[dependabot]

Bumps the dev-dependencies group with 2 updates in the /frontend directory: @biomejs/biome and vite.

Updates @biomejs/biome from 2.5.15 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Updates vite from 8.3.3 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

[github-actions]

Size Change: 0 B 🆕

Total Size: 0 B

_{compressed-size-action}