Skip to content

deps: bump the npm-minor-patch group across 1 directory with 9 updates - #48

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-9bb2511a91
Open

deps: bump the npm-minor-patch group across 1 directory with 9 updates#48
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-9bb2511a91

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown

Bumps the npm-minor-patch group with 9 updates in the / directory:

Package From To
@biomejs/biome 2.4.12 2.5.6
ipaddr.js 2.3.0 2.4.0
@vitest/coverage-v8 4.1.5 4.1.10
tsx 4.22.4 4.23.1
vitest 4.1.5 4.1.10
yaml 2.8.3 2.9.0
@modelcontextprotocol/sdk 1.29.0 1.30.0
fastmcp 4.0.1 4.12.1
hono 4.12.32 4.12.33

Updates @biomejs/biome from 2.4.12 to 2.5.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes

  • #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

  • #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

     .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }

  • #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

  • #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

  • #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

  • #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

  • #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

  • #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

  • #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

    The following statements are now reported:

    type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.6

Patch Changes

  • #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

  • #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

     .example {
   value: outer(
     1,
     /* comment */
     nested(
-      first,
-      second
-    )
+        first,
+        second
+      )
   );
 }

  • #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

  • #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

  • #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

  • #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

  • #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

  • #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

  • #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

    The following statements are now reported:

    type AsyncCallback = () => Promise<void>;
declare const callback: AsyncCallback;
callback();
[1, 2, 3].map(async (value) => value);

  • #10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

Updates ipaddr.js from 2.3.0 to 2.4.0

Changelog

Sourced from ipaddr.js's changelog.

2.4.0 - 2026-05-03

  • remove Bower support
  • add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges
Commits
  • 61bd6df Bump version.
  • f563e5c Add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges.
  • 9992db9 Rename 2001:10::/28 from deprecated to deprecatedOrchid.
  • 5686480 Indicate which RFCs reserved some IPv6 ranges.
  • 9199d3f Remove bower.json
  • 1915d22 spelling: string
  • 85eb23c spelling: javascript
  • 4222342 spelling: ip v6
  • 1c76a35 spelling: hexadecimal
  • 82e4b6d spelling: addresses
  • Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 4.1.5 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits

Updates tsx from 4.22.4 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

  • support tsImport after global preload (8d4ffc2)
  • watch: avoid clearing piped output (95d0672)
  • watch: treat script and dependency paths literally (79fddde)

Performance Improvements

  • index transform cache lazily (e818ad6)
  • load esbuild lazily in CLI (d067938)
  • map Node TypeScript formats directly (cdcc623)
  • use sync module hooks on Node v22.22.3+ (f8992f1)

This release is also available on:

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

Features

This release is also available on:

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

  • isolate hook state per async module.register() registration (a305f36)

This release is also available on:

Commits
  • 79fddde fix(watch): treat script and dependency paths literally
  • e818ad6 perf: index transform cache lazily
  • cdcc623 perf: map Node TypeScript formats directly
  • d067938 perf: load esbuild lazily in CLI
  • 95d0672 fix(watch): avoid clearing piped output
  • 6fd4607 docs: add per-page metadata
  • f4176d8 docs: generate sitemap
  • 8d4ffc2 fix: support tsImport after global preload
  • f0e89b2 docs: document Node's public type-stripping API vs internal loader path
  • f8992f1 perf: use sync module hooks on Node v22.22.3+
  • Additional commits viewable in compare view

Updates vitest from 4.1.5 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • Additional commits viewable in compare view

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

  • Disable alias resolution with maxAliasCount:0 (#677)
  • Handle invalid unicode escapes (e1a1a77)
  • Apply minFractionDigits only to decimal strings (#676)
Commits
  • ddb21b0 2.9.0
  • 167365b docs: Clarify that not all errors can be avoided
  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
  • ccdf743 2.8.4
  • f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
  • e1a1a77 fix: Handle invalid unicode escapes
  • a163ea0 style: Satify Prettier
  • b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
  • 93c951b chore: Bump JSR version to v2.8.3 (#673)
  • Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates fastmcp from 4.0.1 to 4.12.1

Release notes

Sourced from fastmcp's releases.

v4.12.1

4.12.1 (2026-07-27)

Bug Fixes

  • export SessionError and FastMCPError from the package root (#298) (8041340), closes #407

v4.12.0

4.12.0 (2026-07-25)

Features

  • add FastMCP.connect for custom transports — closes #176 (8f6b751)

v4.11.0

4.11.0 (2026-07-25)

Features

  • expose progress message, document streamContent as non-spec — closes #198 (0687e3b)

v4.10.0

4.10.0 (2026-07-25)

Features

  • add jsonSchemaAdapter for plain JSON Schema support — closes #54 (#244) (dcddc98)

v4.9.2

4.9.2 (2026-07-25)

Bug Fixes

  • avoid client capability warning in stateless mode (#267) (13e4fc4)

v4.9.1

4.9.1 (2026-07-25)

Bug Fixes

v4.9.0

4.9.0 (2026-07-24)

... (truncated)

Commits
  • 8041340 fix: export SessionError and FastMCPError from the package root (#298)
  • 8f6b751 feat: add FastMCP.connect for custom transports — closes #176
  • 9bcde68 docs: correct progress message revision and client behavior claims
  • 0687e3b feat: expose progress message, document streamContent as non-spec — closes #198
  • dcddc98 feat: add jsonSchemaAdapter for plain JSON Schema support — closes #54 (#244)
  • 13e4fc4 fix: avoid client capability warning in stateless mode (#267)
  • 81bad14 fix(auth): persist OAuth proxy state (#286)
  • 61a156b chore: update code example with current get-jwks and fast-jwt API (#252)
  • da227b7 feat: add non-interactive tool calls to fastmcp dev (#280)
  • a87f791 fix(stdio): add stdin close/end listeners to prevent zombie/orphan processes ...
  • Additional commits viewable in compare view

Updates hono from 4.12.32 to 4.12.33

Release notes

Sourced from hono's releases.

v4.12.33

What's Changed

Full Changelog: honojs/hono@v4.12.32...v4.12.33

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
deps: bump the npm-minor-patch group across 1 directory with 9 updates
0102159 
Bumps the npm-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.12` | `2.5.6` |
| [ipaddr.js](https://github.com/whitequark/ipaddr.js) | `2.3.0` | `2.4.0` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.5` | `4.1.10` |
| [tsx](https://github.com/privatenumber/tsx) | `4.22.4` | `4.23.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.5` | `4.1.10` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [fastmcp](https://github.com/punkpeye/fastmcp) | `4.0.1` | `4.12.1` |
| [hono](https://github.com/honojs/hono) | `4.12.32` | `4.12.33` |



Updates `@biomejs/biome` from 2.4.12 to 2.5.6
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.6/packages/@biomejs/biome)

Updates `ipaddr.js` from 2.3.0 to 2.4.0
- [Changelog](https://github.com/whitequark/ipaddr.js/blob/main/Changes.md)
- [Commits](whitequark/ipaddr.js@v2.3.0...v2.4.0)

Updates `@vitest/coverage-v8` from 4.1.5 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/coverage-v8)

Updates `tsx` from 4.22.4 to 4.23.1
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](privatenumber/tsx@v4.22.4...v4.23.1)

Updates `vitest` from 4.1.5 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.3...v2.9.0)

Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `fastmcp` from 4.0.1 to 4.12.1
- [Release notes](https://github.com/punkpeye/fastmcp/releases)
- [Commits](punkpeye/fastmcp@v4.0.1...v4.12.1)

Updates `hono` from 4.12.32 to 4.12.33
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.32...v4.12.33)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.6
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: ipaddr.js
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: tsx
  dependency-version: 4.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: fastmcp
  dependency-version: 4.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-patch
- dependency-name: hono
  dependency-version: 4.12.33
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency typescript Related to the TypeScript packages or toolchain labels Aug 3, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 3, 2026 12:26
@dependabot dependabot Bot added dependencies Pull requests that update a dependency typescript Related to the TypeScript packages or toolchain labels Aug 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency typescript Related to the TypeScript packages or toolchain

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants