Skip to content

chore(deps): update linters - #2375

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/linters
Open

chore(deps): update linters#2375
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/linters

Conversation

@renovate

@renovate renovate Bot commented Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
aqua:jonwiggins/xmloxide tools minor 0.4.4 → 0.5.0 age confidence
biome tools patch 2.5.5 → 2.5.8 age confidence
editorconfig-checker tools minor 3.8.0 → 3.11.1 age confidence
google-java-format tools minor 1.35.0 → 1.36.1 age confidence
npm:renovate (source) tools major 43.279.1 → 44.16.0 44.26.0 (+23) age confidence
ruff tools patch 0.16.0 → 0.16.2 age confidence
rumdl tools patch v0.2.43 → v0.2.54 age confidence
typos tools minor 1.48.0 → 1.49.0 age confidence
zizmor tools minor 1.28.0 → 1.29.0 age confidence

Release Notes

jonwiggins/xmloxide (aqua:jonwiggins/xmloxide)

v0.5.0

Compare Source

Changed
  • XPath attribute results are first-class attribute nodes (#​47).
    Node-sets (XPathValue::NodeSet) now hold XPathNode entries — either a
    tree node or an attribute identified by owner element and index — instead
    of bare NodeIds. This fixes a family of wrong-answer bugs rooted in the
    old one-value-per-element override map: //a/@x != //a/@y comparisons no
    longer clobber each other's values, @* yields one node per attribute
    (previously only the first per element), count((//a)[1]/@href) returns a
    number instead of a type error, name()/local-name()/namespace-uri()
    work on attribute nodes, @attr/.. navigates to the owner element,
    predicates evaluate with the attribute as context node, and namespace
    declarations (xmlns, xmlns:*) are no longer visible as attributes per
    the XPath 1.0 data model. Mixed node-sets (//a | //a/@x) sort in
    document order with attributes directly after their owner element.
    Breaking: code matching XPathValue::NodeSet must handle
    XPathNode; use .anchor() for the owning tree node or
    .as_tree_node() to filter attributes out. The single-match collapse
    (attribute paths returning XPathValue::String) is gone — convert with
    string() where a string is wanted. xmllint --xpath prints attribute
    results as name="value" lines, matching libxml2. The C API keeps
    xmloxide_xpath_nodeset_item() (returns the owner element id for
    attributes) and adds xmloxide_xpath_nodeset_item_is_attribute(),
    ..._attr_name(), and ..._attr_value().
  • XPath step predicates apply per context node per XPath 1.0 §2.4:
    //a/b[1] now selects the first b of every a (previously the first
    of the merged set), and position()/last() in step predicates are
    relative to each context node's own node-set, matching libxml2. The
    parenthesized form (//a/b)[1] keeps global-position semantics.
  • Schematron rules with attribute contexts (context="//@id") now fire
    with the attribute itself as the context node — . is the attribute
    value and <value-of select="."/> reads it, per ISO Schematron.
    Previously such rules either never fired (single match) or misfired
    against the owner element.
Security
  • Fix exponential-time entity recursion check (#​42, thanks @​hey-jj). The
    WFC: No Recursion walks in the DTD validator re-visited entities once per
    path, so a 474-byte document with chained entity declarations took 8+
    seconds to parse and a 694-byte one about 22 hours. The walks (including
    parameter entities and ATTLIST-default validation) now memoize entities
    proven acyclic, making the check linear in the size of the DTD. Cycle
    detection is unaffected.
  • Bound element nesting across entity expansions. Entity replacement text
    is parsed by nested sub-parsers, which now inherit the outer parser's
    nesting depth so total element depth stays bounded by
    ParseOptions::max_depth instead of max_depth per expansion level.
Fixed
  • General entity replacement text is parsed as content per XML 1.0 §4.4
    (#​43, thanks @​hey-jj). EntityRef nodes now carry their parsed expansion
    as children: character references in declarations are expanded when
    replacement text is built (§4.5), nested entity references are included,
    and markup-bearing entities produce real element children instead of
    escaped text — while serialization still emits &name;, keeping
    round-trips lossless. Replacement text must match the content production
    (§4.3.2); unbalanced or split tags are rejected. Entity expansion is
    subject to the expansion counter, a nesting-depth cap, and the 5x
    amplification guard, matching libxml2. DTD content-model validation sees
    through entity references (§4.4.3), so entity-supplied elements are
    validated too.
  • XPath != uses its own existential semantics for node-sets per XPath
    1.0 §3.4 (#​44, thanks @​hey-jj). != was evaluated as not(=), inverting
    empty-node-set comparisons and breaking multi-node sets (both = and !=
    can hold at once). Node-set vs boolean keeps boolean-conversion semantics;
    scalar comparisons are unchanged. An absent attribute step now also yields
    an empty node-set (false under both = and !=) instead of an
    empty-string sentinel.
  • XPath filter-path continuations navigate instead of filtering (#​20,
    thanks @​ancientcatz). (//a)[1]/@href parsed to the same AST as
    (//a)[@href], so the trailing path acted as a predicate and
    string((//a)[1]/@href) returned the anchor text. A new
    Expr::FilterPath AST variant evaluates the continuation steps against
    the filter's node-set. Breaking: downstream exhaustive matches on
    xpath::ast::Expr must handle the new variant.
biomejs/biome (biome)

v2.5.8: Biome CLI v2.5.8

Compare Source

2.5.8

Patch Changes

What's Changed

New Contributors

Full Changelog: https://github.com/biomejs/biome/compare/@biomejs/biome@2.5.7...@​biomejs/biome@2.5.8

v2.5.7: Biome CLI v2.5.7

Compare Source

2.5.7

Patch Changes

  • #​10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

  • #​11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

  • #​10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

  • #​11184 135f476 Thanks @​subotac! - Fixed #​11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

  • #​8239 a519f9d Thanks @​cormacrelf! - Fixed #​8233, where Biome CLI in
    stdin mode didn't work correctly when handling files in projects with nested
    configurations. For example, with the following structure,
    --stdin-file-path=subdirectory/... would not use the nested configuration in
    subdirectory/biome.json:

    ├── biome.json
└── subdirectory
    ├── biome.json
    └── lib.js

    biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

    Now, the nested configuration is correctly picked up and applied.

    In addition, Biome now shows a warning if --stdin-file-path is provided but
    that path is ignored and therefore not formatted or fixed.

  • #​11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

    The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

    declare function schedule(handler: () => void): string;
declare function schedule(handler: () => Promise<void>): string | undefined;

schedule(async () => {}) ?? "fallback";

    The following code is also now invalid, because map(() => 42) returns 42:

    type Mapper<T> = () => T;
declare function map<T>(mapper: Mapper<T>): T;

map(() => 42) || flag;

  • #​11138 8c2c6bd Thanks @​ematipico! - Fixed #​11087: noUnnecessaryConditions no longer reports optional chains and nullish coalescing whose receiver can be nullish.

    For example, the optional chain and fallback in the following code are no longer reported:

    declare const usage: { range: { startDate: string } } | null;
const startDate = usage?.range.startDate ?? "N/A";

  • #​11118 9c16840 Thanks @​subotac! - Fixed #​11098: The HTML formatter now preserves the configured trailing newline when a file ends with a comment.

    -<!-- trailing comment -->
\ No newline at end of file
+<!-- trailing comment -->

  • #​11201 0e80610 Thanks @​Bishwas-py! - Fixed #​11182: suppression comments for noPositiveTabindex now suppress the rule in HTML files when the attributes of the element span multiple lines.

  • #​11079 607afd2 Thanks @​dyc3! - The HTML formatter now lays out the srcset attribute of <img> and <source> as the list of candidates it is. Runs of whitespace between candidates collapse, and once the list no longer fits on one line each candidate goes on its own line with the descriptors aligned:

    - <img srcset="/visual@0.5.png  400w, /visual.png 805w, /visual@2x.png 1610w, /visual@3x.png 2415w" />
+ <img
+   srcset="
+     /visual@0.5.png  400w,
+     /visual.png      805w,
+     /visual@2x.png  1610w,
+     /visual@3x.png  2415w
+   "
+ />

  • #​11156 fed72c7 Thanks @​saberoueslati! - Fixed #​11129: noUnusedVariables no longer reports Vue bindings as unused when they are assigned through automatically unwrapped template refs.

  • #​11124 d890b39 Thanks @​denbezrukov! - Fixed CSS formatting of line comments between a declaration colon and value to preserve their source indentation.

     .test {
   background:
-  /////// foo
-  // bar
+        /////// foo
+        // bar
     radial-gradient(circle, #&#8203;000, transparent);
 }

  • #​11113 3d8ab73 Thanks @​denbezrukov! - Fixed CSS formatting of long block comments between comma-separated property values:

     .foo {
   box-shadow:
-    1000px /* long long long long long long long long long long long long comment */ 1000px /* long long long long long long long long long comment */ 2px color(srgb 0.555555555 0.555555555 0.555555555),
+    1000px
+      /* long long long long long long long long long long long long comment */
+      1000px /* long long long long long long long long long comment */ 2px
+      color(srgb 0.555555555 0.555555555 0.555555555),
     1px 1px black;
 }

  • #​11127 da5c1a5 Thanks @​dyc3! - The HTML formatter now picks the quote character for an attribute by counting the quotes in the value rather than looking only for a double quote. &apos; and &quot; count as the characters they stand for, and only the character that ends up as the delimiter stays escaped:

    - <div title='123 &apos;&quot; 456'></div>
+ <div title="123 '&quot; 456"></div>

    Entities that are not quotes, such as &amp; or &[#&#8203;39](https://redirect.github.com/biomejs/biome/issues/39);, are left exactly as written.

  • #​11193 77035bb Thanks @​dyc3! - Fixed the HTML formatter collapsing the blank line between an element and the text that follows it. A blank line before text is now kept, the way one before another element already was:

      <div>foo</div>
-
  text

  • #​11106 ad80f57 Thanks @​dyc3! - The HTML formatter now writes the HTML5 doctype in lowercase, matching Prettier:

    - <!DOCTYPE html>
+ <!doctype html>

    This only applies to a plain .html file whose doctype stands alone. A doctype that names a DTD keeps the case it was written with, since the rest of the declaration is not lowercased either:

    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

    A .vue, .svelte, or .astro file keeps whatever the author wrote.

  • #​11188 60679db Thanks @​dyc3! - Fixed the HTML formatter printing a comment twice when it ended the line of the last element in a document:

    - text<!-- a --><!-- a -->
+ text<!-- a -->

  • #​11077 4dcd0d9 Thanks @​dyc3! - Fixed a bug where the HTML formatter collapsed the whitespace inside <textarea>, <xmp> and <plaintext>, changing what the page renders.

    - <textarea>
-  line one
- line two </textarea>
+ <textarea>line one line two</textarea>

    Biome now prints the content of these elements exactly as it appears in the source, matching the existing behavior for <pre>.

  • #​11194 abfbb11 Thanks @​dyc3! - Fixed the HTML formatter refusing to format a Svelte file containing an array pattern that skips a position:

    {#each animals as [, value]}
	<p>{value}</p>
{/each}

  • #​10094 e007143 Thanks @​THEjacob1000! - Fixed useSortedClasses to correctly detect unsorted classes in static member expression tagged templates (e.g. tw.div\...``). Previously, these were silently skipped due to surrounding whitespace trivia not being stripped from the tag name.

  • #​11078 10da30e Thanks @​dyc3! - Fixed Vue single-file components failing to parse when they contain a custom block such as <i18n> or <docs>, or a <template> written in another language. Their content is no longer read as HTML, so a block may hold whatever its own tooling expects:

    <docs>
This block is prose, and it may mention a `<my-component>` without closing it.
</docs>

<template lang="pug">
  .test
    #foo
</template>

    Previously both blocks produced a parse error and the whole file was left unformatted. Biome now prints their content unchanged while still formatting the opening tag.

  • #​11231 4afd901 Thanks @​ematipico! - Improved the performance of the following lint rules:

  • #​11134 2fa0a62 Thanks @​yanthomasdev! - Clarified the warning emitted when using the experimental json and json-pretty reporters.

  • #​11198 ed88b13 Thanks @​saberoueslati! - Fixed #​11171: variables referenced only inside a Svelte attachment ({@attach ...}) are no longer reported as unused by noUnusedVariables and noUnusedImports.

  • #​11155 6ee17ea Thanks @​dyc3! - Improved performance when printing diagnostics to the console.

  • #​11160 217f8ad Thanks @​dyc3! - Improved the performance of noFloatingPromises by skipping type inference for assignment statements, which are always considered handled.

  • #​11159 26c23d9 Thanks @​saberoueslati! - Fixed #​11144: noFloatingPromises no longer reports already-awaited optional Promise values.

  • #​11138 8c2c6bd Thanks @​ematipico! - Fixed #​11121: noUnnecessaryConditions no longer reports conditions based on an inapplicable function overload.

    For example, the condition in the following code is no longer reported because query({}) selects the overload that returns boolean:

    declare function query(options: { initial: string }): { isPending: false };
declare function query(options: { initial?: string }): { isPending: boolean };

const { isPending } = query({});
isPending || fallback;

  • #​11152 c4fc6a9 Thanks @​dyc3! - Improved the performance of collecting rule timings with --profile-rules in heavily multithreaded environments.

  • #​11128 4d3ff76 Thanks @​ematipico! - Fixed #​7635: noDeprecatedImports now detects deprecated ambient declarations that are exported separately.

  • #​11117 01f7ef5 Thanks @​subotac! - Fixed #​11014: noDelete no longer reports process.env["FOO"] style property deletions.

  • #​11168 9847e68 Thanks @​saberoueslati! - Added the nursery rule noNonScalableViewport, which reports viewport metadata that disables user scaling with user-scalable=no.

    For example:

    <meta name="viewport" content="width=device-width, user-scalable=no" />

  • #​11154 a1d6b1f Thanks @​dyc3! - Improved the performance of noImportCycles by skipping graph traversals for imports that cannot be part of a cycle.

  • #​11175 d96d6dd Thanks @​ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

What's Changed

New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 4am on Monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 10, 2026
@renovate
renovate Bot enabled auto-merge (squash) August 10, 2026 01:40
@github-actions

github-actions Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Benchmark results

Benchmark run finished with conclusion skipped for dffdb244f4e5f356f1ad69ff063a9b1f7122cd06.

Benchmark summary artifact was not found; see the workflow run for details.

@renovate
renovate Bot force-pushed the renovate/linters branch 7 times, most recently from f99a3b6 to 5503307 Compare August 12, 2026 00:40
@renovate
renovate Bot force-pushed the renovate/linters branch from 5503307 to c2b5224 Compare August 12, 2026 09:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@fstab fstab Awaiting requested review from fstab fstab is a code owner
@dhoard dhoard Awaiting requested review from dhoard dhoard is a code owner
@zeitlinger zeitlinger Awaiting requested review from zeitlinger zeitlinger is a code owner
@jaydeluca jaydeluca Awaiting requested review from jaydeluca jaydeluca is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants