Skip to content

build(deps-dev): bump the typescript-tooling group across 1 directory with 3 updates#6

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/typescript-tooling-54c6e5fcc4
Closed

build(deps-dev): bump the typescript-tooling group across 1 directory with 3 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/typescript-tooling-54c6e5fcc4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026

Bumps the typescript-tooling group with 3 updates in the / directory: @biomejs/biome, @types/node and typescript.

Updates @biomejs/biome from 2.4.0 to 2.4.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.12

2.4.12

Patch Changes

  • #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

    describe("foo", () => {});
    describe("foo", () => {
      // invalid: same title as previous describe block
      test("baz", () => {});
      test("baz", () => {}); // invalid: same title as previous test case
    });
  • #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

  • #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

    For example, the following snippets trigger the rule:

    function createComponent(label) {
      function MyComponent() {
        return <div>{label}</div>;
      }
      return MyComponent;
    }
    function Parent() {
      function Child() {
        return <div />;
      }
      return <Child />;
    }
  • #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

  • #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

  • #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.12

Patch Changes

  • #9376 9701a33 Thanks @​dyc3! - Added the nursery/noIdenticalTestTitle lint rule. This rule disallows using the same title for two describe blocks or two test cases at the same nesting level.

    describe("foo", () => {});
    describe("foo", () => {
      // invalid: same title as previous describe block
      test("baz", () => {});
      test("baz", () => {}); // invalid: same title as previous test case
    });
  • #9889 7ae83f2 Thanks @​dyc3! - Improved the diagnostics for useForOf to better explain the problem, why it matters, and how to fix it.

  • #9916 27dd7b1 Thanks @​Jayllyz! - Added a new nursery rule noComponentHookFactories, that disallows defining React components or custom hooks inside other functions.

    For example, the following snippets trigger the rule:

    function createComponent(label) {
      function MyComponent() {
        return <div>{label}</div>;
      }
      return MyComponent;
    }
    function Parent() {
      function Child() {
        return <div />;
      }
      return <Child />;
    }
  • #9980 098f1ff Thanks @​ematipico! - Fixed #9941: Biome now emits a warning diagnostic when a file exceed the files.maxSize limit.

  • #9942 9956f1d Thanks @​dyc3! - Fixed #9918: useConsistentTestIt no longer panics when applying fixes to chained calls such as test.for([])("x", () => {});.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noGlobalObjectCalls diagnostic to better explain why calling global objects like Math or JSON is invalid and how to fix it.

  • #9902 3f4d103 Thanks @​ematipico! - Fixed #9901: the command lint --write is now idempotent when it's run against HTML-ish files that contains scripts and styles.

  • #9891 4d9ac51 Thanks @​dyc3! - Improved the noMultiStr diagnostic to explain why escaped multiline strings are discouraged and what to use instead.

  • #9966 322675e Thanks @​siketyan! - Fixed #9113: Biome now parses and formats @media and other conditional blocks correctly inside embedded CSS snippets.

... (truncated)

Commits

Updates @types/node from 20.14.0 to 25.6.0

Commits

Updates typescript from 5.9.3 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

Commits
  • 050880c Bump version to 6.0.3 and LKG
  • eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
  • ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
  • 0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
  • 607a22a Bump version to 6.0.2 and LKG
  • 9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
  • 35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
  • e175b69 Bump version to 6.0.1-rc and LKG
  • af4caac Update LKG
  • 8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 22, 2026
@dependabot dependabot Bot changed the title build(deps-dev): bump the typescript-tooling group with 3 updates build(deps-dev): bump the typescript-tooling group across 1 directory with 3 updates Apr 23, 2026
Bumps the typescript-tooling group with 3 updates: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [typescript](https://github.com/microsoft/TypeScript).


Updates `@biomejs/biome` from 2.4.0 to 2.4.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.12/packages/@biomejs/biome)

Updates `@types/node` from 20.14.0 to 25.6.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `typescript` from 5.9.3 to 6.0.3
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](microsoft/TypeScript@v5.9.3...v6.0.3)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: typescript-tooling
- dependency-name: "@types/node"
  dependency-version: 25.6.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: typescript-tooling
- dependency-name: typescript
  dependency-version: 6.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: typescript-tooling
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/typescript-tooling-54c6e5fcc4 branch from 54d4344 to 9edbdbf Compare April 23, 2026 00:08
@theagenticguy
Copy link
Copy Markdown
Owner

Superseded by #18 (bulk dep bump).

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 23, 2026

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@theagenticguy theagenticguy deleted the dependabot/npm_and_yarn/typescript-tooling-54c6e5fcc4 branch April 23, 2026 00:09
theagenticguy added a commit that referenced this pull request Apr 23, 2026
## Summary

Sweep of every outdated direct dependency in the workspace, bringing
each one to its latest version — except for two intentional holds
(TypeScript 6, Zod 4) that need their own migration PRs.

## What's bumped

**Safe minors + patches** (no behavior changes on our surface):

| Package | From | To |
|---|---|---|
| `@biomejs/biome` | 2.4.0 | 2.4.12 |
| `fast-xml-parser` | 5.7.0 | 5.7.1 |
| `piscina` | 5.1.3 | 5.1.4 |
| `envinfo` | 7.14.0 | 7.21.0 |
| `lru-cache` | 11.2.2 | 11.3.5 |

**Safe majors** (no source-level breakage; verified via full build +
test matrix):

| Package | From | To |
|---|---|---|
| `@apidevtools/swagger-parser` | 10.1.1 | 12.1.0 |
| `@commitlint/cli` | 19.6.1 | 20.5.0 |
| `@commitlint/config-conventional` | 19.6.0 | 20.5.0 |
| `@types/node` | 20.14.0 | 22.19.17 (Node 22 LTS) |
| `commander` | 13.1.0 | 14.0.3 |
| `listr2` | 9.0.4 | 10.2.1 |
| `write-file-atomic` | 6.0.0 | 7.0.1 |

**Deliberately deferred** (need real migration work; track in follow-up
PRs):

- `typescript` 5.9.3 → 6.x — many workspace deps peer-declare
`typescript@^5`; the jump needs a compatibility sweep first.
- `zod` 3 → 4 — breaking changes (`.merge()` → `.extend()`, stricter
coercion, different result shape) that touch the MCP + SARIF schema
layers.

## License allowlist update

`lru-cache` switched its declared license from `ISC` → `BlueOak-1.0.0`
at 11.3.x. BlueOak-1.0.0 is an OSI-approved permissive license
(explicitly designed as an MIT/ISC-class modernization with no
ShareAlike / attribution friction).

Added `BlueOak-1.0.0` and `0BSD` to the CI license allowlist
(`.github/workflows/ci.yml`, `mise.toml`) to match what's actually in
the SBOM today. `SECURITY.md` + `CONTRIBUTING.md` updated to mirror.

## Supply chain

- `osv-scanner` — 0 issues on the refreshed 705-package lockfile.
- `SBOM.cdx.json` regenerated from the new lockfile.
- `THIRD_PARTY_LICENSES.md` regenerated (705 components).

## Drive-by fix

`packages/cli/src/commands/setup.test.ts` asserted the bundled plugin
manifest version was `2.0.0` (stale from the pre-launch internal
versioning). Updated to `0.1.0` to match the launch version and unblock
`pnpm -r test`.

## Closes

Should supersede these open Dependabot PRs (will auto-close on next
scan): #6, #7, #8, #9, #10, #11, #12, #13, #14, #15.

## Test plan

- [x] `pnpm install` resolves cleanly
- [x] `pnpm -r build` — all workspaces green
- [x] `pnpm -r exec tsc --noEmit` — 0 type errors
- [x] `pnpm -r test` — 1 stale-assertion fixed, remainder green
- [x] `bash scripts/check-banned-strings.sh` — PASS
- [x] `osv-scanner scan source --lockfile=pnpm-lock.yaml` — 0 issues
- [x] `license-checker-rseidelsohn --onlyAllow '...'` — 0 violations
theagenticguy added a commit that referenced this pull request May 10, 2026
## Summary

V1-launch readiness sweep: cherry-picks three known-good upstream bug
fixes from the post-filter testbed, closes two residual smoke gaps, and
deeply refreshes the v1 docs against current reality.

### Bug fixes (5 of 7 from UPSTREAM_BUGS.md)

| Severity | Bug | Fix |
|---|---|---|
| HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF
into operator's CWD instead of the scanned repo | `c43c5aa fix(cli):
scan ingests SARIF into the scanned repo, not CWD` |
| HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted
EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp
asserts 29 tools, matching the v1.0 server` |
| HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance
gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard
surfaces all 17 acceptance gates` |
| MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter /
@duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()`
undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves
native bindings from owner workspaces` |
| LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when
`CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1
fix(embedder): isolate http-embedder tests from operator env` |

Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes
#1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a`
from the post-filter sibling — every changed file:line coordinate
verified to match upstream HEAD before pick.

### Spec-coordinate hygiene
- `fad766f` — scrub `AC-A-7` / `AC-A-10` from
`scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are
not ADRs).
- `e186aea` — restore ADR-permanent spec coordinates in
`docs/adr/0013-m7-default-flip-and-abstraction.md` and
`docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an
earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out,
ADR text is the explicit place where coordinates ARE allowed.

Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero
hits.

### Docs refresh
- `898192e` — README: status flipped from "v0.1.0 initial public
release" to "v1 — feature-complete on M1–M7" (the prerelease caveat
stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across
the mermaid diagram, table heading, and mcp-package row; new "Parse
runtime — WASM default" section cross-linking ADR
`0013-parse-runtime-wasm-default.md`; Repository Layout regenerated
against `ls packages/` (now 17 packages — adds `cobol-proleap`,
`frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a
sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider);
requirements bumped to Node 22-or-24; tool table expanded to enumerate
the cross-repo federation tools and `pack_codebase`.
- `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed →
Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision
(`0013-parse-runtime-wasm-default.md` and
`0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR
0014 References block swapped from `.erpaval/specs/...` (gitignored,
will rot once packet graduates) to durable code-path citations.
- `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR;
AGENTS.md 28 → 29 tools and a divergence banner where it intentionally
drops session-local coordinates that CLAUDE.md still carries;
OBJECTIVES.md tool count + language count + sibling-testbed note.

## Validation

- `pnpm install --frozen-lockfile` ✅
- `mise run check` (lint + typecheck + test + banned-strings + verdict)
✅
- `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from
the new `[SKIP]` parsing case in `bench.test.ts`)
- `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped
- `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)**
- `node packages/cli/dist/index.js doctor` — `tree-sitter native
binding: OK`, `duckdb native binding: OK`, `graph-db native binding:
FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not
installed on this dev box, which is what `doctor` is supposed to
surface; the false-WARN this PR fixes is gone)
- `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits

## Test plan

- [ ] CI green on `chore/v1-upstream-bug-sweep`
- [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix
(Node 22 + Node 24)
- [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD
(manual verification on a downstream repo)
- [ ] `codehub bench` table now renders all 17 rows, none stuck on
"skipped — script crashed"
- [ ] License audit / banned-strings / commitlint stay green

## Out of scope

- Bug #5 (testbed-only pytest-timeout). Listed for reference in
UPSTREAM_BUGS.md; does not affect upstream.
theagenticguy added a commit that referenced this pull request May 10, 2026
## Summary

V1-launch readiness sweep: cherry-picks three known-good upstream bug
fixes from the post-filter testbed, closes two residual smoke gaps, and
deeply refreshes the v1 docs against current reality.

### Bug fixes (5 of 7 from UPSTREAM_BUGS.md)

| Severity | Bug | Fix |
|---|---|---|
| HIGH (data corruption) | #2 — `codehub scan <path>` ingested SARIF
into operator's CWD instead of the scanned repo | `c43c5aa fix(cli):
scan ingests SARIF into the scanned repo, not CWD` |
| HIGH (CI gate) | #3 — `scripts/smoke-mcp.sh` asserted
EXPECTED_TOOLS=19; server registers 29 | `433f684 fix(repo): smoke-mcp
asserts 29 tools, matching the v1.0 server` |
| HIGH (CI dashboard) | #4 — `codehub bench` surfaced 9 of 17 acceptance
gates (some titles also stale) | `c5f9047 fix(cli): bench dashboard
surfaces all 17 acceptance gates` |
| MEDIUM | #1 + #6 — `codehub doctor` false-WARN on tree-sitter /
@duckdb / @LadybugDB under pnpm strict isolation; `duckdb close()`
undefined on `@duckdb/node-api@1.x` | `c218c31 fix(cli): doctor resolves
native bindings from owner workspaces` |
| LOW (test hygiene) | #7 — `http-embedder.test.ts` cases failed when
`CODEHUB_EMBEDDING_*` env was set in operator's shell | `317bdf1
fix(embedder): isolate http-embedder tests from operator env` |

Bug #5 (testbed-only pytest-timeout) does not apply upstream. Bug fixes
#1+#6, #2, #3 are direct cherry-picks of `def988b`, `6924b1b`, `ec66d4a`
from the post-filter sibling — every changed file:line coordinate
verified to match upstream HEAD before pick.

### Spec-coordinate hygiene
- `fad766f` — scrub `AC-A-7` / `AC-A-10` from
`scripts/m7-parity-audit.sh` header (per the durable lesson; scripts are
not ADRs).
- `e186aea` — restore ADR-permanent spec coordinates in
`docs/adr/0013-m7-default-flip-and-abstraction.md` and
`docs/adr/0014-scip-references-and-embedder-fingerprint.md` after an
earlier docs-sweep commit over-scrubbed them. Per PR #74's carve-out,
ADR text is the explicit place where coordinates ARE allowed.

Final sweep: `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` returns zero
hits.

### Docs refresh
- `898192e` — README: status flipped from "v0.1.0 initial public
release" to "v1 — feature-complete on M1–M7" (the prerelease caveat
stays since `package.json` is still `0.1.x`); 28 → 29 MCP tools across
the mermaid diagram, table heading, and mcp-package row; new "Parse
runtime — WASM default" section cross-linking ADR
`0013-parse-runtime-wasm-default.md`; Repository Layout regenerated
against `ls packages/` (now 17 packages — adds `cobol-proleap`,
`frameworks`, `pack`, `policy`, `wiki`; drops `eval` and `gym` with a
sibling-testbed note); 14 → 15 GA languages (COBOL via regex provider);
requirements bumped to Node 22-or-24; tool table expanded to enumerate
the cross-repo federation tools and `pack_codebase`.
- `69eac8f` — ADR 0011 `Proposed → Accepted`; ADR 0013-m7 `Proposed →
Accepted`; sibling-ADR cross-link banner on the duplicate-0013 collision
(`0013-parse-runtime-wasm-default.md` and
`0013-m7-default-flip-and-abstraction.md` both landed concurrently); ADR
0014 References block swapped from `.erpaval/specs/...` (gitignored,
will rot once packet graduates) to durable code-path citations.
- `edb362e` — CHANGELOG `[Unreleased]` entry summarizing this PR;
AGENTS.md 28 → 29 tools and a divergence banner where it intentionally
drops session-local coordinates that CLAUDE.md still carries;
OBJECTIVES.md tool count + language count + sibling-testbed note.

## Validation

- `pnpm install --frozen-lockfile` ✅
- `mise run check` (lint + typecheck + test + banned-strings + verdict)
✅
- `pnpm -F @opencodehub/cli test` — **236/236** pass (was 235; +1 from
the new `[SKIP]` parsing case in `bench.test.ts`)
- `pnpm -F @opencodehub/embedder test` — 79 pass / 0 fail / 1 skipped
- `bash scripts/smoke-mcp.sh` — **PASS (29 tools listed)**
- `node packages/cli/dist/index.js doctor` — `tree-sitter native
binding: OK`, `duckdb native binding: OK`, `graph-db native binding:
FAIL` (real opt-in build status — the `@ladybugdb/core` binding is not
installed on this dev box, which is what `doctor` is supposed to
surface; the false-WARN this PR fixes is gone)
- `rg -n 'AC-[A-Z]-[0-9]' packages/ scripts/` — zero hits

## Test plan

- [ ] CI green on `chore/v1-upstream-bug-sweep`
- [ ] `codehub doctor` reports OK on tree-sitter + duckdb in CI matrix
(Node 22 + Node 24)
- [ ] `codehub scan /tmp/<fixture>` ingests into `<fixture>` not CWD
(manual verification on a downstream repo)
- [ ] `codehub bench` table now renders all 17 rows, none stuck on
"skipped — script crashed"
- [ ] License audit / banned-strings / commitlint stay green

## Out of scope

- Bug #5 (testbed-only pytest-timeout). Listed for reference in
UPSTREAM_BUGS.md; does not affect upstream.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant