Repository navigation
fix(deps): update all dependencies - #31
renovate[bot] wants to merge 1 commit into
Conversation
6cba843 to
0f055c2
Compare
92bada8 to
71cb2e1
Compare
54d829d to
590142f
Compare
5daa077 to
79555ae
Compare
055e1ef to
d1673ca
Compare
c20c888 to
c23139a
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the
|
| Layer / File(s) | Summary |
|---|---|
Root package manager and Changesets tooling package.json |
Root package.json updated to packageManager: "pnpm@11.1.3" and Changesets devDependencies (@changesets/changelog-github, @changesets/cli) bumped. |
App package manager and dependency upgrades packages/app/package.json |
packages/app packageManager set to pnpm@11.1.3; multiple runtime dependencies and devDependencies (including @effect/*, effect, ts-morph, tooling, TypeScript, Vite/Vitest, linters) have version bumps. |
GitHub Actions and workflow configuration .github/actions/setup/action.yml, .github/workflows/checking-dependencies.yml, .github/workflows/snapshot.yml |
Composite action/workflows updated: pnpm/action-setup bumped to v6, actions/setup-node node-version changed to 24.15.0, and actions/upload-artifact bumped to v7. |
Estimated code review effort
🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related issues
- Dependency Dashboard openapi-effect#1 — Matches Renovate-style dependency and workflow version bumps (pnpm and action versions).
- Dependency Dashboard eslint-plugin-suggest-members#2 — Overlaps CI and Changesets dependency/version updates present in this PR.
- Dependency Dashboard #10 — Similar CI/action and package metadata updates (pnpm, actions, packageManager).
- Dependency Dashboard context-doc#5 — Contains comparable dependency/version adjustments across workflows and manifests.
- Dependency Dashboard dist-deps-prune#2 — Related updates to GitHub Action versions and package.json dependency entries.
- Dependency Dashboard effect-eslint-template#6 — Mirrors pnpm/action-setup and pnpm packageManager version bumps seen here.
🚥 Pre-merge checks | ✅ 5
-
✅ Passed checks (5 passed)
-
Check name Status Explanation Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request. Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request. Title check ✅ Passed The title clearly identifies the pull request as a dependency update, which matches the primary changes across packages, tooling, and CI actions. Description check ✅ Passed The description directly documents the Renovate-generated dependency, package manager, CI action, and runtime version updates.
-
✨ Finishing Touches
-
📝 Generate docstrings
-
- Create stacked PR
- Commit on current branch
🧪 Generate unit tests (beta)
-
- Create PR with unit tests
- Commit unit tests in branch
renovate/all
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
🐰 A patch of pins and versions new,
I nibbled bumps and pushed them through.
Workflows hum and artifacts sing,
PNPM hops to a brighter spring.
— Rabbit with a CI carrot 🥕
Comment @coderabbitai help to get the list of available commands.
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/actions/setup/action.yml:
- Line 13: The action uses pnpm/action-setup@v6 but the custom action default
still sets node-version: 20.16.0 which is incompatible; update the default
node-version in action.yml to Node 24 (>=24.0.0, e.g., 24.15.0 to match
checking-dependencies.yml) so the action runs on the required runtime, and after
changing the default verify pnpm selection behavior (packageManager in
package.json / pnpm@11.1.2) because v6 has a bug that may ignore
packageManager—if necessary pin the pnpm version explicitly or add configuration
to enforce packageManager to ensure the expected pnpm version is used.
In @.github/workflows/checking-dependencies.yml:
- Line 15: The workflow uses pnpm/action-setup@v6 but package.json declares
packageManager: pnpm@11.1.2, causing a mismatch; either align the workflow or
package.json: update package.json's packageManager to "pnpm@11.1.1" to match the
action's default, or explicitly configure the action in
.github/workflows/checking-dependencies.yml (pnpm/action-setup) with a
compatible with.version value (e.g., 11.1.1) until 11.1.2 is released, or remove
the explicit version so the action auto-detects from package.json and surfaces
the proper error if the version is unavailable.
In `@package.json`:
- Line 6: Update package.json to remove deprecated pnpm v10 fields and adopt
pnpm v11 format: replace any ignoredBuiltDependencies and onlyBuiltDependencies
entries with the new allowBuilds configuration (mapping allowed package patterns
or booleans accordingly) and set the engines.node field to ">=22" (or "22.x" per
project policy) so Node.js requirement is explicit for pnpm 11; also keep
packageManager set to "pnpm@11.1.2" and run the pnpm v10→v11 codemod (pnpx
codemod run pnpm-v10-to-v11) to ensure any other migration changes are applied.
In `@packages/app/package.json`:
- Line 71: Add an "engines" entry to packages/app/package.json to require
Node.js >=20.19.0 so ESLint 10.3.0 runs correctly; locate the existing "eslint":
"^10.3.0" dependency in package.json and add an "engines" object with "node":
">=20.19.0" to enforce the minimum Node version for contributors and CI.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 99f915a6-56ca-42ec-8fc8-02ccf3d20151
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.github/actions/setup/action.yml.github/workflows/checking-dependencies.yml.github/workflows/snapshot.ymlpackage.jsonpackages/app/package.json
| steps: | ||
| - uses: actions/checkout@v6 | ||
| - uses: pnpm/action-setup@v4 | ||
| - uses: pnpm/action-setup@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
pnpm/action-setup v6 release notes
💡 Result:
pnpm/action-setup v6 release notes (from the repo’s official GitHub Releases pages) are available as a series of versioned release entries under the v6 tags. The most recent v6 entry visible in the official releases feed is v6.0.8 (published 2026-05-12), with the following changes: 1) v6.0.8 (2026-05-12) - docs(README): fix cache_dependency_path type (PR #257) [1] - fix: drop patchPnpmEnv so standalone+self-update works on Windows (PR #258) [1] - fix: update pnpm to 11.1.1 (PR #248) [1] 2) v6.0.4 (2026-04-30) - fix: use npm co-located with the action node binary (PR #239) [2] Additional v6 changes are also reflected in the v4...v6 comparison page (including updates to README/examples and caching-related input typing/behavior), which indicates that v6 introduces/updates inputs like cache_dependency_path handling. In that compare view, cache_dependency_path is described as accepting multiple paths delimited by newlines, and the example workflows are updated to use pnpm/action-setup@v6 instead of v4. [3] Notes / where to read the full set of v6 release notes: - Start at the official Releases index for pnpm/action-setup and select the v6.x.y tags. The Releases index is the source of truth for the complete v6 changelog history. [4] If you want, tell me the exact v6 range you care about (e.g., “v6.0.0 through v6.0.8” or “just v6.0.8”), and I’ll summarize only those entries.
Citations:
- 1: https://github.com/pnpm/action-setup/releases/tag/v6.0.8
- 2: https://github.com/pnpm/action-setup/releases/tag/v6.0.4
- 3: pnpm/action-setup@v4...v6
- 4: https://github.com/pnpm/action-setup/releases
🌐 Web query:
Node.js 24.15.0 release notes
💡 Result:
Node.js 24.15.0 (Krypton, LTS) release notes (published 2026-04-15) list these notable changes: - cli: add --max-heap-size option [1] - cli: add --require-module / --no-require-module [2] - crypto: add raw key formats support to the KeyObject APIs [1] - fs: add throwIfNoEntry option for fs.stat and fs.promises.stat [2] - http2: add http1Options for HTTP/1 fallback configuration [2] - module: mark require(esm) as stable [2] - module: mark module compile cache as stable [2] - net: add setTOS and getTOS to Socket [2] - sqlite: add limits property to DatabaseSync [2] - sqlite: mark as release candidate [2] - src: add C++ support for diagnostics channels [2] - stream: rename Duplex.toWeb type option to readableType [2] - test_runner: add exports option for module mocks [2] - test_runner: expose worker ID for concurrent test execution [2] - test_runner: show interrupted test on SIGINT [2] Primary sources for the above are the official Node.js blog release page and the Node.js v24 changelog section for 24.15.0 [1][2].
Citations:
- 1: https://nodejs.org/blog/release/v24.15.0
- 2: https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V24.md
🏁 Script executed:
#!/bin/bash
# Check all workflow files for consistency in action versions
rg -n "pnpm/action-setup@" --type yaml
rg -n "node-version:" --type yamlRepository: ProverCoderAI/effect-template
Length of output: 55
🏁 Script executed:
#!/bin/bash
# Check if the workflow file exists
ls -la .github/workflows/ 2>/dev/null || echo "Directory not found"
# If it exists, read the file
if [ -f ".github/workflows/checking-dependencies.yml" ]; then
echo "=== File found, reading contents ==="
cat -n ".github/workflows/checking-dependencies.yml"
else
echo "File not found"
fi
# Also check with fd for any workflow files
echo "=== Searching for workflow files ==="
fd -e yml -e yaml ".github/workflows/" 2>/dev/null || fd -e yml -e yamlRepository: ProverCoderAI/effect-template
Length of output: 1412
🏁 Script executed:
#!/bin/bash
# Check pnpm version in lock file
head -20 pnpm-lock.yaml | grep -i "version\|lockfileVersion"
# Also check package.json for pnpm version requirement if any
if [ -f "package.json" ]; then
grep -i "pnpm" package.json
fi
# Check if there's a .npmrc or similar config
if [ -f ".npmrc" ]; then
cat .npmrc
fiRepository: ProverCoderAI/effect-template
Length of output: 745
🌐 Web query:
pnpm 11.1.2 release date and availability
💡 Result:
No evidence found of a pnpm 11.1.2 release as of 2026-05-14. The latest releases are v11.1.1 (published around 2026-05-12 [1]) and v11.1.0 (published 2026-05-11 [2][3][4]). Official GitHub releases page lists recent tags up to May 12 but no 11.1.2 [3]. npm registry tracks these releases [4], and no sources mention 11.1.2. It is not yet released or available.[2][3][1]
Citations:
- 1: https://newreleases.io/project/github/pnpm/pnpm/release/v11.1.1
- 2: https://github.com/pnpm/pnpm/releases/tag/v11.1.0
- 3: https://github.com/pnpm/pnpm/releases
- 4: https://newreleases.io/project/npm/pnpm/release/11.1.0
🌐 Web query:
pnpm/action-setup configure pnpm version 11.1.2
💡 Result:
To configure pnpm/action-setup to install pnpm 11.1.2, use the action’s with.version input: steps: - uses: pnpm/action-setup@v6 with: version: 11.1.2 The version input is “Version of pnpm to install” and supports exact versions like 11.1.2 (or version ranges/tags). If you omit version, the action can use the packageManager field from your package.json instead.[1] You may optionally specify run_install if you also want the action to run pnpm install for you; otherwise run pnpm install in a later step.[1]
Citations:
Configure pnpm version in pnpm/action-setup to match project requirement.
The workflow uses pnpm/action-setup@v6 which installs pnpm 11.1.1 by default, but the project specifies packageManager: pnpm@11.1.2 in package.json. Since pnpm 11.1.2 does not yet exist, the pnpm install --frozen-lockfile step (line 21) will fail due to version mismatch. Either update package.json to use pnpm 11.1.1, or configure the action with with.version: 11.1.2 once that version is released. Alternatively, the action can auto-detect the version from package.json if no version input is specified (allowing proper error messaging when unavailable).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/checking-dependencies.yml at line 15, The workflow uses
pnpm/action-setup@v6 but package.json declares packageManager: pnpm@11.1.2,
causing a mismatch; either align the workflow or package.json: update
package.json's packageManager to "pnpm@11.1.1" to match the action's default, or
explicitly configure the action in .github/workflows/checking-dependencies.yml
(pnpm/action-setup) with a compatible with.version value (e.g., 11.1.1) until
11.1.2 is released, or remove the explicit version so the action auto-detects
from package.json and surfaces the proper error if the version is unavailable.
| "private": true, | ||
| "description": "Monorepo workspace for effect-template", | ||
| "packageManager": "pnpm@10.29.3", | ||
| "packageManager": "pnpm@11.1.2", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
pnpm 11 release notes breaking changes from pnpm 10
💡 Result:
pnpm 11 introduces several breaking changes from v10, primarily documented in the official migration guide [1] and v11.0.0 release notes [2][3]. Key breaking changes include: Node.js requirement: Now requires Node.js 22 or newer; support for v18-21 dropped. pnpm is pure ESM, and standalone exe needs glibc 2.27+ [3][2][4]. Configuration changes [1]: - No longer reads config from package.json#pnpm; move to pnpm-workspace.yaml. -.npmrc limited to auth/registry; other settings (hoist-pattern, node-linker, etc.) to pnpm-workspace.yaml (camelCase keys). - npm_config_* env vars ignored; use pnpm_config_*. - Deprecated build settings (onlyBuiltDependencies, etc.) removed; use allowBuilds [3][2]. - Package manager settings consolidated to pmOnFail: 'download'|'ignore'|'warn'|'error'. - Renames: allowNonAppliedPatches -> allowUnusedPatches; auditConfig.ignoreCves -> auditConfig.ignoreGhsas. Store upgraded to v11: SQLite index.db replaces JSON files; incompatible with v10 stores (clear or migrate) [3][2][5]. Global installs: Isolated in {pnpmHomeDir}/global/v11/{hash}/ with own package.json/node_modules/pnpm-lock.yaml. pnpm install -g (no args) removed; use pnpm add -g [3][2]. pnpm link changes: No global store resolution; only relative/absolute paths. --global removed (use pnpm add -g.); no-arg pnpm link removed [1][6]. Removed commands: pnpm server; npm passthrough (publish, login, etc.) now native, some like access, edit removed [3][2]. Lockfile: patchedDependencies simplified to selector -> hash; auto-migrated [5]. Script shadowing: Scripts named clean/setup/deploy/rebuild run script, not built-in; use pnpm pm [1]. Security defaults: minimumReleaseAge=1440 (1 day), blockExoticSubdeps=true, strictDepBuilds=true [3][2]. A codemod assists migration: pnpx codemod run pnpm-v10-to-v11 [1]. Full details: https://pnpm.io/migration [1], https://github.com/pnpm/pnpm/releases/tag/v11.0.0 [2], https://pnpm.io/blog/releases/11.0 [3].
Citations:
- 1: https://pnpm.io/migration
- 2: https://github.com/pnpm/pnpm/releases/tag/v11.0.0
- 3: https://pnpm.io/blog/releases/11.0
- 4: https://github.com/pnpm/pnpm/releases/tag/v11.0.0-rc.0
- 5: https://github.com/pnpm/pnpm/releases/tag/v11.0.0-alpha.14
- 6: https://github.com/pnpm/pnpm/releases/tag/v11.0.0-beta.3
🏁 Script executed:
#!/bin/bash
# Check if pnpm-lock.yaml has been updated alongside this change
git diff HEAD -- pnpm-lock.yaml | head -50Repository: ProverCoderAI/effect-template
Length of output: 55
🏁 Script executed:
#!/bin/bash
# Check if pnpm-lock.yaml exists and what version it specifies
if [ -f "pnpm-lock.yaml" ]; then
echo "=== pnpm-lock.yaml lockfileVersion ==="
head -20 pnpm-lock.yaml | rg "lockfileVersion|name|version"
else
echo "pnpm-lock.yaml not found"
fi
# Check if package.json has pnpm config that needs migration
echo -e "\n=== package.json pnpm config ==="
jq '.pnpm' package.json 2>/dev/null || echo "No pnpm config in package.json"
# Check Node.js version requirement
echo -e "\n=== Node.js engines requirement ==="
jq '.engines' package.json 2>/dev/null || echo "No engines field"Repository: ProverCoderAI/effect-template
Length of output: 586
🏁 Script executed:
#!/bin/bash
# Check git log to see if pnpm-lock.yaml was modified in this change
echo "=== Recent git changes to pnpm-lock.yaml ==="
git log --oneline -n 10 -- pnpm-lock.yaml 2>/dev/null || echo "No pnpm-lock.yaml history"
# Check if .npmrc or pnpm-workspace.yaml exists
echo -e "\n=== pnpm configuration files ==="
ls -la .npmrc pnpm-workspace.yaml .pnpmfile.cjs 2>/dev/null || echo "Checking config files..."
fd -e "npmrc|pnpmfile|workspace.yaml" .Repository: ProverCoderAI/effect-template
Length of output: 287
🏁 Script executed:
#!/bin/bash
# Check CI workflows for Node.js version
echo "=== CI/CD Node.js version requirement ==="
find .github -name "*.yml" -o -name "*.yaml" 2>/dev/null | head -5 | xargs grep -l "node-version\|node_version\|setup-node" 2>/dev/null | head -1 | xargs cat 2>/dev/null | grep -A 2 "node-version\|setup-node" || echo "Checking workflows..."Repository: ProverCoderAI/effect-template
Length of output: 370
Migrate deprecated pnpm configuration to pnpm 11 format.
The pnpm-lock.yaml has been regenerated to v9.0 (pnpm 11 format), but package.json still contains deprecated configuration that is no longer supported in pnpm 11:
ignoredBuiltDependenciesandonlyBuiltDependenciesmust be migrated to the newallowBuildsconfiguration- Node.js requirement must be explicitly set to 22+ in the
enginesfield (pnpm 11 no longer supports Node.js v18-21)
These deprecated options will cause failures when running pnpm commands. Use the pnpm v10→v11 migration codemod (pnpx codemod run pnpm-v10-to-v11) to complete the migration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 6, Update package.json to remove deprecated pnpm v10
fields and adopt pnpm v11 format: replace any ignoredBuiltDependencies and
onlyBuiltDependencies entries with the new allowBuilds configuration (mapping
allowed package patterns or booleans accordingly) and set the engines.node field
to ">=22" (or "22.x" per project policy) so Node.js requirement is explicit for
pnpm 11; also keep packageManager set to "pnpm@11.1.2" and run the pnpm v10→v11
codemod (pnpx codemod run pnpm-v10-to-v11) to ensure any other migration changes
are applied.
| "@typescript-eslint/parser": "^8.59.3", | ||
| "typescript-eslint": "^8.59.3", | ||
| "@vitest/coverage-v8": "^4.1.6", | ||
| "eslint": "^10.3.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
ESLint 10.0 release notes breaking changes migration guide
💡 Result:
ESLint 10.0 release notes / breaking changes and the official migration guide are here: 1) Official migration guide (v9.x → v10.x) https://eslint.org/docs/latest/use/migrate-to-10.0.0 [1] 2) Official release notes for v10.0.0 https://eslint.org/blog/2026/02/eslint-v10.0.0-released/ [2] Key breaking changes called out in the migration guide (high-signal items) A) Node.js version support dropped ESLint v10.0.0 no longer supports Node.js versions < v20.19.0 (and also drops v21.x and v23.x); the migration guide says to upgrade to Node.js v20.19.0 or later [1][3]. B) “Old config format” no longer supported; flat config required The v10 migration guide states the legacy config system is removed (i.e., old eslintrc format is no longer supported) and points you to use flat config (eslint.config.) [1]. The migration guide summary also calls out removing the eslintrc format [1][3]. C) New configuration file lookup algorithm In ESLint v9 there was an alternate behavior guarded by a feature flag; in v10.0.0, the behavior is the default. The migration guide describes that config lookup now starts from the directory of each linted file and searches upward to the filesystem root (instead of starting from the current working directory) and that the v10_config_lookup_from_file flag was removed [1]. D) Removed feature for eslintrc config lookup behavior flag Attempting to use v10_config_lookup_from_file now results in an error (because the flag was removed) [1]. E) Rule/behavior & API breaking changes (examples listed in the migration guide) The migration guide lists multiple other breaking/API changes, including (among others) removal of the nodeType property in LintMessage objects [1], JSX references now being tracked [1], and changes around fixer APIs requiring string text arguments [1]. How to migrate (practical steps to follow) - Upgrade Node.js to a supported version (>= v20.19.0) before running ESLint 10 [1]. - Ensure you are using flat config (eslint.config.) and remove any legacy eslintrc configuration usage [1]. - If you previously relied on the v9 config lookup behavior / feature flag, update to the new lookup algorithm (start from each linted file’s directory) [1]. - Then run the official migration guide’s checklist/sections to address any remaining listed breaking changes in your specific setup [1].
Citations:
- 1: https://eslint.org/docs/latest/use/migrate-to-10.0.0
- 2: https://eslint.org/blog/2026/02/eslint-v10.0.0-released/
- 3: https://mintlify.com/eslint/eslint/guides/migrate-to-10
🏁 Script executed:
#!/bin/bash
# Check ESLint configuration files for compatibility
fd eslint.config -e js -e mjs -e cjs --exec cat {}Repository: ProverCoderAI/effect-template
Length of output: 55
🏁 Script executed:
#!/bin/bash
# Check for ESLint configuration files
echo "=== Searching for ESLint config files ==="
fd -e json -e js -e cjs -e mjs '(eslintrc|eslint\.config)' --base-directory .
# Check package.json for Node.js version and ESLint config location
echo -e "\n=== Checking packages/app/package.json ==="
head -80 packages/app/package.json | tail -20
# Check root package.json for Node.js engines
echo -e "\n=== Checking root package.json for engines ==="
rg '"engines"' -A 5 package.jsonRepository: ProverCoderAI/effect-template
Length of output: 1013
🏁 Script executed:
#!/bin/bash
# More comprehensive search for all ESLint-related configs
echo "=== Searching for all ESLint configs ==="
find . -type f \( -name ".eslintrc*" -o -name "eslint.config.*" \) 2>/dev/null
# Check for ESLint in workspace packages
echo -e "\n=== Checking eslint references in all package.json files ==="
find . -name "package.json" -type f -exec grep -l "eslint" {} \; 2>/dev/nullRepository: ProverCoderAI/effect-template
Length of output: 252
🏁 Script executed:
#!/bin/bash
# Check the ESLint flat config file
echo "=== Content of eslint.config.mts ==="
cat packages/app/eslint.config.mts
# Search for Node.js version constraints
echo -e "\n=== Searching for Node.js version constraints ==="
find . -type f \( -name ".nvmrc" -o -name ".tool-versions" -o -name "nvmrc" \) 2>/dev/null | head -10
# Check GitHub workflows for Node.js version
echo -e "\n=== Checking for Node.js version in CI/workflows ==="
fd "\.ya?ml$" .github/workflows 2>/dev/null | xargs grep -h "node-version" 2>/dev/null | head -10Repository: ProverCoderAI/effect-template
Length of output: 10380
🏁 Script executed:
#!/bin/bash
# Check if engines field exists in root and app package.json
echo "=== Checking engines field in package.json files ==="
rg '"engines"' -B 1 -A 3 . --type json
# Check for `@eslint/compat` usage in eslint.config.mts
echo -e "\n=== Checking `@eslint/compat` usage ==="
grep -n "@eslint/compat\|compat" packages/app/eslint.config.mts || echo "No `@eslint/compat` found in config"Repository: ProverCoderAI/effect-template
Length of output: 219
Add engines field to enforce Node.js >= v20.19.0 for ESLint 10.3.0 compatibility.
The repository has already properly migrated to ESLint's flat config format (eslint.config.mts) and uses @eslint/compat correctly for plugin compatibility. However, ESLint 10.3.0 requires Node.js >= v20.19.0, and this constraint should be explicitly documented in package.json via an engines field. Without it, developers using older Node.js versions may encounter runtime errors. Add to packages/app/package.json:
"engines": {
"node": ">=20.19.0"
}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/app/package.json` at line 71, Add an "engines" entry to
packages/app/package.json to require Node.js >=20.19.0 so ESLint 10.3.0 runs
correctly; locate the existing "eslint": "^10.3.0" dependency in package.json
and add an "engines" object with "node": ">=20.19.0" to enforce the minimum Node
version for contributors and CI.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
^2.4.0→^2.6.4^0.5.2→^1.0.1^2.29.8→^3.0.3^0.73.2→^0.77.2^0.56.4→^0.60.2^0.58.0→^0.61.1^0.94.5→^0.97.2^0.104.1→^4.1.0^0.47.0→^0.51.0^0.47.0→^0.51.0^0.73.1→^0.76.2^0.49.0→^0.52.1^0.38.0→^0.41.0^0.27.0→^4.1.0^0.16.0→^0.19.1^4.6.0→^4.8.12.0.2→2.1.13.3.3→3.3.7^0.0.25→^0.0.26^24.10.13→^26.6.6^8.55.0→^8.72.1^8.55.0→^8.72.1^4.0.18→^5.0.5^1.6.9→^1.6.28v6→v7v6→v7v6→v7^3.19.17→^4.1.0^10.0.0→^10.13.0^4.4.4→^4.4.5^12.1.1→^14.0.0^3.0.7→^4.2.2^2.0.0→^3.0.0^63.0.0→^79.0.0^17.3.0→^17.13.0^4.0.8→^5.4.224.13.1→26.13.010.29.3→12.16.1v4→v6v3→v6^27.0.2→^28.0.0^5.9.3→^7.0.2^8.55.0→^8.72.1^7.3.1→^8.3.5^4.0.18→^5.0.5cc @skulidropek
Release Notes
biomejs/biome (@biomejs/biome)
v2.6.4Compare Source
Patch Changes
#12261
19fbfb2Thanks @dyc3! - Added the new nursery rulenoConsoleSpaces, which reports a leading or trailing space in aconsole.log(),console.debug(),console.info(),console.warn(), orconsole.error()argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.#12469
cd716d3Thanks @dyc3! - Added the new nursery rulenoMagicArrayFlatDepth, which reports number literals other than1passed as the depth ofArray.prototype.flat()unless a comment inside the parentheses explains them.#12470
92c9e81Thanks @dyc3! - Added the nursery rulenoNull, which reports uses of thenullliteral and suggestsundefinedinstead. Strict comparisons such asfoo === nullare allowed.#12483
9bd3527Thanks @dyc3! - Added the nursery rulenoReturnArrayPush, which reports code that uses the return value ofpush()orunshift(). These methods return the new length of the array, not the added item or the array.#12477
a384892Thanks @dyc3! - Added the nursery rulenoUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.#12447
0a963e4Thanks @dyc3! - Added the nursery rulenoUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.#12554
2eddda9Thanks @dyc3! - Added the nursery rulenoVueComputedPropertiesInData, which reports computed properties used inside thedatafunction of a Vue component. Vue runsdatabefore it sets up computed properties, so the value read there isundefined.#12586
824df15Thanks @dyc3! - Added the nursery rulenoVueDeprecatedDeleteSet, which reports calls to the$setand$deletefunctions,Vue.setandVue.delete, andsetanddelimported fromvue. Vue 3 removed these functions, so calling them throws an error.#12648
6fc1a51Thanks @dyc3! - Added the nursery rulenoVueDeprecatedRouterLinkTagProp, which disallows thetagprop onRouterLink. Vue Router 4 ignores this prop, so the link still renders as an<a>element.#12631
de1188fThanks @dyc3! - Added the new nursery rulenoVueDeprecatedScopeAttribute, which reports thescopeattribute on<template>elements in Vue files. Vue no longer supports this attribute, so usev-slotto receive slot props instead.#12562
5d7553bThanks @dyc3! - Added the new nursery rulenoVueMultipleSlotArgs, which disallows passing more than one argument to a Vue slot from a render function. Slot content written in a template receives only the first argument.#12513
2e520d8Thanks @dyc3! - Added the nursery rulenoVueMutatingProps, which reports code that changes the props of a Vue component, in the script or in the template. Props belong to the parent component, so the child should emit an event or copy the value instead.#12567
144b786Thanks @dyc3! - Added the nursery rulenoVueSideEffectsInComputed, which reports Vue computed properties that change state. Vue decides when to run a computed property, so changes made inside one happen at unpredictable times.#12603
861b288Thanks @dyc3! - Added the new nursery rulenoVueUnusedRefs, which reports template refs in Vue components that nothing reads through$refs,useTemplateRef(), or a variable of the same name in<script setup>. The rule needshtml.experimentalFullSupportEnabledto betrue.#12285
68770e0Thanks @dyc3! - Added the new nursery rulenoYamlBooleanKeys, which disallows boolean values as keys in YAML. For example, the following key is a boolean instead of text, so it is reported:#12338
f46411bThanks @dyc3! - Added the nursery ruleuseSvelteEventDispatcherTypes, which reportscreateEventDispatcher()calls that don't declare the types of their events in Svelte components written in TypeScript.The rule accepts a call that declares its events:
#12615
ade9845Thanks @dyc3! - Added the nursery ruleuseVueDefineOptions, which reports the default export of a plain<script>block in Vue components that also use<script setup>, and suggests setting those options withdefineOptions()instead.#12514
e74b4dcThanks @dyc3! - Added the nursery ruleuseVueDefinePropsDestructuring, which requires destructuring the props returned bydefineProps()in Vue<script setup>blocks. It also reportswithDefaults(), because destructured props can set their default values directly.#12559
94985baThanks @dyc3! - Added the nursery ruleuseVueTemplateRef, which requiresuseTemplateRef()instead ofref()orshallowRef()to access elements of the template in<script setup>.#12512
6be5078Thanks @dyc3! - Added the nursery ruleuseVueTypedProps, which reports Vue props declared without a type, in thepropsoption,defineProps(), ordefineModel(). Without a type, Vue accepts any value for the prop and can't warn when a component receives the wrong kind of value.#12653
f307633Thanks @dyc3! - Added the nursery ruleuseVueVModel, which reports a prop binding on a Vue component paired with anupdate:listener that only writes the new value back, and suggestsv-modelinstead.#12591
a810209Thanks @dyc3! - Added the nursery ruleuseVueValidDefineEmits, which enforces valid usage of Vue'sdefineEmitsmacro in<script setup>.For example, the following code is now reported, because
defineEmitsdeclares its events with both a type and an argument:#12614
9308110Thanks @dyc3! - Added the nursery ruleuseVueValidDefineProps, which reportsdefineProps()calls that Vue can't compile or that declare props incorrectly. For example, it reports a component that callsdefineProps()twice, or whosedefineProps()argument uses a variable declared in<script setup>:#12570
222a230Thanks @dyc3! - Added the nursery ruleuseVueValidVIs, which reportsv-isdirectives that have an argument or modifiers, have no value, or are used on a component instead of a native HTML element.For example, the following
v-isdirective has no value:#12521
4010bb7Thanks @dyc3! - Added the nursery ruleuseVueValidVMemo, which reports invalidv-memodirectives in Vue templates. Av-memodirective must have an array value, can't have an argument or modifiers, and doesn't work inside an element withv-for.For example, the following value is an object instead of an array:
#12597
aff42a7Thanks @dyc3! - Added the nursery ruleuseVueValidVModel, which reportsv-modeldirectives that Vue can't use: on unsupported elements or file inputs, with an argument or unknown modifier on a native element, without a value, or with a value that can't be assigned to.For example, the following
v-modeldirectives are invalid:#12569
3058597Thanks @dyc3! - Added the new nursery ruleuseVueValidVShow, which reportsv-showdirectives that have an argument, a modifier, or no value, or that are placed on a<template>element.#12525
e2e5a36Thanks @dyc3! - Added the nursery ruleuseVueValidVSlot, which reports misplaced, duplicated, or malformedv-slotdirectives in Vue templates.For example, the rule reports two
<template>elements that fill the same slot:#12472
efd16bdThanks @dyc3! - Added the new nursery ruleuseWhileLoopCondition, which reports loops such aswhile (true)andfor (;;)that start with anifstatement containing only abreak, and moves that condition into thewhilestatement.#12640
167bb00Thanks @latin-1! - UpdateduseSortedPropertiesto followstylelint-config-recess-order7.9.0, adding sorting support forscroll-behavior, anchor positioning, multi-column layout, and other properties known to Biome.#12719
40a82b0Thanks @dyc3! - Improved the performance of the linter. Biome now spends less time setting up the enabled rules for each file it analyzes.#12722
f074730Thanks @dyc3! - Improved the performance ofbiome lintby about 1% to 3% on large projects, most noticeably with Biome's default rules and with rules that track variables or unreachable code.#12501
90a4d74Thanks @ematipico! - Fixed #12466: the Biome daemon used more memory with everybiome check --use-serverrun. The daemon now reuses the data that it stores for each file and project, and it keeps syntax trees only for the files that it read most recently.#12501
90a4d74Thanks @ematipico! - Fixed biomejs/biome-vscode#923: when a file open in the editor changed on disk, the language server replaced the editor's text with the text on disk. Biome now keeps the editor's text of open files until they are closed, so diagnostics, code actions and formatting stay at the right positions.#12652
59ff42aThanks @kurovskyiii! - Fixed #12651: an imported name that the other module exports as both a type and a value now resolves to the type in type annotations, sonoBaseToStringno longer reportsslugbelow as an object.#12678
301402fThanks @nhedger! - Fixed biomejs/biome-vscode#1113: the language server now shows a warning when the configuration file can't be parsed. Previously, Biome stopped processing files without telling the user why.#12662
8c836ebThanks @dyc3! - Fixed #12645: the Markdown formatter no longer removes the blank line between a blockquote and the list that follows it, matching Prettier.#12662
8c836ebThanks @dyc3! - Fixed #12663: the Markdown formatter no longer removes the blank line between a table and the list that follows it, matching Prettier.#12576
735d370Thanks @jfmcdowell! - Fixed #12541: Markdown list items whose markers are indented 4 or more spaces now nest at the correct level. Previously the formatter could move such an item under the item before it, or join it to that item's text.1. Step - a - x - - y - - b + - y + - b#12575
0da9080Thanks @jfmcdowell! - Fixed formatting of Markdown block quotes inside deeply indented list items. WithproseWrap: "always", consecutive quote lines now wrap together within the same quote, while setext headings and fenced code blocks keep their structure.#12607
896d53eThanks @xucian! - Fixed #12542: the Markdown formatter is no longer idempotent when it formats tables.#12692
8ff63f4Thanks @NikitaCOEUR! - Fixed thelinux-x64-muslbinary not using jemalloc, which it already ships: it fell back to musl's allocator, andbiome checkon several threads could take minutes instead of seconds, for example in Alpine-based CI images.#12682
fa7cf4cThanks @dyc3! - Fixed #12679: whenmarkdown.parser.frontmatterandmarkdown.formatter.formatEmbedsare enabled, the Markdown formatter keeps the frontmatter of a fenced Markdown code block as written. Previously, it formatted the frontmatter as a thematic break and a paragraph, which removed the indentation of its YAML.Policy
#12649
343c8caThanks @JamBalaya56562! - Fixed #12643 and #12669: Biome now migrates the Prettier optionbracketSpacingtoformatter.bracketSpacing, both at the top level and insideoverrides. JSON and GraphQL files are now formatted with the same bracket spacing as JavaScript files.#12640
167bb00Thanks @latin-1! - FixeduseSortedPropertiesto withhold sorting fixes that would change the effective values of overlapping declarations, physical/logical border or corner properties, or declarations followed byall.Updated
noShorthandPropertyOverridesto recognize logical border, corner shape,position-try,text-box, andtransition-behavioroverrides.#12723
b6cbec8Thanks @dyc3! - Improved the performance ofbiome lint,biome check, andbiome cion files where rules report diagnostics with code fixes, by up to 12% with the default rules.#12664
6021da0Thanks @MindTooth! - Fixed Biome processingpnpm-lock.yamlfiles. These generated lockfiles are now protected from processing.#12501
90a4d74Thanks @ematipico! - Fixed an issue where the CLI, when it ran with--use-serveralongside an editor connected to the same daemon, checked the unsaved text of the files open in the editor instead of the files on disk, and could make the editor's text get lost. The CLI now checks the files on disk, and every editor and CLI run connected to the daemon keeps its own text of the files it opens.#12519
9ae56baThanks @dyc3! - The rulenoVueVIfWithVFornow also reportsv-else-ifandv-elseon the same element asv-for.#12702
df0f7ccThanks @dyc3! - Fixed parsing of default values in Vuev-forbindings. Biome now parses the default value as JavaScript, so it is formatted and linted like other template expressions instead of being reported as a parse error.#12656
25a00a2Thanks @dyc3! - Fixed non-JSON files inside the global settings directories of Zed, VS Code, and Cursor being parsed as JSON.#12501
90a4d74Thanks @ematipico! - Fixed an issue where the language server kept using the previous parser options for open files after the configuration changed. Open files are now parsed again with the new options, for examplejson.parser.allowComments.#12656
25a00a2Thanks @dyc3! - Improved the performance of Biome when it processes many files by up to 7%.#12661
066a077Thanks @dyc3! - Added the nursery rulenoVueDeprecatedListeners. It reports references to$listeners, which Vue 3 removed, in Vue templates and component objects. For example, Biome now reports<div v-on="$listeners" />andthis.$listenersinside a Vue component.v2.6.3Compare Source
Patch Changes
#12275
807e616Thanks @dyc3! - Added the new nursery rulenoArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. UseMath.min()orMath.max()instead.#12432
cf61682Thanks @dyc3! - Added the nursery rulenoBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example,array.sort((a, b) => a > b)never puts the first item before the second, so the array isn't sorted correctly.#12304
b4654c5Thanks @dyc3! - Added the new nursery rulenoEagerArrayMethodsInLoops, which reports.map()and.filter()calls in the header offor...ofloops. These calls build a new array that is only used by the loop.#12121
66c3791Thanks @dyc3! - Added the nursery rulenoNewRequire, which disallows callingrequirewithnew, such asnew require("app-header").#12316
34b520dThanks @dyc3! - Added the new nursery rulenoObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.#12258
cce2385Thanks @dyc3! - Added the nursery rulenoPathConcat, which disallows building file paths and URLs by joining strings to__dirname,__filename,import.meta.dirname,import.meta.filename, orimport.meta.url.#12287
e12ad78Thanks @dyc3! - Added the new nursery rulenoPlaywrightNthMethods, which disallows selecting Playwright elements by position withfirst(),last(), andnth(). A test that relies on the position of an element can act on a different element when the page changes.#12343
62ad123Thanks @vibbix! - Added the nursery rulenoSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an@layerblock are relative to it, so the inner layer below creates the sublayercomponents.componentsinstead of adding tocomponents.#12289
bbbd95dThanks @dyc3! - Added the nursery rulenoShortTimeValues, which reports CSS animation and transition times that are shorter than the configuredminimumnumber of milliseconds. The rule does nothing untilminimumis set.For example, the following code is invalid when
minimumConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.