RENOVATE: Update all non-major dependencies by renovate[bot] · Pull Request #183 · adobe/commerce-integration-starter-kit

renovate · 2026-08-31T03:54:21Z

This PR contains the following updates:

Package	Change	Type	Update
@biomejs/biome (source)	`2.5.9` → `2.5.11`	devDependencies	patch
@biomejs/biome (source)	`2.5.9` → `2.5.11`		patch
cloudflare/cloudflared	`2026.8.2` → `2026.8.3`		patch
grafana/otel-lgtm	`0.31.0` → `0.32.0`		minor
lint-staged	`17.3.0` → `17.4.1`	devDependencies	minor
ultracite (source)	`7.10.6` → `7.10.7`	devDependencies	patch

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.11`

Compare Source

Patch Changes

#11499 9743d0c Thanks @scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.
#11437 88f805e Thanks @Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.
```
{options.map(() =>
  <div />
  <div />
)}
```
#11437 88f805e Thanks @Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.
#11507 e2fc036 Thanks @dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.
#11398 afc4615 Thanks @dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.
#11526 372cd68 Thanks @dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

The refactor enabling these fixes also improves the performance of the rule.
#11458 a7cd286 Thanks @dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.
#11515 382b15d Thanks @dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.
#11516 6f40e82 Thanks @levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.
```
const result = computed(() => list.find((item) => item.label === "a"));
```
Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.
#11495 496268d Thanks @Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.
#11407 6ef52b0 Thanks @1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.
#11322 5c353e6 Thanks @jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

For example, the following snippet triggers the rule:
```
<div set:html={content} />
```
#11462 18883b7 Thanks @dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.
#11476 3270ca4 Thanks @dyc3! - Fixed #10330: Vue interpolation delimiters now stay attached to whitespace-sensitive element boundaries and adjacent inline siblings, wrapping their expression when needed to fit the configured line width. Interpolations followed by text now also converge after one formatting pass.
```
-<v-btn v-if="store.state.user" variant="text" to="/my-rooms"
-  >{{ $t("nav.my-rooms") }}</v-btn
->
+<v-btn v-if="store.state.user" variant="text" to="/my-rooms">{{
+  $t("nav.my-rooms")
+}}</v-btn>
```
#11191 3e5367f Thanks @ematipico! - Added the nursery rule noUndeclaredCustomProperties, which reports references to custom properties that are not defined in available CSS, static HTML-like style attributes, or JSX string style attributes.

For example, the following snippet triggers the rule:
```
a { color: var(--undefined-color); }
```

#11435 7754894 Thanks @levrik! - Fixed: Variables and imports used as custom Vue directives are no longer reported as unused.

For example:

<script setup>
const vHighlight = {
  mounted: (element) => {
    element.style.color = "red";
  },
};
</script>

<template>
  <p v-highlight>Hello</p>
</template>

#11501 e6acded Thanks @aminya! - Improved the performance of useArraySortCompare by skipping type inference for calls to unrelated methods.
#11467 66b282c Thanks @dyc3! - Fixed #11464: Biome now parses parenthesized object literals returned from arrow functions when they contain a conditional expression and a nested arrow function.
#11456 db9aa2a Thanks @dyc3! - Fixed #10278: Marked the fix for noThisInStatic as unsafe by default.
#11502 652aedb Thanks @levrik! - noGlobalAssign no longer reports assignments to a Vue <script setup> binding from a template expression, when the binding's name happens to match a built-in global (e.g. open, parent, top).

For example, this no longer triggers a diagnostic:
```
<script setup>
const open = defineModel();
</script>

<template>
  <button @click="open = !open">Toggle</button>
</template>
```

`v2.5.10`

Compare Source

Patch Changes

#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.
```
<div /* block comment */ class="something"></div>
<Component /* c */ client:load />
```
#11403 8f7786f Thanks @Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.
#11438 3133ffa Thanks @Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.
```
<div>{/* a note */}</div>
<div class={/* a note */}>x</div>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro expressions containing a comment failing to parse.
```
<div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>
```
#11403 8f7786f Thanks @Princesseuh! - Added support for Astro's fragment shorthand.
```
<>
  <p>a</p>
</>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.
```
---
const a = "</script>";
// </script> in a comment
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.
```

---
this is text, not frontmatter
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed an Astro frontmatter block ending early on a line that merely starts with a dash.
```
---
--count;
---
```
#11403 8f7786f Thanks @Princesseuh! - Fixed the children of an Astro element carrying is:raw being parsed as markup instead of raw text. This now also covers <script> and <style>, whose contents Astro emits verbatim rather than processing, so they are no longer linted as JavaScript or CSS.
```
<article is:raw><% awesome %></article>
<script is:raw>{{ mustache }}</script>
```
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting attribute names that start with a colon, such as :href.
#11403 8f7786f Thanks @Princesseuh! - Fixed the Astro parser failing to recover from a malformed closing tag such as <div></{<//, so that a later mistake is reported where it happens rather than cascading.
#11403 8f7786f Thanks @Princesseuh! - Fixed { inside an Astro <math> element opening an expression. MathML is foreign content where Astro parses no expressions, so LaTeX such as R^{2x} now survives as text. <svg> is unaffected.
#11403 8f7786f Thanks @Princesseuh! - Fixed {{ at the start of an Astro expression being read as an interpolation. Astro has no {{ }} syntax, so {{ a: 1 }} and <Comp a={{ b: 1 }} /> are object literals.
#11403 8f7786f Thanks @Princesseuh! - Fixed expressions inside an Astro <pre> or <textarea> being read as raw text. Astro parses both as ordinary elements, so their markup and interpolations are now parsed, and a variable used only inside one is no longer reported as unused.
```
<pre>{value}</pre>
<textarea><div>{value}</div></textarea>
```
#11403 8f7786f Thanks @Princesseuh! - Added support for template literal attribute values in Astro, such as <div class=`a ${b} c`>.
#11403 8f7786f Thanks @Princesseuh! - Fixed Astro rejecting HTML5 unquoted attribute values that contain `, =, ' or ", such as <a href=a=b> and <a href=a'b>.
#11393 dec5a8f Thanks @1678092075! - Fixed #11207: useStrictMode no longer reports Vue event handlers such as @click="count++".
#11431 c065f99 Thanks @levrik! - Fixed #11429: Variables and imports used by Vue same-name bindings such as :disabled or v-bind:disabled are no longer reported as unused.
#11409 405dedb Thanks @ematipico! - Fixed a memory leak in the LSP server where memory usage kept growing over long editor sessions.
#11422 a51eff7 Thanks @dyc3! - Fixed #11416: Biome no longer crashes when parsing incomplete {let} or {const} declarations in Svelte files.
#11378 34b715c Thanks @Netail! - Added extra rule sources from @eslint/css. biome migrate eslint detects rules in your eslint configurations more reliably.
#11403 8f7786f Thanks @Princesseuh! - Fixed {#, {/, {: and {@ being read as Svelte block openings in every HTML-like file. They are now Svelte-only, so in HTML, Vue and Angular files a sequence such as {#if x} is ordinary text instead of a parse error.
#11443 8d45229 Thanks @ematipico! - Fixed #11390: noFloatingPromises no longer performs unnecessary type inference on call arguments when checking methods of non-generic class instances created with new.
#11425 9c2667b Thanks @dyc3! - Fixed #6426: GritQL plugins now match and rewrite metavariables embedded in quoted strings.
#11441 00317c3 Thanks @dyc3! - Improved performance of useNamedCaptureGroup, noMisplacedAssertion, noSkippedTests, noExportsInTest, noDuplicateTestHooks, noIdenticalTestTitle, useTestHooksInOrder, and useTestHooksOnTop.

cloudflare/cloudflared (cloudflare/cloudflared)

`v2026.8.3`

Compare Source

SHA256 Checksums:

cloudflared-amd64.pkg: 95f499fba19643893212bbe912733e5e80394af111fea6c67f066b46a70c3194
cloudflared-arm64.pkg: 8dc66777e1ace4c24a347857eef63a3cbb23ccdfbf3ba72f3d621bdd5e6af203
cloudflared-darwin-amd64.tgz: 936aa4ed783b0e191fac48e7140c34605b25d8d5c0495c3599c90e350ae6e4c4
cloudflared-darwin-arm64.tgz: 50a04624531e7a98ddb65f1223905e32f84e7488ed3ee8dadcd3260aa8932603
cloudflared-fips-linux-amd64: 99e8ad6e87228afd213890cc39176b7dd02b76fcf81030af4040645b89f8a205
cloudflared-fips-linux-amd64.deb: 9510f46a1fad3bd8f31551fad978bde9e0e92796be01a25288efbac413db3980
cloudflared-fips-linux-x86_64.rpm: 0697fbebcd25a61db5cbcffc7ba47a561ec94291327b365752f469f6cecafe46
cloudflared-linux-386: 691e3a2b8926f90ec4fcec4f4bc8e38b1de14f6232d93a24f6cb7b2c23ab5e92
cloudflared-linux-386.deb: 68e7e2cec6934a6bc5f06ca6703d55e898369fef297e33e3b23d02b1f7282a4e
cloudflared-linux-386.rpm: b2fc222ef9410ee81a04e0058b00a4e4944274c253c2eb1ebda0ea63583c18b5
cloudflared-linux-aarch64.rpm: 85bda0d5385757549c04f036571a453a933b6e9f32f3cd84cf8692ccf25f5bb6
cloudflared-linux-amd64: f29324fe934d1e100617484c78deef803c4dc2cd351d645bbde42e96b4fccc5e
cloudflared-linux-amd64.deb: 660b348d473bba81997445b534e7eaefaf4c4e16331866922326c338a7013dd9
cloudflared-linux-arm: 7a7cac4ad4561ff55797eaf27aae1a0be37498c85502715bc87e3bad919d928c
cloudflared-linux-arm.deb: f1ee5c2e42771d1f63313910e792a1d1e355fc1b55cd69bececac7a8ff6acb12
cloudflared-linux-arm.rpm: ce958ce42ad88b5a436e5b6d72bb988e23167f4f670cea69c05f2702c3ad62e7
cloudflared-linux-arm64: 4bcfd35521a7cbc545ebfd5d57334a71ee180e2a64874981f374c81472118391
cloudflared-linux-arm64.deb: 2c0d991ed6061e55d2e0148b794d86f594ddb473c1db43cf0647278b62e326ab
cloudflared-linux-armhf: d8bd9d00c15398ef4c6e6bc1a0486b6f1eb8c0dfd93e7479e07a121aa4e3dd57
cloudflared-linux-armhf.deb: dc1265f86d79c425cacc4e8a2a036a6276d189f118d95c319e833e74ae4b0f2e
cloudflared-linux-armhf.rpm: 4ac13cfb739c30330739655ae4aad6cf24a53d860b11de0d33f1e48885915045
cloudflared-linux-x86_64.rpm: f442d9c2bd9afc595c6fbe9d1a19a9ff0d3a44911c0ccc00666fa28c08d1a31f
cloudflared-windows-386.exe: bdfab00122a3c2a0772d3f176445f6baf0271fed71656d0902cbc23a0eea7048
cloudflared-windows-386.msi: a21d6c4a60e076e2e34a2df800fd94e70aabd6427f07d55c987ae11cabc025bf
cloudflared-windows-amd64.exe: 83e726ed18ea78c5ad5213c4c3a3a27051393950d2bc8ed4de69bec12d14eaae
cloudflared-windows-amd64.msi: 4236c68898bcd9d1e9aeea70268e6482d13a7bb9ea111e532299f35fde82f721

grafana/docker-otel-lgtm (grafana/otel-lgtm)

`v0.32.0`

Compare Source

What's Changed

OpenTelemetry & LGTM

chore(deps): update dependency grafana to v13.2.0 by @renovate-sh-app[bot] in #1768
chore(deps): update dependency obi to v0.12.1 by @renovate-sh-app[bot] in #1778
chore(deps): update grafana/otel-lgtm docker tag to v0.31.0 by @renovate-sh-app[bot] in #1784
chore(deps): update dependency obi to v0.12.2 by @renovate-sh-app[bot] in #1788
chore(deps): update dependency pyroscope to v2.3.0 by @renovate-sh-app[bot] in #1793

Other Changes

fix: validate Renovate workflow dependencies by @zeitlinger in #1767

Full Changelog: grafana/docker-otel-lgtm@v0.31.0...v0.32.0

lint-staged/lint-staged (lint-staged)

`v17.4.1`

Compare Source

Patch Changes

#1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

haydenbleasel/ultracite (ultracite)

`v7.10.7`

Compare Source

Patch Changes

15f7ae0: Add support for the Aube package manager: ultracite init --pm aube is now accepted and projects with an aube-lock.yaml lockfile are detected automatically
1afc8fe: Re-declare selected Oxlint JS plugins on the root config so dependency analyzers see them. ultracite init --linter oxlint --js-plugins ... now generates const jsPlugins = selectJsPlugins([...]) and adds jsPlugins: jsPlugins.jsPlugins to the root config (also when the full ultracite/oxlint/js-plugins preset is extended). Knip only resolves jsPlugins from the root Oxlint config and never walks extends, so eslint-plugin-github, eslint-plugin-sonarjs, and oxlint-plugin-react-doctor were reported as unused devDependencies. Oxlint dedupes the plugin between the root and the extended preset, so linting is unchanged.

Also fix ultracite update dropping the js-plugins preset from extends when the config used the documented import jsPlugins, { jsPluginSettings } from "ultracite/oxlint/js-plugins" form: the import parser only matched bare default imports. The regenerated full-preset config keeps settings: jsPluginSettings on the root as well.
20b06bf: Ignore .alchemy across all linters and formatters. Alchemy (alchemy.run) writes local state and generated bindings to a .alchemy directory. It is now part of the shared ignore patterns synced into Biome's files.includes and imported by oxlint, oxfmt, and ESLint, and the Stylelint preset ignores it via ignoreFiles. Prettier needs no change: it already respects .gitignore/.prettierignore.
6e9286c: Run lefthook install during ultracite init through the same spawn adapter as every other tool invocation instead of execSync, so it no longer goes through a shell and gets the same Windows command resolution as husky, the linters, and editor extension installs.
8b24f34: Add support for the Nub package manager: ultracite init --pm nub is now accepted and projects with a nub.lock lockfile are detected automatically (requires nypm ^0.6.9)
240cb6b: Install into the workspace root correctly for Nub and Aube monorepos: nypm emits no root selector for them, so nub add ran without -w and was refused. Ultracite now hands nypm pnpm's flag set for these pnpm-compatible CLIs, producing nub add --workspace-root --save-dev ultracite
44ecbba: Add Vitest type-test files (**/*.{test-d,spec-d}.{ts,tsx,js,jsx}) to the test-file globs so the shared test relaxations and the Vitest rule overrides apply to them, and enable the Vitest plugin's typecheck setting in the ESLint preset so expectTypeOf/assertType count as assertions.
7ba6bb8: Package the reusable Ultracite agent skill with the npm distribution.

Configuration

📅 Schedule: (UTC)

Branch creation
- "on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

renovate Bot requested a review from a team as a code owner August 31, 2026 03:54

renovate Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

renovate-approve Bot approved these changes Aug 31, 2026

View reviewed changes

renovate Bot force-pushed the renovate/all-non-major branch from 1d5726a to ffef430 Compare August 31, 2026 12:04

RENOVATE: Update all non-major dependencies

87a5003

renovate Bot force-pushed the renovate/all-non-major branch from ffef430 to 87a5003 Compare August 31, 2026 12:04

renovate Bot merged commit 79b2523 into main Aug 31, 2026
4 checks passed

renovate Bot deleted the renovate/all-non-major branch August 31, 2026 17:29

Navigation Menu

Uh oh!

RENOVATE: Update all non-major dependencies - #183

RENOVATE: Update all non-major dependencies#183
renovate[bot] merged 1 commit into
mainfrom
renovate/all-non-major

renovate Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.5.11

Patch Changes

v2.5.10

Patch Changes

v2026.8.3

SHA256 Checksums:

v0.32.0

What's Changed

OpenTelemetry & LGTM

Other Changes

v17.4.1

Patch Changes

v7.10.7

Patch Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 31, 2026 •

edited

Loading

`v2.5.11`

`v2.5.10`

`v2026.8.3`

`v0.32.0`

`v17.4.1`

`v7.10.7`