Skip to content

build(deps-dev): bump the development-dependencies group with 8 updates - #3029

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/development-dependencies-bd750f9834
Open

build(deps-dev): bump the development-dependencies group with 8 updates#3029
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/development-dependencies-bd750f9834

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 12, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 8 updates:

Package From To
@biomejs/biome 2.6.4 2.6.6
rimraf 6.1.3 6.1.4
vite 8.3.5 8.3.6
vitest 5.0.5 5.1.0
@vitejs/plugin-react 6.2.1 6.3.0
sass 1.107.1 1.108.1
jsdom 30.1.3 31.0.0
@rspack/core 2.3.0 2.3.1

Updates @biomejs/biome from 2.6.4 to 2.6.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.6

2.6.6

Patch Changes

  • #12887 da0422e Thanks @​dyc3! - Added the new nursery rule noArrayMethodsOnArguments. It reports calls to array methods on the arguments object, which isn't an array, so these calls throw a TypeError when the code runs.

    function sum() {
  return arguments.reduce((total, value) => total + value, 0);
}

  • #12877 cd9e10f Thanks @​dyc3! - Added the nursery rule noConstantComparisons, which reports && and || conditions that can never be true, are always true, or contain a check with no effect.

    if (statusCode <= 400 && statusCode > 500) {}

  • #12876 a7c9586 Thanks @​dyc3! - Added the nursery rule noErasingOperation, which disallows operations with 0 that always result in zero: multiplying by 0, a bitwise AND with 0, and dividing 0 by a number. The other value in these operations has no effect on the result, which usually means the code has a mistake.

    const total = price * 0;

  • #12841 e954f55 Thanks @​dyc3! - Added the nursery rule noNegatedArrayPredicate, which reports negated calls to Array#some() and Array#every() and suggests moving the negation into the callback function.

    // Invalid: use `array.every((item) => !isUnicorn(item))` instead.
const isMissing = !array.some((item) => isUnicorn(item));

  • #12888 15039f7 Thanks @​dyc3! - Added the new nursery rule noNumberArgumentOutOfRange, which reports number literal arguments of toString(), toFixed(), toExponential() and toPrecision() that are outside the range the method accepts. These calls throw a RangeError at runtime.

    value.toString(64);

  • #12889 1cd7520 Thanks @​dyc3! - Added the nursery rule noSharedBranchCode, which reports code that is repeated at the start or end of every branch of an if statement. That code runs no matter which branch is taken, so it can be moved before or after the if statement.

    if (condition) {
  doSomething();
  cleanup();
} else {
  doSomethingElse();
  cleanup();
}

... (truncated)

Commits

Updates rimraf from 6.1.3 to 6.1.4

Commits

Updates vite from 8.3.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

Build System

  • generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)
Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

  • await overlapping plugin container close calls (#23935) (175bbeb)
  • build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
  • build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
  • bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
  • bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
  • deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
  • deps: update all non-major dependencies (#23896) (46b91c5)
  • deps: update all non-major dependencies (#23966) (b3cb057)
  • deps: update rolldown-related dependencies (#23868) (a63eb87)
  • deps: update rolldown-related dependencies (#23967) (0105733)
  • dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
  • html: remove adjacent module tags on the first line (#23823) (eab1dc2)
  • ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
  • optimizer: detect cache dir precisely (#23912) (cc9bc21)
  • optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
  • respect build.sourcemap from environment (#23879) (82e7aa0)
  • server: escape HTML attributes (#23995) (a270391)
  • server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
  • ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
  • use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
  • wasm: reject .wasm outside server.fs (#23914) (64e2467)
  • watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
  • worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

Miscellaneous Chores

Build System

  • generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)
Commits
  • 0fd9a29 release: v8.3.6 (#23996)
  • eab1dc2 fix(html): remove adjacent module tags on the first line (#23823)
  • a270391 fix(server): escape HTML attributes (#23995)
  • 7139ef3 fix(worker): keep chunks conflicted with unused workers that are still used b...
  • 0fdd81e fix(optimizer): resolve subpath imports (#) with Vite's resolver (#23959)
  • 8069835 fix(build): use stable module ids in chunk import map hash signatures (fix #2...
  • 95c2daf fix: ignore pnpm's .modules.yaml as a Vite Task input (#23634)
  • b3cb057 fix(deps): update all non-major dependencies (#23966)
  • 0105733 fix(deps): update rolldown-related dependencies (#23967)
  • 90bc034 fix: use top-level input for SSR build when build.ssr: true (#23898)
  • Additional commits viewable in compare view

Updates vitest from 5.0.5 to 5.1.0

Release notes

Sourced from vitest's releases.

v5.1.0

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates @vitejs/plugin-react from 6.2.1 to 6.3.0

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.3.0

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.3.0 (2026-11-09)

Make reactCompilerPreset work with @rolldown/plugin-babel's parallel option (#1549)

reactCompilerPreset now refers to its Babel preset by module path instead of by function, so it can be sent to worker threads.

Commits
  • 0e95069 release: plugin-react@6.3.0 (#1557)
  • 8a7d0d4 feat(plugin-react): make reactCompilerPreset work with @​rolldown/plugin-babel...
  • See full diff in compare view

Updates sass from 1.107.1 to 1.108.1

Release notes

Sourced from sass's releases.

Dart Sass 1.108.1

To install Sass 1.108.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Node.js Embedded Host

  • Fix an issue in the release process causing the OS-specific embedded Sass packages to be missing their Dart Sass snapshots.

See the full changelog for changes in earlier releases.

Dart Sass 1.108.0

To install Sass 1.108.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

  • Undo some unintentional breaking changes added in 1.106.0 relating to how escaped identifiers interact with sass:meta functions and named rest arguments.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.108.1

Node.js Embedded Host

  • Fix an issue in the release process causing the OS-specific embedded Sass packages to be missing their Dart Sass snapshots.

1.108.0

  • Undo some unintentional breaking changes added in 1.106.0 relating to how escaped identifiers interact with sass:meta functions and named rest arguments.
Commits
  • 524dc18 Bump version and add changelog for embedded-host-node#459 (#2911)
  • f7d5775 Bump zizmorcore/zizmor-action from 0.6.4 to 0.8.0 (#2905)
  • 2cff27c Bump postcss from 8.5.31 to 8.5.32 in /pkg/sass-parser (#2906)
  • ae65617 Lock Foundation tests to the v6 branch (#2909)
  • c59636a Fix escape behavior changes with reflection added in 1.106 (#2908)
  • See full diff in compare view

Updates jsdom from 30.1.3 to 31.0.0

Release notes

Sourced from jsdom's releases.

v31.0.0

Breaking changes

  • Changed the optional canvas and image decoding backend from canvas to @napi-rs/canvas. Install @napi-rs/canvas v1.0.13 or later in the v1.x series alongside jsdom; installing canvas alone no longer enables this support. The new backend provides prebuilt Skia binaries on supported platforms, and rendering and encoded image bytes can differ. Projects using native canvas objects or custom font registration should follow the canvas migration guidance. Added WebP serialization through canvas.toDataURL() and canvas.toBlob(). Fixed image loading to wait for decoding before firing load, discard obsolete source requests, avoid refetching when dimensions change, and prevent failed images from drawing stale contents. Fixed canvas context and serialization behavior, including unsupported context types, read-only ctx.canvas, image-drawing exceptions, MIME type and quality normalization, and asynchronous null results from canvas.toBlob() for empty canvases or encoding failures. (@​Brooooooklyn)
  • Changed CSS parsing, selector matching, and computed styles to use a new integrated implementation, with substantially expanded support and faster selector queries and repeated style reads. This includes cascade layers, nesting, @scope, custom-property substitution and registration through @property and CSS.registerProperty(), typed attr(), conditional if(), shadow-tree styling with :host, ::slotted(), and ::part(), pseudo-element computed styles, and constructable stylesheets with document.adoptedStyleSheets and shadowRoot.adoptedStyleSheets. Fixed numerous cascade, shorthand, serialization, and default-style issues; computed declarations now stay live across DOM and stylesheet changes. CSS serialization and computed values can differ from previous releases.
  • Changed HTML and XML parsing to pause at blocking scripts until their required resources are ready. The JSDOM constructor, JSDOM.fromURL(), and JSDOM.fromFile() can now return partially parsed documents. Wait for DOMContentLoaded for the finished tree, or the window's load event for load-delaying resources, checking document.readyState first in case the event has already fired. XML syntax errors encountered after asynchronous parsing resumes are reported through the virtual console as "xml-parsing" errors.

Other changes

  • Added window.reportError(), which dispatches an error event and reports uncanceled errors to the virtual console. (@​sarankumar1325)
  • Added element.ariaBrailleLabel and element.ariaBrailleRoleDescription. (@​Kjubikstronk)
  • Fixed page-completion load events to fire only on the window. Use window.addEventListener("load", ...) or window.onload instead of listening on the document.
  • Fixed document.open(), including implicit calls from document.write(), to clear event listeners and handlers from the document, its descendants, and its window when replacing the input stream.
  • Fixed document.write() to process successive writes through the parser's input stream, preserve insertion points across nested scripts, and make completed text immediately visible. Script-created input streams now remain open until document.close().
  • Fixed dynamically inserted scripts to respect script.async = false execution order, use their source text and document from preparation time, and avoid executing after adoption into another document. Scripts parsed through inert fragment APIs no longer execute when subsequently inserted.
  • Fixed unrelated images, stylesheets, and frames being delayed behind scripts, and resource completion events firing before nested stylesheet imports finish. Cyclic imports no longer prevent completion, and <style> elements in shadow trees now fire load events.
  • Fixed window.stop() to cancel pending subresource and XMLHttpRequest requests in descendant frames and suppress completion events for canceled loads, while allowing subsequent requests to proceed.
  • Fixed repeated document.close() calls replaying readiness and load events, and incorrect iframe load events when reopening documents from event handlers.
  • Fixed memory leaks where pending request interceptor promises retained closed windows, introduced in v28.0.0.
  • Fixed focus remaining on elements that become non-focusable after DOM or style changes. Focus now moves asynchronously to the document's viewport, and element.blur() can release it immediately.
  • Fixed document.hasFocus() returning false before an element is focused or during focus transitions within the document, including inside frames.
  • Fixed \<template> parsing and template.innerHTML serialization in XML documents, including templates with namespace prefixes. (@​b84330808)
  • Fixed rect.toJSON() and performance.toJSON() to create their result objects in the method's realm instead of the host Node.js realm.
Commits
  • 825fa8e 31.0.0
  • 9f2e49a Add ariaBrailleLabel and ariaBrailleRoleDescription
  • 4c0a35e Flush text written with document.write()
  • fce11d3 Switch canvas support to @​napi-rs/canvas
  • 27614bf Fix document.hasFocus() during focus changes
  • 627ade2 Implement asynchronous focus fixup
  • 8bd17a2 Implement reportError()
  • 5ae66cf Update webidl2js and remove IDL workarounds
  • ce5a100 Align development scripts and CI
  • 9cc717f Adopt ESLint config v6 and oxfmt
  • Additional commits viewable in compare view

Updates @rspack/core from 2.3.0 to 2.3.1

Release notes

Sourced from @​rspack/core's releases.

v2.3.1

What's Changed

New Features 🎉

Performance 🚀

Bug Fixes 🐞

@dependabot
build(deps-dev): bump the development-dependencies group with 8 updates
bbe56e8 
Bumps the development-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.6.4` | `2.6.6` |
| [rimraf](https://github.com/isaacs/rimraf) | `6.1.3` | `6.1.4` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.2.1` | `6.3.0` |
| [sass](https://github.com/sass/dart-sass) | `1.107.1` | `1.108.1` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.3` | `31.0.0` |
| [@rspack/core](https://github.com/web-infra-dev/rspack/tree/HEAD/packages/rspack) | `2.3.0` | `2.3.1` |


Updates `@biomejs/biome` from 2.6.4 to 2.6.6
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.6/packages/@biomejs/biome)

Updates `rimraf` from 6.1.3 to 6.1.4
- [Changelog](https://github.com/isaacs/rimraf/blob/main/CHANGELOG.md)
- [Commits](isaacs/rimraf@v6.1.3...v6.1.4)

Updates `vite` from 8.3.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `vitest` from 5.0.5 to 5.1.0
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest)

Updates `@vitejs/plugin-react` from 6.2.1 to 6.3.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.3.0/packages/plugin-react)

Updates `sass` from 1.107.1 to 1.108.1
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](sass/dart-sass@1.107.1...1.108.1)

Updates `jsdom` from 30.1.3 to 31.0.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.3...v31.0.0)

Updates `@rspack/core` from 2.3.0 to 2.3.1
- [Release notes](https://github.com/web-infra-dev/rspack/releases)
- [Commits](https://github.com/web-infra-dev/rspack/commits/v2.3.1/packages/rspack)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: rimraf
  dependency-version: 6.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: vitest
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: sass
  dependency-version: 1.108.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: jsdom
  dependency-version: 31.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: "@rspack/core"
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area-dependencies Pull requests that update a dependency file platform-javascript Related to the JavaScript version of alphaTab labels Nov 12, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) November 12, 2026 09:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area-dependencies Pull requests that update a dependency file platform-javascript Related to the JavaScript version of alphaTab

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants