chore(deps-dev): Bump the production-dependencies group with 7 updates #2

dependabot · 2026-01-26T10:17:43Z

Bumps the production-dependencies group with 7 updates:

Package	From	To
@biomejs/biome	`2.3.11`	`2.3.12`
@vitest/browser	`4.0.17`	`4.0.18`
@vitest/browser-playwright	`4.0.17`	`4.0.18`
@vitest/coverage-v8	`4.0.17`	`4.0.18`
playwright	`1.57.0`	`1.58.0`
turbo	`2.7.5`	`2.7.6`
vitest	`4.0.17`	`4.0.18`

Updates @biomejs/biome from 2.3.11 to 2.3.12

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.3.12

2.3.12

Patch Changes
#8653 047576d Thanks @dyc3! - Added new nursery rule noDuplicateAttributes to forbid duplicate attributes in HTML elements.
#8648 96d09f4 Thanks @BaeSeokJae! - Added a new nursery rule noVueOptionsApi.

Biome now reports Vue Options API usage, which is incompatible with Vue 3.6's Vapor Mode. This rule detects Options API patterns in <script> blocks, defineComponent(), and createApp() calls, helping prepare codebases for Vapor Mode adoption.

For example, the following now triggers this rule:
<script>
export default {
  data() {
    return { count: 0 };
  },
};
</script>
#8832 b08270b Thanks @Exudev! - Fixed #8809, #7985, and #8136: the noSecrets rule no longer reports false positives on common CamelCase identifiers like paddingBottom, backgroundColor, unhandledRejection, uncaughtException, and IngestGatewayLogGroup.

The entropy calculation algorithm now uses "average run length" to distinguish between legitimate CamelCase patterns (which have longer runs of same-case letters) and suspicious alternating case patterns (which have short runs).
#8793 c19fb0e Thanks @TheBaconWizard! - Properly handle parameters metavariables for arrow_function GritQL queries. The following biome search command no longer throws an error:
biome search 'arrow_function(parameters=$parameters, body=$body)'
#8561 981affb Thanks @wataryooou! - Fixed noUnusedVariables to ignore type parameters declared in ambient contexts such as declare module blocks.

#8817 652cfbb Thanks @dyc3! - Fixed #8765: The HTML parser can now parse directive modifiers with a single colon, e.g. @keydown.:.
#8704 a1914d4 Thanks @Netail! - Added the nursery rule noRootType. Disallow the usage of specified root types. (e.g. mutation and/or subscription)

Invalid:
{
  "options": {
    "disallow": ["mutation"]
  }

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.3.12

Patch Changes
#8653 047576d Thanks @dyc3! - Added new nursery rule noDuplicateAttributes to forbid duplicate attributes in HTML elements.
#8648 96d09f4 Thanks @BaeSeokJae! - Added a new nursery rule noVueOptionsApi.

Biome now reports Vue Options API usage, which is incompatible with Vue 3.6's Vapor Mode. This rule detects Options API patterns in <script> blocks, defineComponent(), and createApp() calls, helping prepare codebases for Vapor Mode adoption.

For example, the following now triggers this rule:
<script>
export default {
  data() {
    return { count: 0 };
  },
};
</script>
#8832 b08270b Thanks @Exudev! - Fixed #8809, #7985, and #8136: the noSecrets rule no longer reports false positives on common CamelCase identifiers like paddingBottom, backgroundColor, unhandledRejection, uncaughtException, and IngestGatewayLogGroup.

The entropy calculation algorithm now uses "average run length" to distinguish between legitimate CamelCase patterns (which have longer runs of same-case letters) and suspicious alternating case patterns (which have short runs).
#8793 c19fb0e Thanks @TheBaconWizard! - Properly handle parameters metavariables for arrow_function GritQL queries. The following biome search command no longer throws an error:
biome search 'arrow_function(parameters=$parameters, body=$body)'
#8561 981affb Thanks @wataryooou! - Fixed noUnusedVariables to ignore type parameters declared in ambient contexts such as declare module blocks.

#8817 652cfbb Thanks @dyc3! - Fixed #8765: The HTML parser can now parse directive modifiers with a single colon, e.g. @keydown.:.
#8704 a1914d4 Thanks @Netail! - Added the nursery rule noRootType. Disallow the usage of specified root types. (e.g. mutation and/or subscription)

Invalid:
{
  "options": {
    "disallow": ["mutation"]
  }
}

... (truncated)

Commits

fd33f86 ci: release (#8671)
a53fc75 chore: update sponsors (#8844)
4ee3bda feat(graphql_analyze): implement useLoneAnonymousOperation (#8616)
71b5c6e feat(js_analyze): implement noExcessiveClassesPerFile (#8753)
d6b2bda feat(js_analyze): implement noFloatingClasses (#8754)
17ed9d3 feat(js_analyze): implement noDivRegex (#8757)
291c9f2 feat(biome_js_analyze): port useInlineScriptId from Next.js (#8624)
96d09f4 feat(lint): add noVueOptionsApi rule (#8648)
39eb545 fix(biome_configuration): revert URL brackets (#8766)
365f7aa feat(js_analyze): implement noDuplicateEnumValues (#8711)
Additional commits viewable in compare view

Updates @vitest/browser from 4.0.17 to 4.0.18

Release notes

Sourced from @vitest/browser's releases.

v4.0.18

   🚀 Experimental Features

experimental: Add onModuleRunner hook to worker.init - by @sheremet-va in vitest-dev/vitest#9286 (ea837)

   🐞 Bug Fixes

Use meta.url in createRequire - by @sheremet-va in vitest-dev/vitest#9441 (e0572)

browser: Hide injected data-testid attributes - by @sheremet-va in vitest-dev/vitest#9503 (f8989)

ui: Process artifact attachments when generating HTML reporter - by @macarie in vitest-dev/vitest#9472 (22543)

    View changes on GitHub

Commits

4d3e3c6 chore: release v4.0.18
See full diff in compare view

Updates @vitest/browser-playwright from 4.0.17 to 4.0.18

Release notes

Sourced from @vitest/browser-playwright's releases.

v4.0.18

   🚀 Experimental Features

experimental: Add onModuleRunner hook to worker.init - by @sheremet-va in vitest-dev/vitest#9286 (ea837)

   🐞 Bug Fixes

Use meta.url in createRequire - by @sheremet-va in vitest-dev/vitest#9441 (e0572)

browser: Hide injected data-testid attributes - by @sheremet-va in vitest-dev/vitest#9503 (f8989)

ui: Process artifact attachments when generating HTML reporter - by @macarie in vitest-dev/vitest#9472 (22543)

    View changes on GitHub

Commits

4d3e3c6 chore: release v4.0.18
See full diff in compare view

Updates @vitest/coverage-v8 from 4.0.17 to 4.0.18

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.0.18

   🚀 Experimental Features

experimental: Add onModuleRunner hook to worker.init - by @sheremet-va in vitest-dev/vitest#9286 (ea837)

   🐞 Bug Fixes

Use meta.url in createRequire - by @sheremet-va in vitest-dev/vitest#9441 (e0572)

browser: Hide injected data-testid attributes - by @sheremet-va in vitest-dev/vitest#9503 (f8989)

ui: Process artifact attachments when generating HTML reporter - by @macarie in vitest-dev/vitest#9472 (22543)

    View changes on GitHub

Commits

4d3e3c6 chore: release v4.0.18
See full diff in compare view

Updates playwright from 1.57.0 to 1.58.0

Release notes

Sourced from playwright's releases.

v1.58.0

📣 Playwright CLI+SKILLs 📣

We are adding a new token-efficient CLI mode of operation to Playwright with the skills located at playwright-cli. This brings the long-awaited official SKILL-focused CLI mode to our story and makes it more coding agent-friendly.

It is the first snapshot with the essential command set (which is already larger than the original MCP!), but we expect it to grow rapidly. Unlike the token use, that one we expect to go down since snapshots are no longer forced into the LLM!

Timeline

If you're using merged reports, the HTML report Speedboard tab now shows the Timeline:

UI Mode and Trace Viewer Improvements

New 'system' theme option follows your OS dark/light mode preference

Search functionality (Cmd/Ctrl+F) is now available in code editors

Network details panel has been reorganized for better usability

JSON responses are now automatically formatted for readability

Thanks to @cpAdm for contributing these improvements!

Miscellaneous

browserType.connectOverCDP() now accepts an isLocal option. When set to true, it tells Playwright that it runs on the same host as the CDP server, enabling file system optimizations.

Breaking Changes ⚠️

Removed _react and _vue selectors. See locators guide for alternatives.

Removed :light selector engine suffix. Use standard CSS selectors instead.

Option devtools from browserType.launch() has been removed. Use args: ['--auto-open-devtools-for-tabs'] instead.

Removed macOS 13 support for WebKit. We recommend to upgrade your macOS version, or keep using an older Playwright version.

Browser Versions

Chromium 145.0.7632.6

Mozilla Firefox 146.0.1

WebKit 26.0

This version was also tested against the following stable channels:

Google Chrome 144

Microsoft Edge 144

Commits

961381e chore: mark 1.58.0 (#38921)
0c1b64c chore: hide stuff (#38882)
b1fd5d0 test: unflake some ui-mode tests (#38907)
faf317c chore: tune press/type via cli (#38898)
ba4b983 docs: add v1.58 release notes (#38879)
00fb7a9 chore: implement shard weights feedback (#38902)
42d4f18 test: unflake/skip/fix some tests (#38905)
42b9784 feat(dot): onTestPause + make --pause private (#38904)
428b557 fix(html): truncate step titles (#38884)
5959834 chore(list): onTestPaused (#38777)
Additional commits viewable in compare view

Updates turbo from 2.7.5 to 2.7.6

Release notes

Sourced from turbo's releases.

Turborepo v2.7.6

What's Changed

Docs

fix: Fix AI chat not opening on home page by @anthonyshew in vercel/turborepo#11514

docs: Add update-versioned-schema-json codemod documentation by @anthonyshew in vercel/turborepo#11513

fix: Make showcase page logos theme-aware, grayscale by @anthonyshew in vercel/turborepo#11517

fix: Sync favicon to browser theme preference on initial load by @anthonyshew in vercel/turborepo#11518

docs: Add sitemap.md and link from all docs pages by @anthonyshew in vercel/turborepo#11515

feat: Add md tracking for AI usage analytics by @molebox in vercel/turborepo#11526

docs: Update $schema recommendation to use versioned subdomain by @anthonyshew in vercel/turborepo#11519

feat: Add loading spinner while AI chat looks up sources by @anthonyshew in vercel/turborepo#11531

fix: Use container queries for navbar to handle AI chat panel by @anthonyshew in vercel/turborepo#11532

fix: Add turbo-site label to feedback submissions by @molebox in vercel/turborepo#11536

fix(docs): Update "Edit this page on GitHub" link to new content path by @clay-curry in vercel/turborepo#11534

fix: Move md tracking to middleware for static optimization by @molebox in vercel/turborepo#11535

feat: Add stream-with-experimental-timestamps UI mode by @anthonyshew in vercel/turborepo#11538

feat: Add CopyPrompt component for AI-assisted documentation by @anthonyshew in vercel/turborepo#11537

fix: Simplify VersionWarning to show on all versioned subdomains by @anthonyshew in vercel/turborepo#11542

@turbo/codemod

feat(turbo-codemod): Add update-versioned-schema-json transformer by @anthonyshew in vercel/turborepo#11502

Changelog

chore: Update serde to 1.0.228 and swc crates for compatibility by @anthonyshew in vercel/turborepo#11498

fix(scope): Don't inject package name when user provides directory filter by @anthonyshew in vercel/turborepo#11500

docs: Add READMEs for all Rust crates by @anthonyshew in vercel/turborepo#11503

chore: Upgrade pnpm by @anthonyshew in vercel/turborepo#11506

feat: Agent Skill by @anthonyshew in vercel/turborepo#11541

chore: Update turborepo skill version during release by @anthonyshew in vercel/turborepo#11543

fix: Validate turbo version from lockfile is a semver string by @anthonyshew in vercel/turborepo#11546

New Contributors

@clay-curry made their first contribution in vercel/turborepo#11534

Full Changelog: vercel/turborepo@v2.7.5...v2.7.6

Turborepo v2.7.6-canary.3

What's Changed

Docs

feat: Add CopyPrompt component for AI-assisted documentation by @anthonyshew in vercel/turborepo#11537

fix: Simplify VersionWarning to show on all versioned subdomains by @anthonyshew in vercel/turborepo#11542

Changelog

feat: Agent Skill by @anthonyshew in vercel/turborepo#11541

chore: Update turborepo skill version during release by @anthonyshew in vercel/turborepo#11543

Full Changelog: vercel/turborepo@v2.7.6-canary.2...v2.7.6-canary.3

... (truncated)

Commits

2147bf9 publish 2.7.6 to registry
a49e07e fix: Validate turbo version from lockfile is a semver string (#11546)
c95d539 release(turborepo): 2.7.6-canary.3 (#11544)
07599d1 chore: Update turborepo skill version during release (#11543)
94b9a99 fix: Simplify VersionWarning to show on all versioned subdomains (#11542)
464d25b feat: Add CopyPrompt component for AI-assisted documentation (#11537)
84910df feat: Agent Skill (#11541)
f7f1581 release(turborepo): 2.7.6-canary.2 (#11539)
2bbb2dd feat: Add stream-with-experimental-timestamps UI mode (#11538)
46232aa fix: Move md tracking to middleware for static optimization (#11535)
Additional commits viewable in compare view

Updates vitest from 4.0.17 to 4.0.18

Release notes

Sourced from vitest's releases.

v4.0.18

   🚀 Experimental Features

experimental: Add onModuleRunner hook to worker.init - by @sheremet-va in vitest-dev/vitest#9286 (ea837)

   🐞 Bug Fixes

Use meta.url in createRequire - by @sheremet-va in vitest-dev/vitest#9441 (e0572)

browser: Hide injected data-testid attributes - by @sheremet-va in vitest-dev/vitest#9503 (f8989)

ui: Process artifact attachments when generating HTML reporter - by @macarie in vitest-dev/vitest#9472 (22543)

    View changes on GitHub

Commits

4d3e3c6 chore: release v4.0.18
ea837de feat(experimental): add onModuleRunner hook to worker.init (#9286)
e057281 fix: use meta.url in createRequire (#9441)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 7 updates: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.3.11` | `2.3.12` | | [@vitest/browser](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser) | `4.0.17` | `4.0.18` | | [@vitest/browser-playwright](https://github.com/vitest-dev/vitest/tree/HEAD/packages/browser-playwright) | `4.0.17` | `4.0.18` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.0.17` | `4.0.18` | | [playwright](https://github.com/microsoft/playwright) | `1.57.0` | `1.58.0` | | [turbo](https://github.com/vercel/turborepo) | `2.7.5` | `2.7.6` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.17` | `4.0.18` | Updates `@biomejs/biome` from 2.3.11 to 2.3.12 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.3.12/packages/@biomejs/biome) Updates `@vitest/browser` from 4.0.17 to 4.0.18 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/browser) Updates `@vitest/browser-playwright` from 4.0.17 to 4.0.18 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/browser-playwright) Updates `@vitest/coverage-v8` from 4.0.17 to 4.0.18 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/coverage-v8) Updates `playwright` from 1.57.0 to 1.58.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.57.0...v1.58.0) Updates `turbo` from 2.7.5 to 2.7.6 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.7.5...v2.7.6) Updates `vitest` from 4.0.17 to 4.0.18 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.3.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@vitest/browser" dependency-version: 4.0.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@vitest/browser-playwright" dependency-version: 4.0.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 4.0.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: playwright dependency-version: 1.58.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: turbo dependency-version: 2.7.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: vitest dependency-version: 4.0.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-01-26T10:17:44Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps-dev): Bump the production-dependencies group with 7 updates #2

chore(deps-dev): Bump the production-dependencies group with 7 updates #2

Uh oh!

dependabot bot commented on behalf of github Jan 26, 2026

Uh oh!

dependabot bot commented on behalf of github Jan 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps-dev): Bump the production-dependencies group with 7 updates #2

Are you sure you want to change the base?

chore(deps-dev): Bump the production-dependencies group with 7 updates #2

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 26, 2026

Biome CLI v2.3.12

2.3.12

Patch Changes

2.3.12

Patch Changes

v4.0.18

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

v4.0.18

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

v4.0.18

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

v1.58.0

📣 Playwright CLI+SKILLs 📣

Timeline

UI Mode and Trace Viewer Improvements

Miscellaneous

Breaking Changes ⚠️

Browser Versions

Turborepo v2.7.6

What's Changed

Docs

@​turbo/codemod

Changelog

New Contributors

Turborepo v2.7.6-canary.3

What's Changed

Docs

Changelog

v4.0.18

🚀 Experimental Features

🐞 Bug Fixes

View changes on GitHub

Uh oh!

dependabot bot commented on behalf of github Jan 26, 2026

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`@turbo/codemod`