Bump the monthly-npm-updates group with 16 updates

[dependabot]

Bumps the monthly-npm-updates group with 16 updates:

Package	From	To
@biomejs/biome	2.5.6	2.5.11
@playwright/test	1.62.0	1.62.1
@tanstack/react-store	0.11.0	0.11.1
@testing-library/jest-dom	7.0.0	7.0.1
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.6
@types/node	26.1.2	26.4.0
@types/react	19.2.17	19.2.18
@types/react-dom	19.2.3	19.2.5
@vitejs/plugin-react	6.0.4	6.1.1
@vitest/coverage-v8	4.1.10	4.1.11
dexie	4.4.4	4.4.5
postcss	8.5.24	8.5.26
sonner	2.0.7	2.0.8
vite	8.1.5	8.2.2
vitest	4.1.10	4.1.11

Updates @biomejs/biome from 2.5.6 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.0 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• See full diff in compare view

Updates @tanstack/react-store from 0.11.0 to 0.11.1

Release notes

Sourced from @​tanstack/react-store's releases.

@​tanstack/react-store@​0.11.1

Patch Changes

• Updated dependencies [1d7c87e]:
  • @​tanstack/store@​0.11.1

Changelog

Sourced from @​tanstack/react-store's changelog.

0.11.1

Patch Changes

• Updated dependencies [1d7c87e]:
  • @​tanstack/store@​0.11.1

Commits

• 550ba4f ci: Version Packages (#351)
• 4e0c7ef Fix preact selector stability (#318)
• See full diff in compare view

Updates @testing-library/jest-dom from 7.0.0 to 7.0.1

Release notes

Sourced from @​testing-library/jest-dom's releases.

v7.0.1

7.0.1 (2026-08-09)

Bug Fixes

• declare vitest as an optional peer dependency (#733) (3782c78)

Commits

• 3782c78 fix: declare vitest as an optional peer dependency (#733)
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.6

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

14.6.2 (2026-08-03)

Commits

• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
• 13fa4bc ci: stop lint errors from blocking release (#1316)
• c3cec18 chore(ci): make releases work with full git history (#1315)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates @types/node from 26.1.2 to 26.4.0

Commits

• See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.0.4 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

plugin-react@6.0.5

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react

import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

6.0.5 (2026-07-30)

Fixed the react compiler preset filter to be linear (#1353)

The improved filter in v6.0.3 was non-linear and caused a performance regression (#1349). The filter was changed to be linear to avoid that.

Commits

• 04cac50 release: plugin-react@6.1.1 (#1440)
• 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
• 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
• 61006e6 fix(deps): update all non-major dependencies (#1433)
• e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
• fb2d6f3 fix(deps): update all non-major dependencies (#1427)
• 39b3173 release: plugin-react@6.1.0 (#1428)
• f1340b0 feat(react): add native React Compiler support (#1419)
• 9ab698e fix(deps): update all non-major dependencies (#1375)
• 68c0cb8 release: plugin-react@6.0.5 (#1362)
• Additional commits viewable in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• See full diff in compare view

Updates dexie from 4.4.4 to 4.4.5

Release notes

Sourced from dexie's releases.

Dexie v4.4.5

This is a maintenance release that fixes an issue with indexes named after inherited Object properties and improves authentication recovery in dexie-cloud-addon.

Related Package Releases

Package	Version
dexie	4.4.5
dexie-cloud-addon	4.4.14
dexie-react-hooks	4.4.0 (no change)
y-dexie	4.4.0 (no change)
dexie-export-import	4.4.0 (no change)

Bug Fixes

dexie@4.4.5

• fix: don't crash when an index is named constructor — Tables with a primary key or index named constructor could cause db.open() to fail with TypeError: indexList.push is not a function. The internal index lookup now uses an object without a prototype, avoiding collisions with inherited Object.prototype properties such as constructor, toString, and valueOf. (#2325, fixes #1920). Contributed by @​tarann26.

dexie-cloud-addon@4.4.14

• fix: recover from failed refresh-token renewal — When a locally unexpired refresh token is rejected by the server, login() now falls back to the regular fetchTokens authentication path instead of propagating the refresh error. This allows custom authentication integrations to silently obtain new tokens when possible, or trigger their normal login flow when required. OAuth redirect errors continue to propagate normally. (#2326). Fixed by @​liz709 and @​dfahlander.

Commits

• 22bdff1 dexie@4.4.5
• 6a7b452 fix(dbcore): don't crash when an index is named 'constructor' (#2325)
• dbaf960 dexie-cloud-addon@4.4.14
• 3fd4745 fix(dexie-cloud-addon): fall back to fetchTokens when refresh fails
• 962052f updated pnpm lockfile
• 12038d1 Updated deps of dexie-cloud-todo-app
• See full diff in compare view

Updates postcss from 8.5.24 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

• Added support for custom aria labels by @​hirotomoyamada in emilkowalski/sonner#704
• Fixed handling when hotkey is an empty array by @​hirotomoyamada in emilkowalski/sonner#703
• fix: keep the toaster as top layer when react-aria modal is open by @​sadeghbarati in emilkowalski/sonner#699
• fix: format by @​WuMingDao in emilkowalski/sonner#707
• fix: add missing safari prefix by @​emilkowalski in emilkowalski/sonner#710
• Fix event listener removal in hooks.tsx by @​VishwaGauravIn in emilkowalski/sonner#711
• Fix dismiss for custom toast by @​reegodev in emilkowalski/sonner#717
• Use variables in close button colors instead of hardcoded values by @​faroukfaiz10 in emilkowalski/sonner#726
• Fix a batch of reported issues by @​emilkowalski in emilkowalski/sonner#777

New Contributors

• @​hirotomoyamada made their first contribution in emilkowalski/sonner#704
• @​sadeghbarati made their first contribution in emilkowalski/sonner#699
• @​WuMingDao made their first contribution in emilkowalski/sonner#707
• @​VishwaGauravIn made their first contribution in emilkowalski/sonner#711
• @​reegodev made their first contribution in emilkowalski/sonner#717
• @​faroukfaiz10 made their first contribution in emilkowalski/sonner#726

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

• 6739aca v2.0.8
• ecce184 Fix a batch of reported issues (#777)
• 45d8940 Use variables in close button colors instead of hardcoded values (#726)
• fe51da1 Fix dismiss for custom toast (#717)
• c2d6990 fix: event listener removal in hooks.tsx (#711)
• 5caadb1 Add safari prefix (#710)
• ea3410f fix: format (#707)
• a685ffc fix: keep the toaster as top layer when react-aria modal is open (#699)
• 7760223 fix(index.tsx): ensure hotkey array is not empty before checking (#703)
• 8c0ce1e feat(toaster): add support for custom aria labels (#704)
• See full diff in compare view

Updates vite from 8.1.5 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (