build(deps-dev): bump @biomejs/biome from 2.5.6 to 2.5.13

[dependabot]

Bumps @biomejs/biome from 2.5.6 to 2.5.13.

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Fail ❌
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Fail ❌
GITHUB_ACTIONS_ZIZMOR	Fail ❌
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JAVASCRIPT_ES	Pass ✅
JAVASCRIPT_PRETTIER	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

BIOME_FORMAT

Checked 2 files in 6ms. No fixes applied.
Found 2 errors.package.json format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

    1 1 │   {
    2   │ - ··"scripts":·{
    3   │ - ····"lint":·"npx·@biomejs/biome·lint·&&·actionlint·&&·zizmor·./.github"
    4   │ - ··},
    5   │ - ··"devDependencies":·{
    6   │ - ····"@biomejs/biome":·"2.5.13"
    7   │ - ··}
      2 │ + → "scripts":·{
      3 │ + → → "lint":·"npx·@biomejs/biome·lint·&&·actionlint·&&·zizmor·./.github"
      4 │ + → },
      5 │ + → "devDependencies":·{
      6 │ + → → "@biomejs/biome":·"2.5.13"
      7 │ + → }
    8 8 │   }
    9 9 │


scripts/static-utils.js format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Formatter would have printed the following content:

    13 13 │    */
    14 14 │   function parse({ core }, state = {}) {
    15    │ - ··const·fs·=·require("fs");
    16    │ - ··let·config·=·{};
    17    │ - ··try·{
    18    │ - ····config·=·JSON.parse(fs.readFileSync("./static.json",·"utf8"));
    19    │ - ··}·catch·(e)·{
    20    │ - ····core.setFailed(`Unable·to·parse·static.json:·${e.message}`);
    21    │ - ··}
    22    │ - ··//·Merge·GitHub·Action·state·with·the·parsed·static.json
    23    │ - ··config·=·{
    24    │ - ····...config,
    25    │ - ····_static:·{
    26    │ - ······host:·{
    27    │ - ········...state.host,
    28    │ - ······},
    29    │ - ······...config._static,
    30    │ - ····},
    31    │ - ··};
       15 │ + → const·fs·=·require("fs");
       16 │ + → let·config·=·{};
       17 │ + → try·{
       18 │ + → → config·=·JSON.parse(fs.readFileSync("./static.json",·"utf8"));
       19 │ + → }·catch·(e)·{
       20 │ + → → core.setFailed(`Unable·to·parse·static.json:·${e.message}`);
       21 │ + → }
       22 │ + → //·Merge·GitHub·Action·state·with·the·parsed·static.json
       23 │ + → config·=·{
       24 │ + → → ...config,
       25 │ + → → _static:·{
       26 │ + → → → host:·{
       27 │ + → → → → ...state.host,
       28 │ + → → → },
       29 │ + → → → ...config._static,
       30 │ + → → },
       31 │ + → };
    32 32 │
    33    │ - ··try·{
    34    │ - ····validate(config);
    35    │ - ··}·catch·(e)·{
    36    │ - ····core.setFailed(`Invalid·static.json:·${e.message}`);
    37    │ - ··}
    38    │ - ··return·config;
       33 │ + → try·{
       34 │ + → → validate(config);
       35 │ + → }·catch·(e)·{
       36 │ + → → core.setFailed(`Invalid·static.json:·${e.message}`);
       37 │ + → }
       38 │ + → return·config;
    39 39 │   }
    40 40 │
    ····· │
    43 43 │    */
    44 44 │   function validate(config) {
    45    │ - ··if·(!config)·{
    46    │ - ····throw·new·Error("No·configuration·provided.");
    47    │ - ··}
    48    │ - ··if·(!("_static"·in·config)·||·!config._static)·{
    49    │ - ····throw·new·Error("`_static`·member·not·found·in·configuration.");
    50    │ - ··}
    51    │ - ··if·(!config._static?.generator)·{
    52    │ - ····throw·new·Error("A·`generator`·is·required·in·a·`_static`·configuration.");
    53    │ - ··}
    54    │ - ··if·(config._static?.ecosystem·&&·config._static?.ecosystem·!==·"npm")·{
    55    │ - ····throw·new·Error(
    56    │ - ······"Unknown·ecosystem·provided.·`npm`·is·currently·the·only·official·supported·ecosystem.",
    57    │ - ····);
    58    │ - ··}
    59    │ - ··return·true;
       45 │ + → if·(!config)·{
       46 │ + → → throw·new·Error("No·configuration·provided.");
       47 │ + → }
       48 │ + → if·(!("_static"·in·config)·||·!config._static)·{
       49 │ + → → throw·new·Error("`_static`·member·not·found·in·configuration.");
       50 │ + → }
       51 │ + → if·(!config._static?.generator)·{
       52 │ + → → throw·new·Error("A·`generator`·is·required·in·a·`_static`·configuration.");
       53 │ + → }
       54 │ + → if·(config._static?.ecosystem·&&·config._static?.ecosystem·!==·"npm")·{
       55 │ + → → throw·new·Error(
       56 │ + → → → "Unknown·ecosystem·provided.·`npm`·is·currently·the·only·official·supported·ecosystem.",
       57 │ + → → );
       58 │ + → }
       59 │ + → return·true;
    60 60 │   }
    61 61 │
    62 62 │   module.exports = {
    63    │ - ··parse,
    64    │ - ··validate,
       63 │ + → parse,
       64 │ + → validate,
    65 65 │   };
    66 66 │


format ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  × Some errors were emitted while running checks.

GITHUB_ACTIONS

.github/workflows/static.yml:140:9: shellcheck reported issue in this script: SC2086:info:1:36: Double quote to prevent globbing and word splitting [shellcheck]
    |
140 |         run: |
    |         ^~~~
.github/workflows/static.yml:146:9: shellcheck reported issue in this script: SC2086:info:2:12: Double quote to prevent globbing and word splitting [shellcheck]
    |
146 |         run: |
    |         ^~~~

GITHUB_ACTIONS_ZIZMOR

�[1m�[33mwarning[ref-version-mismatch]�[0m�[1m: action's hash pin has mismatched or missing version comment�[0m
   �[1m�[94m--> �[0m/github/workspace/.github/workflows/static.yml:193:79
    �[1m�[94m|�[0m
�[1m�[94m193�[0m �[1m�[94m|�[0m         uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
    �[1m�[94m|�[0m         �[1m�[94m-------------------------------------------------------------------�[0m   �[1m�[33m^^�[0m �[1m�[33mpoints to commit 368f82528645�[0m
    �[1m�[94m|�[0m         �[1m�[94m|�[0m
    �[1m�[94m|�[0m         �[1m�[94mis pointed to by tag v3.0.2-node.24�[0m
    �[1m�[94m|�[0m
    �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
    �[1m�[94m= �[0m�[1mnote�[0m: this finding has an auto-fix
    �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#ref-version-mismatch�[39m

�[32m7�[39m findings (�[1m�[93m6�[39m suppressed, �[91m1�[39m unsafe fixes�[0m): �[35m0�[39m informational, �[36m0�[39m low, �[33m1�[39m medium, �[31m0�[39m high�[32m INFO�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 zizmor v1.25.2
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/dependabot.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/lint.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/static.yml

[dependabot]

Superseded by #36.