build(deps-dev): bump the development-dependencies group with 5 updates

[dependabot]

Bumps the development-dependencies group with 5 updates:

Package	From	To
@biomejs/biome	2.5.12	2.5.13
@types/node	26.4.1	26.5.1
vite	8.2.2	8.3.0
@microsoft/api-extractor	7.59.0	7.59.1
webpack	5.110.3	5.111.0

Updates @biomejs/biome from 2.5.12 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• See full diff in compare view

Updates @types/node from 26.4.1 to 26.5.1

Commits

• See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)
• delete unused PluginContainerOptions (#23382) (ee64401)
• use oxfmt sortImports (#23319) (97ad042)

... (truncated)

Commits

• 95e8923 release: v7.3.1
• 9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
• acf7e05 release: v7.3.0
• cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
• 317b3b2 release: v7.2.7
• 721f163 fix: plugin shortcut support (#21211)
• bda5dbb release: v7.2.6
• 3aa7527 release: v7.2.5
• 72e398a fix(deps): update all non-major dependencies (#21175)
• 3765f7b fix: shortcuts not rebound after server restart (#21166)
• Additional commits viewable in compare view

Updates @microsoft/api-extractor from 7.59.0 to 7.59.1

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.59.1

Sat, 05 Sep 2026 00:15:08 GMT

Version update only

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​microsoft/api-extractor since your current version.

Updates webpack from 5.110.3 to 5.111.0

Release notes

Sourced from webpack's releases.

v5.111.0

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by @​alexander-akait in #22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by @​alexander-akait in #22011)

• Add output.copy to copy files and directories into the output directory. (by @​alexander-akait in #21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by @​alexander-akait in #22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by @​alexander-akait in #21993)

• Export cssMinify and htmlMinify on css.syntax and html.syntax. (by @​alexander-akait in #21953)

• Make processResult async and let a tap rename the asset it rewrote. (by @​alexander-akait in #21854)

• Lower a CSS spelling a target cannot read and write a color fallback before one. (by @​alexander-akait in #21926)

• Allow optional filesystem cache build dependencies. (by @​xiaoxiaojx in #21849)

• Add output.environment.topLevelAwait and await every async ESM entry. (by @​alexander-akait in #21915)

• Add unusedSymbols and pseudoClasses, and evaluate a CSS color function. (by @​alexander-akait in #21927)

• Drop an implied shorthand slot, fold a math function, tighten color conversion. (by @​alexander-akait in #21929)

• Add module.parser.javascript.specNamespaceObject for spec namespace objects. (by @​alexander-akait in #22049)

• Drop what is already said or only a gone engine reads, add lowerUnsupported. (by @​alexander-akait in #21931)

• Add normalizeUrlAttributes, mergeScripts, boolean and token switches. (by @​alexander-akait in #21960)

• Minify an event handler attribute, and name the production each script body is. (by @​alexander-akait in #21968)

• Add source-map, asset, module, bailout, federation hints; group config checks. (by @​alexander-akait in #21961)

• Lower CSS nesting, :dir() and custom at-rules; gate case folding and escapes. (by @​alexander-akait in #21950)

• Add optimization.minimize.css.mergeDistantRules to join rules across a gap. (by @​alexander-akait in #21969)

Patch Changes

• Minify an embedded body through the embedded path, dropping three html options. (by @​alexander-akait in #21936)

• Take a minified style attribute's answer whatever quoting it needs. (by @​alexander-akait in #21936)

• Name chunk imports in the chunk loader, not at each import site. (by @​alexander-akait in #22076)

• Repair hashed names; under HMR bake hashed url maps and reload moved css names. (by @​alexander-akait in #21916)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.0

Minor Changes

• Enable output.module by default with futureDefaults on ESM-capable targets. (by @​alexander-akait in #22088)

• Remove experiments.outputModule, set output.module to emit ESM instead. (by @​alexander-akait in #22011)

• Add output.copy to copy files and directories into the output directory. (by @​alexander-akait in #21938)

• Accept a file URL in any spelling Node reads where an absolute path is taken. (by @​alexander-akait in #22012)

• Minify inline CSS and JSON via renderEmbeddedSource, exporting webpack's own. (by @​alexander-akait in #21993)

• Export cssMinify and htmlMinify on css.syntax and html.syntax. (by @​alexander-akait in #21953)

• Make processResult async and let a tap rename the asset it rewrote. (by @​alexander-akait in #21854)

• Lower a CSS spelling a target cannot read and write a color fallback before one. (by @​alexander-akait in #21926)

• Allow optional filesystem cache build dependencies. (by @​xiaoxiaojx in #21849)

• Add output.environment.topLevelAwait and await every async ESM entry. (by @​alexander-akait in #21915)

• Add unusedSymbols and pseudoClasses, and evaluate a CSS color function. (by @​alexander-akait in #21927)

• Drop an implied shorthand slot, fold a math function, tighten color conversion. (by @​alexander-akait in #21929)

• Add module.parser.javascript.specNamespaceObject for spec namespace objects. (by @​alexander-akait in #22049)

• Drop what is already said or only a gone engine reads, add lowerUnsupported. (by @​alexander-akait in #21931)

• Add normalizeUrlAttributes, mergeScripts, boolean and token switches. (by @​alexander-akait in #21960)

• Minify an event handler attribute, and name the production each script body is. (by @​alexander-akait in #21968)

• Add source-map, asset, module, bailout, federation hints; group config checks. (by @​alexander-akait in #21961)

• Lower CSS nesting, :dir() and custom at-rules; gate case folding and escapes. (by @​alexander-akait in #21950)

• Add optimization.minimize.css.mergeDistantRules to join rules across a gap. (by @​alexander-akait in #21969)

Patch Changes

• Minify an embedded body through the embedded path, dropping three html options. (by @​alexander-akait in #21936)

• Take a minified style attribute's answer whatever quoting it needs. (by @​alexander-akait in #21936)

• Name chunk imports in the chunk loader, not at each import site. (by @​alexander-akait in #22076)

... (truncated)

Commits

• 9256118 chore(release): new release (#21914)
• 3ef9663 refactor: consolidate getter and value format of export fragment (#22100)
• aff7c4c perf: emit less chunk-loading runtime (#22094)
• e954b81 build(html): sweep the HTML printer for spelling-dependent output (#22097)
• da4ad13 fix(css): replace a @​value named in an at-rule prelude only once (#22036)
• df72840 perf(runtime): test the spec namespace cache slot for truthiness (#22098)
• 4c80c99 fix(html): minify an attribute by what it says, not how it was spelled (#22095)
• f6fd097 fix: release stale compilation data from nested children and idle watches (#2...
• 55c9808 refactor(js): own the ECMAScript parser and drop the acorn dependency (#22042)
• e1ab6f2 fix(html): escape a text run the tag after it would fuse with (#22086)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions