fix(deps): update repo-tooling by renovate[bot] · Pull Request #277 · CMLPlatform/relab

renovate · 2026-09-14T01:32:43Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
@astrojs/starlight (source)	`0.41.10` → `0.42.1`	dependencies	minor	`0.42.3` (+1)
@biomejs/biome (source)	`2.5.12` → `2.5.13`	pnpm.catalog.default	patch	`2.5.14`
@jest/globals (source)	`30.5.0` → `30.5.1`	devDependencies	patch	`30.5.2`
@playwright/test (source)	`1.62.1` → `1.63.0`	pnpm.catalog.default	minor
@scalar/api-reference (source)	`1.67.0` → `1.68.0`	dependencies	minor	`1.71.0` (+4)
@types/node (source)	`26.4.1` → `26.6.1`	pnpm.catalog.default	minor	`26.6.2`
@typescript-eslint/parser (source)	`8.68.0` → `8.70.0`	devDependencies	minor	`8.70.1`
astral-sh/uv-pre-commit	`0.12.10` → `0.12.15`	repository	patch	`0.12.18` (+2)
astro (source)	`7.2.9` → `7.3.2`	pnpm.catalog.default	minor	`7.3.4` (+1)
baseline-browser-mapping	`2.11.20` → `2.11.24`	devDependencies	patch	`2.11.25`
commitizen-tools/commitizen	`v4.18.0` → `v4.18.1`	repository	patch	`v4.19.0`
eslint (source)	`10.9.1` → `10.10.0`	devDependencies	minor	`10.11.0`
eslint-plugin-react-refresh	`0.5.5` → `0.5.7`	devDependencies	patch
happy-dom	`20.12.0` → `20.14.5`	devDependencies	minor
hls.js	`1.7.2` → `1.7.3`	dependencies	patch
jest (source)	`30.5.0` → `30.5.1`	devDependencies	patch	`30.5.2`
lucide-react-native (source)	`1.40.0` → `1.46.0`	dependencies	minor	`1.47.0`
monaco-editor@0.55.1>dompurify	`3.4.14` → `3.4.15`	pnpm-workspace.overrides	patch
node (source)	`26.8.1` → `26.9.0`		minor	`v26.10.0`
playwright (source)	`1.62.1` → `1.63.0`	pnpm.catalog.default	minor
pnpm (source)	`12.1.0+sha512.d9b8276d97f6ec86e49815877f91ee9f63cee61f2063b304e43b6dab8fa07ce8a9afd46d2facd39f921e6a9d06b3c75a81349c7b888c2d22886bae0229901037` → `12.4.2`	packageManager	minor	`12.5.1` (+1)
postcss (source)	`8.5.26` → `8.5.28`	devDependencies	patch
react-hook-form (source)	`7.87.0` → `7.88.0`	dependencies	minor
react-native-qrcode-svg	`6.3.22` → `6.3.24`	dependencies	patch	`6.3.26` (+1)
tailwind-merge (source)	`3.6.0` → `3.7.0`	dependencies	minor
uniwind (source)	`1.11.0` → `1.12.0`	dependencies	minor
uv	`0.12.10` → `0.12.15`		patch	`0.12.18` (+2)
zizmorcore/zizmor-pre-commit	`v1.30.0` → `v1.30.1`	repository	patch
zod (source)	`4.5.4` → `4.6.5`	dependencies	minor

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

withastro/starlight (@astrojs/starlight)

`v0.42.1`

Compare Source

Patch Changes

#4198 96a44d4 Thanks @mayank99! - Removes the popover attribute from the sidebar pane on desktop viewports. This ensures the desktop sidebar doesn't stay in a "hidden" popover visibility state.

`v0.42.0`

Compare Source

Minor Changes

#3572 292fb17 Thanks @HiDeoo! - Distributes package as JavaScript files with dedicated type declaration files instead of TypeScript source files.
#4121 2623ae6 Thanks @delucis! - Simplifies markup for Starlight’s mobile menu toggle

⚠️ Potentially breaking change: If you use a theme plugin, custom styles, or component overrides targeting the MobileMenuToggle button or PageFrame components, you may need to adjust these for the new markup. The button is no longer wrapped in a <starlight-menu-button> custom element and no longer uses the aria-expanded attribute. Instead, you can use the .sl-menu-button class name to target the button and the :popover-open pseudo-class to style the menu open state specifically.

In the following example, custom styles for the menu button are updated for the new approach:
```
- starlight-menu-button button {
+ .sl-menu-button {
  color: var(--sl-color-text);
}

- starlight-menu-button[aria-expanded='true'] button {
+ .sl-menu-button:has(~ :popover-open) {
  color: var(--sl-color-text-accent-high);
}
```
See MobileMenuToggle.astro and PageFrame.astro on GitHub for the full source code of the updated components.
#3572 292fb17 Thanks @HiDeoo! - Removes the tagline configuration option, which was never used.

If your configuration included a tagline option, you can safely remove it without any replacement.
#4134 6135f01 Thanks @HiDeoo! - Updates internal @astrojs/mdx, @astrojs/markdown-satteri, and satteri dependencies.

⚠️ BREAKING CHANGE: The following minimum versions are now required:
- astro v7.2.10 or later
- @astrojs/markdown-satteri 0.4.0 or later (if you use it)
- @astrojs/markdown-remark 7.3.0 or later (if you use it)
Please update Starlight and Astro together:
```
npx @astrojs/upgrade
```
#4121 2623ae6 Thanks @delucis! - Refactors Starlight’s mobile menu toggle to work when JavaScript fails or is disabled

⚠️ BREAKING CHANGE: This release drops official support for Chromium-based browsers prior to version 116 (released August 2023), Safari-based browsers prior to version 17.0 (released September 2023), and Firefox prior to version 125 (released April 2024). You can find a list of currently supported browsers and their versions using this browserslist query.

This change also removes the data-mobile-menu-expanded attribute, which was previously added to <body> while the mobile menu is open. If you have custom code that was depending on this attribute, you will need to update it to use a new selector to check if the mobile menu is open.

In the following example, a custom background colour for the site header while the menu is open is updated for the new approach:
```
- [data-mobile-menu-expanded] header {
+ body:has(sl-sidebar-pane:popover-open) header {
  background-color: var(--sl-color-bg);
}
```

`v0.41.11`

Compare Source

Patch Changes

#4167 32a5e29 Thanks @HiDeoo! - Fixes a layout issue and anchor links appearing for hidden headings, e.g. footnote headings, when markdown.headingLinks is enabled or the <AnchorHeading> component is used.
#4148 cdfafd8 Thanks @ematipico! - Optimizes sidebar data generation logic to speed up sites with large sidebars

biomejs/biome (@biomejs/biome)

`v2.5.13`

Compare Source

Patch Changes

#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
```
/* Invalid */
@import 'foo.css';

.my-style {
  color: red;
}

/* Valid */
@import 'foo.css' layer(base);

@layer base {
  .my-style {
    color: red;
  }
}
```
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
```
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
```
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.
#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.
#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.
#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.
#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
```
const kibibyte = 2 ^ 10; // 8, not 1024
```
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.
#11676 840a52a Thanks @dyc3! - Fixed #11672 and #11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.
#11660 49485ed Thanks @ematipico! - Fixed #11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.
#11664 9a73b9c Thanks @dyc3! - Improved the performance of useRegexpExec.
#11661 5341b3f Thanks @ematipico! - Fixed #7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

#11630 62e1fc5 Thanks @dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

 <span>
-  {head.median - base.median >= 0 ? "+" : "−"}
-  {formatMs(Math.abs(head.median - base.median))}
+  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
 </span>

#11658 ed4bfa4 Thanks @fredrikblau! - Fixed #11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.
```
<h1 set:html={heading} />
<h2 set:text={heading}></h2>
```
```
<template>
  <h1 v-html="heading"></h1>
  <h2 v-text="heading"></h2>
</template>
```
#11613 47d7383 Thanks @ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.
#11655 fd8fc74 Thanks @ematipico! - Fixed #6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.
#11618 21a10cf Thanks @siketyan! - Fixed #11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:
```
interface Context {
  doSomething(): Promise<void>;
}

declare function test(callback: (ctx: Context) => Promise<void>): void;

test(async (ctx) => {
	ctx.doSomething(); // now reported as a floating promise
});
```
#11698 b019982 Thanks @denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.
```
-background-image: url(image\);
+background-image: url(image\ );
```
#11622 c23e4c7 Thanks @Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.
```
<iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />
```
#11606 de0528f Thanks @dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.
#11670 4969ee1 Thanks @ematipico! - Fixed #6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.
#11687 09d97d9 Thanks @hori-design! - Fixed #11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.
#11595 a64d757 Thanks @dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.
#11675 353cbae Thanks @dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.
#11625 ea20e5a Thanks @denbezrukov! - Improved linting performance for large CSS and JSON files.
#11670 4969ee1 Thanks @ematipico! - Fixed #7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.
#11655 fd8fc74 Thanks @ematipico! - Fixed #8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.
#11669 579f401 Thanks @denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

jestjs/jest (@jest/globals)

`v30.5.1`

Compare Source

Fixes

[jest-config] Don't warn about global-only options in the config that supplies the global config - the root config a project resolves to, or the first entry of --projects when no root config is passed (#16411)
[jest-config, jest-types] Stop accepting reporters, coverageReporters, workerIdleMemoryLimit, cwd and runnerOptions in a project config - they were silently ignored, and now warn like the other global-only options (#16411)
[jest-config, jest-validate] Warn about maxWorkers and coverageThreshold in a project config instead of dropping them without a word (#16411)
[jest-resolve] Match moduleNameMapper patterns against the specifier as written again (reverting #16390) (#16417)
[jest-runtime] Resolve package imports specifiers like #dep under ESM again (#16413)

Chore & Maintenance

[jest-util] Name the testEnvironmentOptions.globalsCleanup option and link the docs from the JEST-01 deprecation warning, and document the option's modes (#16404)

microsoft/playwright (@playwright/test)

`v1.63.0`

Compare Source

scalar/scalar (@scalar/api-reference)

`v1.68.0`

Minor Changes

#9937: Add a way to open the request body editor in the Form view by default. Set the defaultRequestBodyView: 'form' config option, or the x-scalar-default-request-body-view extension in your OpenAPI document (which also works per source). Defaults to raw, and falls back to raw when a body cannot be shown as a form.

Patch Changes

#10066: Show referenced model names for array branches in schema composition selectors.
#10058: chore: upgrade to Storybook 10.5.10 and drop the third-party dark mode addon

typescript-eslint/typescript-eslint (@typescript-eslint/parser)

`v8.70.0`

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

`v8.69.0`

Compare Source

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

astral-sh/uv-pre-commit (astral-sh/uv-pre-commit)

withastro/astro (astro)

`v7.3.2`

Compare Source

Patch Changes

#17896 a548223 Thanks @matthewp! - Fixes <script>/<style> rendering in MDX so that only literal content (including content injected by remark/rehype plugins) is treated as trusted markup. A dynamic value passed as a <script>/<style> child (e.g. <script>{value}</script>) is now escaped like any other element's content instead of being rendered raw. Use set:html to explicitly opt a dynamic value back into raw rendering.
#17931 c1a6a89 Thanks @astro-factory! - Fixes the dev toolbar returning a 504 "Outdated Optimize Dep" error when a workspace-linked package imports a dependency that Vite's initial scan did not discover
#17908 42e9188 Thanks @astro-factory! - Fixes i18n fallback routing replacing the first substring match instead of the actual locale segment, which mangled paths like /energy/en/about into /esergy/en/about
#17936 4b92ddc Thanks @astro-factory! - Fixes sessions breaking in dev mode with the Cloudflare adapter when middleware is present
Updated dependencies [a548223]:
- @astrojs/markdown-satteri@0.4.1

`v7.3.1`

Compare Source

Patch Changes

#17899 0389640 Thanks @ematipico! - Fixes an error that prevented projects using astro:assets from starting or building

`v7.3.0`

Compare Source

Minor Changes

#17767 ce7c91f Thanks @astro-factory! - Adds --ignore-lock flag to astro preview, allowing multiple preview servers to run simultaneously on different ports. This is useful for E2E testing workflows (e.g., Playwright) that need to run several preview servers at once.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds a logger parameter to image services hooks

Custom image services now receive Astro's runtime logger as an extra argument. Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
```
import type { LocalImageService } from 'astro';

const service: LocalImageService = {
  // ...
  async transform(inputBuffer, transform, imageConfig, logger) {
    logger.warn(`Could not optimize "${transform.src}". Passing it through unchanged.`);
    return { data: inputBuffer, format: 'png' };
  },
};
```
Astro's built-in Sharp service now uses this logger for the warnings it emits when it encounters an unexpected or unsupported source format.
#17818 c0b6581 Thanks @florian-lefebvre! - Adds logger to the context object passed to cache providers

Custom cache providers now receive Astro's runtime logger on the context passed to onRequest(). Messages logged with it are routed through the destination configured in logger and respect your log level, instead of being written straight to the console:
```
import type { CacheProvider } from 'astro';

const provider: CacheProvider = {
  name: 'my-cache',
  async onRequest({ request, url, logger }, next) {
    logger.warn(`Skipping cache for ${url.pathname} because the response sets a cookie.`);
    return next();
  },
  // ...
};
```
Astro's built-in memoryCache() provider now uses this logger for the warnings it emits when it skips caching a response that sets cookies, and when a background revalidation fails.

Patch Changes

#17818 c0b6581 Thanks @florian-lefebvre! - Updates Astro's remaining internal warnings and errors to be written through the configured logger instead of directly to the console, when possible
#17886 e747cba Thanks @matthewp! - Fixes the memory cache provider to skip responses with Vary: Cookie or Vary: *
#17885 916b738 Thanks @Princesseuh! - Improves build performance for sites with a large number of pages coming from a large amount of different modules.
#17795 15e2deb Thanks @matthewp! - Adds concurrent rendering support for experimental.incrementalBuild, including when using @astrojs/cloudflare

Incremental builds no longer disable caching when build.concurrency is greater than 1. Projects that set build.concurrency: 1 to keep the cache enabled can remove that workaround. Cloudflare builds also reduce serialization overhead for large prerendered pages.
#17879 21c34a6 Thanks @matthewp! - Fixes missing styles, links, and scripts from content collection entries rendered inside server islands
#17861 3193988 Thanks @ethanstoner! - Fixes i18n fallback routes being generated with a corrupted path when the locale code also appears at the start of a later path segment. A page such as src/pages/en/enterprise.astro with fallback: { es: 'en' } produced the route /es/esterprise instead of /es/enterprise, so the fallback never matched the intended URL. Only the leading locale segment is rewritten now.

`v7.2.10`

Compare Source

Patch Changes

#17262 f8e9458 Thanks @Princesseuh! - Fixes @astrojs/markdown-remark being pinned to an exact version.
#17874 10c7e63 Thanks @astro-factory! - Fixes SSR manifest placeholder not being replaced when the server build is minified, which caused a runtime Invalid URL crash at server boot
#17869 2548abf Thanks @ematipico! - Fixes a case where the logger was improperly initialized at runtime in dev.
#17878 76eff3d Thanks @ematipico! - Fixes browser heuristic caching for cached responses that include Last-Modified or ETag validators
#17833 413a6e7 Thanks @astro-factory! - Fixes prerender conflict warnings to correctly identify the route that first rendered a duplicate pathname, instead of misattributing the conflict to an unrelated route that merely matches the URL pattern
#17872 f7191cc Thanks @jx-grxf! - Fixes Markdown images in content collections rendering an empty srcset attribute when no responsive candidates are generated.
#17755 157c500 Thanks @matthewp! - Fixes a bug where editing a content collection entry during astro dev on Windows kept serving stale content until the dev server was restarted. The data store now notifies the dev server directly after each write instead of relying only on the file watcher, which can miss the atomic rename that commits the write on some platforms.
Updated dependencies [f8e9458, f8e9458]:
- @astrojs/internal-helpers@0.11.0
- @astrojs/markdown-satteri@0.4.0