fix(deps): update minor-and-patch

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.5.7 → 2.5.8
aws-cdk (source)	2.1135.0 → 2.1136.0
aws-cdk-lib (source)	2.263.0 → 2.264.0
esbuild	0.28.1 → 0.28.2

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.8

Compare Source

Patch Changes

• #​10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #​11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #​11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #​11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #​11250: useAwait no longer reports async functions that contain an await using declaration.

• #​11143 6be7be1 Thanks @​vznh! - Fixed #​11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #​11234 caefe39 Thanks @​subotac! - Fixed #​11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #​11285 bca1f73 Thanks @​denbezrukov! - Fixed #​11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

• #​11080 af16a0b Thanks @​dyc3! - HTML style attribute values are now parsed as CSS. All Biome CSS lint rules are applied to the style attributes.

• #​11195 6a85588 Thanks @​dyc3! - Fixed Svelte files failing to parse when an expression begins with an object literal.

  Now the following snippet is correctly parsed:

  <p>{{ a: true }}</p>
  <div class={{ active: isActive }}></div>

• #​11173 481d008 Thanks @​Austin1serb! - Fixed #​10242: JavaScript GritQL patterns with multiple metavariables now match snippets consistently in WebAssembly.

• #​11187 23c0369 Thanks @​ematipico! - Added the nursery rule noInvalidPropertyInitValue, which reports an @property whose initial-value does not match its syntax descriptor. For example, the following declaration triggers the rule because red is not a <length>:

  @property --size {
    syntax: "<length>";
    inherits: false;
    initial-value: red;
  }

• #​11272 73896e6 Thanks @​ematipico! - Improved the diagnostic emitted by noRootType.

• #​11240 bd0b68d Thanks @​ematipico! - Fixed #​11223: Improved the
  performance of noMisusedPromises
  when analyzing async class methods that call other methods through this.

• #​11172 4a0bc5c Thanks @​saberoueslati! - Fixed #​10806: noUselessFragments no longer causes Biome to panic when its unsafe fix removes a fragment used as a JSX attribute value.

• #​11227 4d603b0 Thanks @​saberoueslati! - Fixed #​11178: noUndeclaredVariables no longer reports Vue's built-in instance properties, such as $slots and $attrs, in template expressions or $event in inline event-handler expressions. The instance properties are still reported inside <script setup>, where they are not defined.

• #​11187 23c0369 Thanks @​ematipico! - Fixed CSS parsing of registered custom properties: Biome now correctly validates the syntax descriptor of @property rules.

aws/aws-cdk-cli (aws-cdk)

v2.1136.0

Compare Source

2.1136.0 (2026-08-12)

Features

• deps: upgrade aws-cdk-lib (#​1820) (536ad69)

v2.1135.1

Compare Source

2.1135.1 (2026-08-07)

aws/aws-cdk (aws-cdk-lib)

v2.264.0

Compare Source

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway
  metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the
  old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#​38526) (b5693cb)
• cloudwatch: support alarm mute rules (#​37504) (c3540bb), closes #​37502
• update L1 CloudFormation resource definitions (#​38479) (279340d)

Bug Fixes

• bedrockagentcore: gateway metrics emit correct CloudWatch dimension (#​38487) (5a7d360)
• bedrockagentcore: runtime metrics emit correct CloudWatch dimensions (#​38486) (4e44f24)
• cloudfront: warn when minimumProtocolVersion is set without a certificate (#​37250) (52ec5f7), closes #​35404
• ec2: allow EBS gp3 and io2 volumes up to 64 TiB (#​37049) (10711ba), closes #​37045
• stepfunctions-tasks: call-rest-api CallApiGatewayRestApiEndpoint does not support JsonATA for api_path (#​37738) (9f0afdc), closes #​37728 /github.com/aws/aws-cdk/blob/e207b76cc2503701b3c4e2c87023617b485b2fde/packages/aws-cdk-lib/aws-stepfunctions/lib/private/jsonata.ts#L1

---

Alpha modules (2.264.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type
  safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated
  accordingly.

Features

• glue-alpha: new Catalog L2 (#​38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#​38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#​38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#​38515) (3c71466), closes #​38517

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates JS/TS dev tooling and AWS CDK dependencies to newer patch/minor versions.

Changes:

• Bump @biomejs/biome and esbuild in root package.json
• Bump aws-cdk-lib, aws-cdk, and esbuild in infra/package.json

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
package.json	Patch updates to formatting/build tooling (@biomejs/biome, esbuild).
infra/package.json	Minor/patch updates to CDK dependencies and build tooling for infra package.

Files not reviewed (1)

• infra/package-lock.json: Generated file

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.