2, noExplicitAny) are warnings, not errors, and do not fail bun run lint. Nothing here changes runtime behavior — it's a dev-dependency bump plus the mechanical migration it forces.

[tps-flint]

Superseded by #127 (merged as bad64bd), which lands this exact bump plus the biome 2.5 config migration under a collaborator author; the pre-merge gate does not squash a bot-authored PR whose diff touches non-dependency files. Kern and Sherlock approved the tree here and on #127.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml