chore(deps): update patch npm dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@ast-grep/napi (source)	^0.40.3 → ^0.40.4
@biomejs/biome (source)	^2.3.10 → ^2.3.11
@rslib/core (source)	0.19.0 → 0.19.1
@rstest/core (source)	^0.7.7 → ^0.7.8

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

ast-grep/ast-grep (@​ast-grep/napi)

v0.40.4

Compare Source

• feat: support --files-with-matches to list all files like ripgrep #2371
• fix: use new assert_cmd command #2399
• chore(deps): update dependency dprint to v0.51.1 9d00e5b
• chore(deps): update dependency @​ast-grep/napi to v0.40.3 80f9c2b
• chore(deps): update dependency oxlint to v1.36.0 dea9153

biomejs/biome (@​biomejs/biome)

v2.3.11

Compare Source

Patch Changes

• #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidTemplateRoot.

  This rule validates only root-level <template> elements in Vue single-file components. If the <template> has a src attribute, it must be empty. Otherwise, it must contain content.

  Invalid examples:

  <template src="./foo.html">content</template>

  <template></template>

  Valid examples:

  <template>content</template>

  <template src="./foo.html"></template>

• #​8586 df8fe06 Thanks @​dyc3! - Added a new nursery rule useVueConsistentVBindStyle. Enforces consistent v-bind style (:prop shorthand vs v-bind:prop longhand). Default prefers shorthand; configurable via rule options.

• #​8587 9a8c98d Thanks @​dyc3! - Added the rule useVueVForKey, which enforces that any element using v-for also specifies a key.

  Invalid

  <li v-for="item in items">{{ item }}</li>

  Valid

  <li v-for="item in items" :key="item.id">{{ item }}</li>

• #​8586 df8fe06 Thanks @​dyc3! - Added a new nursery rule useVueConsistentVOnStyle. Enforces consistent v-on style (@event shorthand vs v-on:event longhand). Default prefers shorthand; configurable via rule options.

• #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVOnce. Enforces that usages of the v-once directive in Vue.js SFC are valid.

  <!-- Valid -->
  <div v-once />
  
  <!-- Invalid -->
  <div v-once:aaa />
  <div v-once.bbb />
  <div v-once="ccc" />

• #​8498 d80fa41 Thanks @​tt-a1i! - Fixed #​8494. Extended noUndeclaredEnvVars to support bracket notation (process.env["VAR"], import.meta.env["VAR"]), Bun runtime (Bun.env.VAR, Bun.env["VAR"]), and Deno runtime (Deno.env.get("VAR")).

• #​8509 574a909 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#await} syntax, when html.experimentalFullSupportEnabled is set to true.

  -{#await promise  then name }
  +{#await promise then name}
  
  -{:catch    name}
  +{:catch name}
  
  {/await}

• #​8316 d64e92d Thanks @​washbin! - Added the new nursery rule noMultiAssign. This rule helps to prevent multiple chained assignments.

  For example, the following code triggers because there are two assignment expressions in the same statement.

  const a = (b = 0);

• #​8592 a5f59cd Thanks @​Netail! - Added the nursery rule useUniqueInputFieldNames. Require fields within an input object to be unique.

  Invalid:

  query A($x: Int, $x: Int) {
    field
  }

• #​8524 17a6156 Thanks @​JacquesLeupin! - Fixed #​8488: Relative plugin paths are now resolved from the configuration file directory, including when configurations are merged (e.g. extends: "//").

• #​8655 3260ec9 Thanks @​JacquesLeupin! - Fixed #​8636: Biome's CSS formatter now breaks comma-separated declaration values at top-level commas when wrapping.

• #​8537 cc3e851 Thanks @​dibashthapa! - Fixed #​8491: Resolved false positive errors for safe boolean expressions. There are still pending fixes. Head to #​8491 (comment) for more details

  This new change will check for safe boolean expressions in variable declarations.

  For example,

  Valid:

  let isOne = 1;
  let isPositiveNumber = number > 0;
  
  return (
    <div>
      {" "}
      {isOne && "One"} {isPositiveNumber && "Is positive"}
    </div>
  );

  Invalid:

  let emptyStr = "";
  let isZero = 0;
  
  return (
    <div>
      {emptyStr && "Empty String"} {isZero && "Number is zero"}{" "}
    </div>
  );

• #​8511 16a9036 Thanks @​ematipico! - Improved the diagnostics of the rules useSortedClasses and noUnnecessaryConditions. The diagnostics now state that these rules are a work in progress and link to the relevant GitHub issue.

• #​8521 a704be9 Thanks @​ToBinio! - Added the nursery rule useVueConsistentDefinePropsDeclaration, which enforces consistent defineProps declaration style.

Invalid

<script setup lang="ts">
const props = defineProps({
  kind: { type: String },
});
</script>

Valid

<script setup lang="ts">
const props = defineProps<{
  kind: string;
}>();
</script>

• #​8595 7c85bf0 Thanks @​dyc3! - Fixed #​8584: The HTML formatter will preserve whitespace after some elements and embedded expressions, which more closely aligns with Prettier's behavior.

  - <h1>Hello, {framework}and Svelte!</h1>
  + <h1>Hello, {framework} and Svelte!</h1>

• #​8598 5e85d43 Thanks @​Netail! - Added the nursery rule useUniqueFieldDefinitionNames. Require all fields of a type to be unique.

  Invalid:

  type SomeObject {
    foo: String
    foo: String
  }

• #​8495 b573d14 Thanks @​taga3s! - Fixed #​8405: noMisusedPromises now emits warnings/errors when a function returns union types such as T | Promise<T> which is used in conditionals.

  const a = (): boolean | Promise<boolean> => Promise.resolve(true);
  if (a()) {
  } // Now correctly flagged

• #​8632 0be7d12 Thanks @​Bertie690! - The documentation & rule sources for lint/complexity/noBannedTypes have been updated to fix a few oversights.

  In addition to some general typo fixes:

  • The rule now recommends Record<keyof any, never> instead of Record<string, never> (the latter of which incorrectly allows symbol-keyed properties).

  • The rule mentions an alternate method to enforce object emptiness involving unique symbol-based guards used by type-fest and many other packages:

    declare const mySym: unique symbol;
    
    // Since this type's only property is an unexported `unique symbol`, nothing that imports it can specify any properties directly
    // (as far as excess property checks go)
    export type EmptyObject = { [mySym]?: never };
    export type IsEmptyObject<T> = T extends EmptyObject ? true : false;

  The rule's listed sources have been updated as well to reflect the original source rule (ban-types) having been split into 3 separate rules circa April 2024.

• #​8580 a3a1ad2 Thanks @​taga3s! - Added the nursery rule noBeforeInteractiveScriptOutsideDocument to the Next.js domain.
  This rule prevents usage of next/script's beforeInteractive strategy outside of pages/_document.js.

• #​8493 5fc24f4 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#each} syntax, when html.experimentalFullSupportEnabled is set to true.

  - {#each items   as item  }
  + {#each items as item}
  
  {/each}

• #​8546 0196c0e Thanks @​Zaczero! - Hardened union static-member type flattening in edge cases (e.g. unions containing unknown or inferred expression types). This keeps inference conservative and avoids unstable type growth in node = node.parent-style loops.

• #​8569 1022c76 Thanks @​ematipico! - Fixed an issue where the Biome HTML parser would emit a parse error when certain keywords are inside the text of HTML tags.

• #​8606 f50723b Thanks @​dyc3! - Fixed #​8563: fixed a bounds check on bogus regex literals that caused panics when doing type inference

• #​7410 ab9af9a Thanks @​sgarcialaguna! - Added the new nursery rule noJsxPropsBind. This rule disallows .bind(), arrow functions, or function expressions in JSX props.

  Invalid:

  <Foo onClick={() => console.log("Hello!")}></Foo>

• #​8523 5f22f1c Thanks @​ematipico! - Improved the diagnostics of nursery rules. Added a message to diagnostics emitted by nursery rules, so that users are aware of nature of nursery rules.

• #​8571 03666fd Thanks @​dyc3! - Improved the performance of noRedeclare by eliminating string allocations

• #​8591 9dd9ca7 Thanks @​Netail! - Added the nursery rule useUniqueArgumentNames. Enforce unique arguments for GraphQL fields & directives.

  Invalid:

  query {
    field(arg1: "value", arg1: "value")
  }

• #​8521 a704be9 Thanks @​ToBinio! - Update useVueDefineMacrosOrder to only run on <script setup> blocks.

• #​8344 7b982ba Thanks @​ematipico! - Reduced the system calls when running the CLI. The performances might be noticeable in big projects that have multiple libraries and enable project rules.

• #​8588 958e24b Thanks @​Netail! - Added the nursery rule useUniqueVariableNames. Enforce unique variable names for GraphQL operations.

  Invalid:

  query ($x: Int, $x: Int) {
    field
  }

• #​8529 8794883 Thanks @​mdevils! - Fixed #​8499: useExhaustiveDependencies properly handles aliased destructured object keys when using stableResult configuration.

• #​8557 4df2f4d Thanks @​dyc3! - Fixed an issue with the HTML formatter where it wouldn't add a space before the /> in self closing elements. This brings the HTML formatter more in line with Prettier.

  -<Component/>
  +<Component />

• #​8509 574a909 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#snippet} syntax, when html.experimentalFullSupportEnabled is set to true.

  -{#snippet    foo() }
  +{#snippet foo()}
  
  {/snippe}

• #​8248 1231a5c Thanks @​emilyinure! - Added new nursery rule noReturnAssign, which disallows assignments inside return statements.

  Invalid:

  function f(a) {
    return (a = 1);
  }

• #​8531 6b09620 Thanks @​taga3s! - Fixed #​8472: The CSS parser can now accept multiple comma separated parameters in :active-view-transition-type.

• #​8615 b9da66d Thanks @​taga3s! - Remove next/script component name check from noBeforeInteractiveScriptOutsideDocument since it is a default export.

• #​8536 efbfbe2 Thanks @​dyc3! - Fixed #​8527: Improved type inference where analyzing code with repeated object property access and assignments (e.g. node = node.parent, a pattern common when traversing trees in a while loop) could hit an internal type limit. Biome now handles these cases without exceeding the type limit.

• #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVCloak. Enforces that usages of the v-cloak directive in Vue.js SFC are valid.

  <!-- Valid -->
  <div v-cloak />
  
  <!-- Invalid -->
  <div v-cloak:aaa />
  <div v-cloak.bbb />
  <div v-cloak="ccc" />

• #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVPre. Enforces that usages of the v-pre directive in Vue.js SFC are valid.

  <!-- Valid -->
  <div v-pre />
  
  <!-- Invalid -->
  <div v-pre:aaa />
  <div v-pre.bbb />
  <div v-pre="ccc" />

• #​8644 a3a27a7 Thanks @​JacquesLeupin! - Added the nursery rule useVueVapor to enforce <script setup vapor> in Vue SFCs. For example <script setup> is invalid.

• #​8508 b86842c Thanks @​tt-a1i! - Fixed #​6783: now, when a path is provided via --stdin-file-path, Biome checks whether the file exists on disk. If the path doesn't exist (virtual path), ignore checks (files.includes and VCS ignore rules) are skipped.

web-infra-dev/rslib (@​rslib/core)

v0.19.1

Compare Source

What's Changed

Document 📖

• docs: refine third-party dependencies guide by @​Timeless0911 in #​1420
• docs: add Rstest guide by @​9aoy in #​1419
• docs: update links from rspack-contrib to rstackjs by @​chenjiahan in #​1423

Other Changes

• chore(deps): bump Rslib v0.19.0 by @​Timeless0911 in #​1417
• chore(deps): bump Rsbuild 1.7.0 by @​fi3ework in #​1422

Full Changelog: web-infra-dev/rslib@v0.19.0...v0.19.1

web-infra-dev/rstest (@​rstest/core)

v0.7.8

Compare Source

What's Changed

New Features 🎉

• feat: support testEnvironment.options by @​9aoy in #​816

Bug Fixes 🐞

• fix: allow inlineSnapshot calls in each with same snapshot by @​9aoy in #​820
• fix: should treat mjs and mts files as strict ES modules by @​9aoy in #​818

Document 📖

• docs: update onConsoleLog usage by @​9aoy in #​810
• docs: add adapters guide by @​9aoy in #​811
• docs: add mocking re-exported modules tip by @​9aoy in #​817
• docs: rename runtime API overview label by @​9aoy in #​819
• docs: update links from rspack-contrib to rstackjs by @​chenjiahan in #​823

Other Changes

• release: @​rstest/adapter-rslib v0.1.1 by @​9aoy in #​812
• chore(deps): bump Rsbuild 1.7.0 by @​fi3ework in #​824
• chore: bump @​rsbuild/core to 1.7.1 by @​fi3ework in #​827

Full Changelog: web-infra-dev/rstest@v0.7.7...v0.7.8

---

Configuration

📅 Schedule: Branch creation - "before 8am on wednesday" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for rspack ready!

Name	Link
🔨 Latest commit	e7e82f1
🔍 Latest deploy log	https://app.netlify.com/projects/rspack/deploys/695d7a4f1bdc920007806b72
😎 Deploy Preview	https://deploy-preview-12647--rspack.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[github-actions]

Rsdoctor Bundle Diff Analysis

Found 5 projects in monorepo, 0 projects with changes.

📊 Quick Summary

Project	Total Size	Change
react-10k	5.7 MB	0
react-1k	825.4 KB	0
react-5k	2.7 MB	0
ui-components	2.1 MB	0
rome	984.3 KB	0

Generated by Rsdoctor GitHub Action

[github-actions]

📦 Binary Size-limit

Comparing e7e82f1 to chore: release v1.7.1 (#12638) by harpsealjs

🙈 Size remains the same at 47.87MB

[codspeed-hq]

Merging this PR will not alter performance

Summary

✅ 16 untouched benchmarks
⏩ 1 skipped benchmark¹

---

_{Comparing renovate/patch-npm-dependencies (e7e82f1) with main (2ed1576)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩