Update frontend dependencies (dev)

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@biomejs/biome (source)	2.5.12 → 2.5.13			devDependencies	patch	2.5.14
@inlang/paraglide-js (source)	2.15.1 → 2.25.2			devDependencies	minor	2.25.4 (+1)
@inlang/paraglide-js (source)	2.25.0 → 2.25.2			dependencies	patch	2.25.4 (+1)
@tanstack/devtools-vite (source)	^0.5.5 → 0.5.5			devDependencies	pin
@tanstack/devtools-vite (source)	^0.3.12 → 0.3.12			devDependencies	pin
@tanstack/react-devtools (source)	^0.9.13 → ^0.10.0			dependencies	minor
@tanstack/react-router (source)	1.170.33 → 1.170.36			dependencies	patch	1.170.38 (+1)
@tanstack/react-router-devtools (source)	1.167.1 → 1.167.2			dependencies	patch
@tanstack/router-plugin (source)	^1.168.36 → 1.168.36			devDependencies	pin
@types/lodash-es (source)	^4.17.12 → 4.17.12			devDependencies	pin
@types/node (source)	^25.9.5 → 25.9.5			devDependencies	pin
@types/qs (source)	^6.15.1 → 6.15.1			devDependencies	pin
@types/react (source)	^19.2.18 → 19.2.18			devDependencies	pin
@types/react-dom (source)	^19.2.7 → 19.2.7			devDependencies	pin
@vitejs/plugin-react-swc (source)	^4.3.3 → 4.3.3			devDependencies	pin
globals	^17.12.0 → 17.12.0			devDependencies	pin
prettier (source)	^3.9.6 → 3.9.6			devDependencies	pin
react (source)	19.2.8 → 19.3.0			dependencies	minor
react-dom (source)	19.2.8 → 19.3.0			dependencies	minor
sass	^1.104.0 → 1.104.0			devDependencies	pin
seroval (source)	1.5.4 → 1.6.7			pnpm-workspace.overrides	minor
sharp (source, changelog)	^0.35.4 → 0.35.4			devDependencies	pin
stylelint (source)	^17.15.0 → 17.15.0			devDependencies	pin
stylelint-config-standard-scss	^17.0.0 → 17.0.0			devDependencies	pin
stylelint-scss	^7.2.0 → 7.2.0			devDependencies	pin
typescript (source)	~5.9.3 → 5.9.3			devDependencies	pin
typescript-eslint (source)	^8.69.0 → 8.69.0			devDependencies	pin
vite (source)	^7.3.6 → 7.3.6			devDependencies	pin
vite-plugin-image-optimizer	^2.0.3 → 2.0.3			devDependencies	pin
vitest (source)	^5.0.0 → 5.0.0			devDependencies	pin
zod (source)	4.5.4 → 4.6.5			dependencies	minor

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.13

Compare Source

Patch Changes

• #​11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  
  .my-style {
    color: red;
  }
  
  /* Valid */
  @import 'foo.css' layer(base);
  
  @layer base {
    .my-style {
      color: red;
    }
  }

• #​11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #​11620 20e513a Thanks @​jakeleventhal! - Fixed #​11610, #​11611, #​11612, #​11615, and #​11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #​11657 e322040 Thanks @​ematipico! - Fixed #​7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #​11627 23aad6d Thanks @​ematipico! - Fixed #​6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #​11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #​11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

• #​11676 840a52a Thanks @​dyc3! - Fixed #​11672 and #​11671 by disabling the experimental capitalized-call and effect-dependency checks in useReactCompiler, matching their exclusion from upstream's recommended lint preset. Valid calls such as Intl.NumberFormat() and captures of variables declared inside effects no longer produce these diagnostics.

• #​11660 49485ed Thanks @​ematipico! - Fixed #​11653: Astro template suppression comments ({/* biome-ignore lint: reason */}) now suppress matching HTML lint diagnostics on the following line when full HTML support is enabled.

• #​11664 9a73b9c Thanks @​dyc3! - Improved the performance of useRegexpExec.

• #​11661 5341b3f Thanks @​ematipico! - Fixed #​7479. noUnusedVariables now treats Unicode escapes in identifiers as the same binding as their decoded spelling.

• #​11630 62e1fc5 Thanks @​dyc3! - Fixed the HTML formatter inserting whitespace between adjacent Svelte expressions when their combined length exceeds the line width.

   <span>
  -  {head.median - base.median >= 0 ? "+" : "−"}
  -  {formatMs(Math.abs(head.median - base.median))}
  +  {head.median - base.median >= 0 ? "+" : "−"}{formatMs(Math.abs(head.median - base.median))}
   </span>

• #​11658 ed4bfa4 Thanks @​fredrikblau! - Fixed #​11644: useHeadingContent no longer reports headings that render their text with a directive: set:html and set:text in Astro files, v-html and v-text in Vue files.

  <h1 set:html={heading} />
  <h2 set:text={heading}></h2>

  <template>
    <h1 v-html="heading"></h1>
    <h2 v-text="heading"></h2>
  </template>

• #​11613 47d7383 Thanks @​ematipico! - Improved the performance of Biome Formatter up to ~50% in some cases.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​6974, where noUnusedPrivateClassMembers incorrectly reported TypeScript private constructor properties read through object destructuring from this as unused.

• #​11618 21a10cf Thanks @​siketyan! - Fixed #​11605: Type inference now infers the type of an unannotated callback parameter from the signature of the function the callback is passed to, and honours explicit type arguments on call expressions. This improves type-aware analysis for noBaseToString, noFloatingPromises, noMisleadingReturnType, noMisusedPromises, noUnnecessaryConditions, noUnsafePlusOperands, noUselessTypeConversion, useArrayFind, useArraySortCompare, useAwaitThenable, useDisposables, useExhaustiveSwitchCases, useIncludes, useNullishCoalescing, useRegexpExec, and useStringStartsEndsWith. For example, noFloatingPromises can now detect Promises reached through such parameters:

  interface Context {
    doSomething(): Promise<void>;
  }
  
  declare function test(callback: (ctx: Context) => Promise<void>): void;
  
  test(async (ctx) => {
  	ctx.doSomething(); // now reported as a floating promise
  });

• #​11698 b019982 Thanks @​denbezrukov! - Fixed parsing of unquoted CSS URLs beginning with @ or !, such as url(@/assets/icon.svg) and url(!font.woff2). Preserved escaped and non-ASCII whitespace in raw URLs during formatting.

  -background-image: url(image\);
  +background-image: url(image\ );

• #​11622 c23e4c7 Thanks @​Netail! - Added the nursery rule noUnsafeIframeSandbox, which reports iframe elements whose sandbox attribute combines allow-scripts and allow-same-origin, since that combination lets the embedded document remove its own sandboxing.

  <iframe src="https://example.com" sandbox="allow-scripts allow-same-origin" />

• #​11606 de0528f Thanks @​dyc3! - Added the recommended noSvelteAtHtmlTags nursery rule, which reports Svelte {@html} tags that render unescaped HTML.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​6782: GritQL plugins now match captured JSX component names against code snippets such as React.Fragment.

• #​11687 09d97d9 Thanks @​hori-design! - Fixed #​11678: useReactCompiler no longer panics on files that contain non-ASCII characters. This bumps the React Compiler version.

• #​11595 a64d757 Thanks @​dyc3! - Added the nursery Vue-domain rule useVueBaseImport rule, which enforces importing Vue APIs from vue instead of internal @vue/* packages.

• #​11675 353cbae Thanks @​dyc3! - Fixed useReactCompiler silently producing no diagnostics in WebAssembly builds, including the playground.

• #​11625 ea20e5a Thanks @​denbezrukov! - Improved linting performance for large CSS and JSON files.

• #​11670 4969ee1 Thanks @​ematipico! - Fixed #​7527: suppression actions for diagnostics emitted on comments are now inserted before the diagnostic comment. In particular, suppressing noTsIgnore now places the biome-ignore comment before @ts-ignore.

• #​11655 fd8fc74 Thanks @​ematipico! - Fixed #​8629, where noUnusedPrivateClassMembers incorrectly reported used private TypeScript method overload signatures as unused.

• #​11669 579f401 Thanks @​denbezrukov! - Improved the performance of noExcessiveLinesPerFile when skipBlankLines is false.

opral/paraglide-js (@​inlang/paraglide-js)

v2.25.2

Patch Changes

• b26bada: Upgrade Inlang SDK to 3.0.5 with Lix 0.16.1 to fix compilation of sorted message files above 512 tracked-state rows. Includes transaction error handling and snapshot restoration fixes.

v2.25.1

Patch Changes

• 845e819: Upgrade the Inlang SDK to 3.0.4, including Lix 0.15.1 fixes for transaction-local message and variant reads.

v2.25.0

Minor Changes

• f719e1f: Expose cleanOutdir, experimentalStaticLocale, and disableAsyncLocalStorage as paraglide-js compile CLI flags.

• 5ed1745: Add support for a paraglide.config.js (or .mjs, .ts, .cjs)
  configuration file inside the inlang project directory.

  The CLI and all bundler plugins now pick up compiler options from
  <project>/paraglide.config.*. The project directory comes from --project
  or the plugin's project option and defaults to the conventional
  ./project.inlang — which means every bundler plugin can now be
  instantiated without arguments. Since the config lives inside the project it
  configures, it cannot set project itself. Explicit flags and plugin
  options win over the config file, which wins over the built-in defaults.
  Existing setups keep working unchanged.

  Also included:

  • A new defineConfig helper exported from @inlang/paraglide-js for type
    inference and autocompletion in config files.
  • Watch modes reload when the active config file changes, including renames
    between the supported file names. Deleting all config files falls back to
    the built-in defaults; an invalid config skips the compilation with an
    error — watch modes keep serving the previous output, production builds
    fail loudly. (esbuild does not support config watching.)
  • cleanOutdir is accepted but ignored: watch integrations always preserve
    the output directory for incremental compilation.

Patch Changes

• aa4ffd3: Resolve references to earlier local variables correctly in message declarations and formatter options.
• 3634877: Fix experimentalMiddlewareLocaleSplitting corrupting the generated server file when a compiled message value contains a literal $ (e.g. a price or currency symbol) that forms a String.replace() special replacement pattern such as $`.
• 1bacc27: Fix experimentalMiddlewareLocaleSplitting keying compiledBundles by the raw bundle id instead of the safe module id, so every SSR message lookup missed and threw globalThis.__paraglide.ssr.<id> is not a function on hydration.

v2.24.1

Patch Changes

• d2aeb93: Update the inlang SDK dependency to 3.0.1, which includes the Lix WASM fallback for musl-based Node.js environments.

v2.24.0

Minor Changes

• 7028c8a: Upgrade to @inlang/sdk v3 and remove obsolete local account migration code.

Patch Changes

• 0ac907e: Cache compiled URL patterns to speed up repeated localized-link generation.
• fda90d2: Skip unchanged Vite compilations across dev-server restarts by persisting and validating the compiler input cache.
• 84e2766: Add a fast path for common locale-prefix and static-domain URL patterns while preserving the generic URLPattern fallback.
• 5de9441: Improve compiler output writes by using Node's synchronous SHA-256 implementation and only creating directories for generated files that changed.
• 5c17acf: Allow importing the programmatic compiler API without installing the optional Vite peer dependency.
• c52b523: Preserve request bodies in paraglideMiddleware by cloning body-bearing requests before rewrapping them, preventing "Body has already been read" errors on POST/PUT/PATCH/DELETE.
• 32d285b: Avoid rewriting unchanged output files during one-shot CLI compilation.
• 9e1ee2e: Add an opt-in trailingSlash compiler option for canonicalizing localized URLs.

v2.23.2

Patch Changes

• b8af4b1: Embed TypeScript sources in published JavaScript sourcemaps and stop emitting declaration sourcemaps that reference unpublished source files.

v2.23.1

Patch Changes

• 6f9b062: Keep the server middleware's AsyncLocalStorage available when module instrumentation snapshots mutable exports.

v2.23.0

Minor Changes

• c2b9c17: Replace the experimental per-locale framework-output specialization with a
  Vite 8+ environment architecture. experimentalPerLocaleBuild: true now
  generates locale source modules before bundling, builds independent native
  Rolldown graphs, supports unminified builds and source maps, and emits
  paraglide-vite-locales.json without rewriting completed chunks or framework
  output.

  Remove the private TanStack Start and SvelteKit renderer integrations. Those
  frameworks now require public client-variant build and render-selection APIs
  before they can compose with experimental per-locale builds.

Patch Changes

• 608385f: Use baseLocale as the exhaustive branch in generated message functions.

v2.22.0

Minor Changes

• 2571af2: Add experimental Vite 8 per-locale client builds for TanStack Start and SvelteKit. Enable the same experimentalPerLocaleBuild: true flag in either framework; Paraglide detects the framework and serves compiler-specialized client assets for each locale.

v2.21.0

Minor Changes

• ab5bfc7: fix emitTsDeclarations with TypeScript 7 #​711

  TypeScript 7 (the Go-based compiler) no longer ships the in-process compiler API that Paraglide used to generate .d.ts files, which made paraglide-js compile --emit-ts-declarations fail with TypeError: Cannot read properties of undefined (reading 'ESNext'). Paraglide now detects this and invokes TypeScript's tsc CLI instead. TypeScript 5 and 6 keep using the compiler API as before.

  Note that the declaration output of TypeScript 7 differs cosmetically from TypeScript 5/6 (quote style, declaration ordering, export declare const vs export const) but is semantically equivalent.

v2.20.2

Patch Changes

• a48e767: Cache client cookie locale extraction for synchronous message bursts.

v2.20.1

Patch Changes

• 8c3493d: Fix server cookie locale parsing when Cookie headers omit whitespace after semicolons.

v2.20.0

Minor Changes

• 2c34351: Emit messages/package.json with { "type": "module", "sideEffects": false } for message-modules output, declaring the generated message modules side-effect-free.

  This lets bundlers (notably Vite 8 / Rolldown) drop unused re-exports from the m barrel per entry, instead of bundling every message used anywhere in the app into one shared chunk that every entry downloads. Without it, per-page JS scales with the union of all messages used across the app rather than with the messages a given route actually uses.

  The declaration is scoped to messages/, so runtime.js (which has real side effects) is unaffected. type: "module" is included because the package.json creates a new module scope for messages/; without it, the generated ESM files would default to CommonJS (a package.json without type is CJS in Node, even when the consuming project is type: "module").

  See #​668

Patch Changes

• 921c3be: experimentalMiddlewareLocaleSplitting: the injected inline script now reuses the nonce from the response's Content-Security-Policy header, so it is allowed under a strict CSP instead of being blocked and breaking hydration. Automatic - no configuration needed.

v2.19.0

Minor Changes

• 67a8942: Compile pattern-level function-reference annotations to registry calls

  Annotations attached directly to pattern expressions (e.g. i18next's {{count, number}} imported via plugin-i18next) were silently dropped and compiled to plain interpolation. They now compile through the same registry.* path as local-variable annotations:

  // before
  const en_views = (i) => `${i?.count} views`;
  // after
  const en_views = (i) => `${registry.number("en", i?.count, {})} views`;

  Unknown formatter names fall back to plain interpolation with a compile-time warning instead of failing or staying silent. compilePattern() gained an optional locale parameter, required to compile annotations.

  Fixes #​694

• d57efa1: Skip recompilation when inputs are unchanged across bundler runs in the same process

  vite build fires buildStart once per environment (client, ssr, ...) and each run did a full compile() — project loading and message compilation — even though the inputs hadn't changed. The plugin now hashes the tracked input files, their directory listings, and the output-affecting options after a successful compile, and skips compile() entirely when the digest matches on the next run. The second and later environments become near-free:

  vite v6.4.1 building for production...
  ✔ [paraglide-js] Compilation complete (locale-modules)
  ✓ built in 634ms
  vite v6.4.1 building SSR bundle for production...
  ℹ [paraglide-js] Compilation skipped — inputs unchanged (locale-modules)
  ✓ built in 15ms
  

  The digest fails open: any state it can't certify (missing files, read errors, changed options, a failed compile) forces a recompile. Multi-compiler webpack setups (client + server) benefit the same way via beforeRun.

  Also fixed along the way:

  • A user-provided fs option silently bypassed the plugin's file-read tracking (the args spread overrode the tracked fs wrapper), which left file watching inert for custom-fs setups.
  • The watch-target filter ignored any path containing the substring "cache" — a project under e.g. /cachet-app/ had its inputs excluded from file watching. It now matches whole path segments only.

  Fixes #​693

Patch Changes

• 6010611: Update @inlang/sdk to 2.10.0.

v2.18.2

Patch Changes

• 4bea31a: Prevent paraglide-js compile --watch from cleaning the output directory on the initial compile.

• 4dfa099: Fix emitted TypeScript declarations for message keys that require quoted export aliases, such as dotted nested keys.

  emitTsDeclarations now preserves quoted aliases from the generated JavaScript so .d.ts output remains valid for keys like greeting.hello. The optional TypeScript peer dependency now requires TypeScript 5.6 or newer, which supports arbitrary quoted module export names.

v2.18.1

Patch Changes

• 6eb7d02: Fix input match generation so Infinity selectors match both numeric Infinity values and string "Infinity" values.
• c16730d: Pin default jsDelivr plugin URLs to exact versions in generated project settings.

v2.18.0

Minor Changes

• 62d37f0: Add a relativetime declaration formatter backed by Intl.RelativeTimeFormat.

Patch Changes

• a5f31bc: Update @inlang/sdk to 2.9.3.
• d2bf729: Mark typescript as an optional peer dependency and show a clear error when emitTsDeclarations is enabled without TypeScript installed.
• ea8343f: Fix race condition where paraglideVitePlugin (and the rollup/rolldown/rspack/esbuild plugins) wiped the output directory on every fresh process, racing concurrent reads from SSR/prerender modules and sibling Vite instances. The plugin now seeds previousCompilation from existing on-disk hashes on the first compile, so warm restarts are a no-op (zero writes when inputs haven't changed) and the recursive wipe is gone. The webpack plugin's wipe behavior is unchanged but now also deletes orphaned files on its first compile. Closes #​659.

v2.17.0

Minor Changes

• 109e588: Add --output-structure option to the compile command.

v2.16.1

Patch Changes

• 3bb446a: Update @inlang/sdk to 2.9.2.

v2.16.0

Minor Changes

• 8401dae: Add new paraglide-js compile CLI flags for compiler options that were
  previously only available through the programmatic API or bundler plugins.

  You can now:

  • enable or disable emitted .gitignore, .prettierignore, and README.md
  • explicitly enable or disable emitted .d.ts files
  • pass a custom isServer expression for runtime tree-shaking

  These options are forwarded through regular and --watch compiles so the CLI
  matches the existing compiler behavior more closely.

v2.15.3

Patch Changes

• b10186d: Fix numeric input match inference so generated message typings accept both numeric and string literal forms for values like input=1, matching runtime behavior without relying on broad loose coercion.

v2.15.2

Patch Changes

• c716c6d: Fix proxy-aware URL handling in paraglideMiddleware(), shouldRedirect(), and locale extraction by adding an effectiveRequestUrl override for browser-facing URLs behind TLS-terminating proxies and load balancers. Addresses #​652.

TanStack/devtools (@​tanstack/react-devtools)

v0.10.12

Compare Source

Patch Changes

• Updated dependencies [4ecd46e]:
  • @​tanstack/devtools@0.14.2

v0.10.11

Compare Source

Patch Changes

• Updated dependencies [cf8e678, cf8e678, cf8e678]:
  • @​tanstack/devtools@0.14.1

v0.10.10

Compare Source

Patch Changes

• Updated dependencies [a46d1f5, a46d1f5]:
  • @​tanstack/devtools@0.14.0

v0.10.9

Compare Source

Patch Changes

• Updated dependencies [d061f0c]:
  • @​tanstack/devtools@0.13.0

v0.10.8

Compare Source

Patch Changes

• Updated dependencies [ea3c674]:
  • @​tanstack/devtools@0.12.5

v0.10.7

Compare Source

Patch Changes

• Updated dependencies [cc8c81b]:
  • @​tanstack/devtools@0.12.4

v0.10.6

Compare Source

Patch Changes

• #​466 73983a7 - Fix the plugin marketplace rendering empty ("No additional plugins available")
  when it should list installable plugins.

  • The client event bus no longer silently drops events emitted while its
    WebSocket is still connecting. Such events are now queued and flushed once
    the socket opens, so the marketplace's mounted request reliably reaches the
    server bus.
  • The marketplace now re-requests package.json every time it is opened and
    retries until the data arrives, so re-opening always re-fetches the plugin
    list.
  • Added TanStack AI Devtools (@tanstack/react-ai-devtools) to the plugin
    marketplace registry.

• Updated dependencies [73983a7]:

  • @​tanstack/devtools@0.12.3

v0.10.5

Patch Changes

• Updated dependencies []:
  • @​tanstack/devtools@0.12.2

v0.10.3

Patch Changes

• Updated dependencies [58e66f5]:
  • @​tanstack/devtools@0.12.0

v0.10.2

Compare Source

Patch Changes

• Updated dependencies [aa32769]:
  • @​tanstack/devtools@0.11.2

v0.10.1

Patch Changes

• Updated dependencies [e89cff4, e04bb11]:
  • @​tanstack/devtools@0.11.1

v0.10.0

Minor Changes

• Change the way props are passed to the plugins (#​319)

Patch Changes

• Updated dependencies

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Warsaw)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.