Commit Graph

16624 Commits

Author SHA1 Message Date
dependabot[bot] 78a52140e5 chore(deps): bump actions/setup-node from 6 to 7
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-10-07 07:51:39 +00:00
Christopher Kolstad 7099f0d4d4 Configure Dependabot for GitHub Actions and npm (#12230)
Added configuration for GitHub Actions and updated schedule for npm
dependencies.

Since the rest of our repos are using dependabot, this configures
dependabot as our dependency updater.

## About the changes

Closes #

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.
2026-10-07 09:50:30 +02:00
irstavr c837f99229 test(session): prove the session timeouts against real Postgres - EG-4708
Before this PR: every session test ran on `session.MemoryStore`, which
rewrites the whole record when a session is touched. But in prod
(`connect-session-knex`) updates only the `expired` column and leaves
the stored payload alone. So the store we actually ship on was never
tested.

Since we added the timeouts, current tests cannot actually assert on
session lifetime.

### What's new:

-added test helper`setupAppWithSessionStore`: now sessions live in
Postgres, with `sessionTimeouts` on by default (different test can
modify this). The rest helpers keep the in-memory store as before.

-added e2e `session-timeout` tests  against a real DB
-- idle window: a session nobody touched expires: a tab that only polls
does not keep itself alive - a fourteen one-minute reads survive, the
fifteenth minute ends it. the keep-alive moves the deadline, a plain
read does not. The keep-alive cannot revive an already-expired session.
Signing in again issues a new session id.
-- max-age: ends a session however active the user it, still applies on
its own with the timeouts off, not enforced while the flag is off.

-tested that sessions before the timeouts feature carry no timestamps,
so there's no window to measure -> they logout on 1st request.
(introduced in
[PR](https://github.com/bricks-software/unleash-enterprise/pull/1991))

-added e2e session tests: for the [keep-alive
endpoint](https://github.com/bricks-software/unleash-enterprise/pull/1992):
what it answers with a window in force, with the flag off, with no
session, and the ui-config interval both ways. Runs with
`strictSchemaValidation` on, so responses are checked against the new
schema.
2026-10-07 09:46:17 +02:00
Krzysztof (Kris) Kula d0fd5bbc0c chore: fix pnpm in the frontend directory
One file missed in
https://github.com/bricks-software/unleash-enterprise/pull/2019

```
/oss/frontend ❯ pnpm i
[ERROR] This project is configured to use 12.9.1 of pnpm. Your current pnpm is v11.15.1
Corepack invoked pnpm with this version, and pnpm does not switch versions when running under corepack.
Align the "packageManager" field in package.json with "devEngines.packageManager", or invoke pnpm directly (without corepack) so it can switch versions automatically.
If you want to bypass this version check, you can set the "pmOnFail" configuration to "warn" or "ignore" (e.g. via --pm-on-fail=ignore). If using "devEngines.packageManager", you can set its "onFail" to "warn" or "ignore"
```
2026-10-07 07:23:57 +00:00
renovate[bot] 9cf8d64753 chore(deps): update dependency browserslist to v4.29.3 (#12717)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [browserslist](https://redirect.github.com/browserslist/browserslist)
| [`4.29.2` →
`4.29.3`](https://renovatebot.com/diffs/npm/browserslist/4.29.2/4.29.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/browserslist/4.29.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/browserslist/4.29.2/4.29.3?slim=true)
|

---

### Release Notes

<details>
<summary>browserslist/browserslist (browserslist)</summary>

###
[`v4.29.3`](https://redirect.github.com/browserslist/browserslist/blob/HEAD/CHANGELOG.md#4293)

[Compare
Source](https://redirect.github.com/browserslist/browserslist/compare/4.29.2...4.29.3)

- Updated Firefox ESR.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-07 01:48:37 +00:00
renovate[bot] c36e648f06 chore(deps): update cypress-io/github-action action to v7.4.5 (#12716)
This PR contains the following updates:

| Package | Type | Update | Change | Pending |
|---|---|---|---|---|
|
[cypress-io/github-action](https://redirect.github.com/cypress-io/github-action)
| action | patch | `v7.4.4` → `v7.4.5` | `v7.4.6` |

---

### Release Notes

<details>
<summary>cypress-io/github-action (cypress-io/github-action)</summary>

###
[`v7.4.5`](https://redirect.github.com/cypress-io/github-action/releases/tag/v7.4.5)

[Compare
Source](https://redirect.github.com/cypress-io/github-action/compare/v7.4.4...v7.4.5)

##### Bug Fixes

- **deps:** execute npm audit fix
([#&#8203;1917](https://redirect.github.com/cypress-io/github-action/issues/1917))
([789d836](https://redirect.github.com/cypress-io/github-action/commit/789d836053c5ca389c2905fc0c9f2909da778c46))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-07 01:47:55 +00:00
Mateusz Prusaczyk 58fb8e8f55 fix: remove usage of node:util in the frontend app
This PR https://github.com/bricks-software/unleash-enterprise/pull/2019
replaced `lodash.isequal` with `node:util`.
But node:util is not available in the frontend and it broke local app
<img width="1177" height="536" alt="image"
src="https://github.com/user-attachments/assets/23c677b6-2bc9-4427-b716-dec691eef375"
/>

At the same time it looks like we have
`[dequal](https://github.com/lukeed/dequal)` already in the codebase, so
we could just use that.
2026-10-06 14:36:37 +00:00
Gastón Fournier 216901f2ab fix(ci): require frontend E2E success in PR build gate (#12715)
## Summary

PR #12369 merged with a failing frontend E2E test because the required
`build` check only depended on the backend and frontend builds.

Call the existing frontend E2E workflow from PR Build and include its
result in the required `build` gate. E2E must succeed for the gate to
pass; backend and frontend builds can still be skipped by their existing
path filters. Remove the E2E workflow's standalone PR trigger to avoid
duplicate runs. E2E continues to run on every PR, and no branch
protection changes are needed.
2026-10-06 16:19:14 +02:00
Krzysztof (Kris) Kula 24db57a505 fix: CSP rules can't depend on the dynamic flag
It was evaluated only during startup so it was erroneously disabled even
after the flag got enabled.
2026-10-06 14:14:28 +00:00
Krzysztof (Kris) Kula d21eea0415 Revert "chore(deps): update dependency @biomejs/biome to v2.5.0" (#12714)
Revert https://github.com/Unleash/unleash/pull/12369

## About the changes

Closes #

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.
2026-10-06 15:55:33 +02:00
renovate[bot] c47fd81b31 chore(deps): update dependency @biomejs/biome to v2.5.0 (#12369)
> ℹ️ **Note**
> 
> This PR body was truncated due to platform limits.

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@biomejs/biome](https://biomejs.dev)
([source](https://redirect.github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome))
| [`2.4.16` →
`2.5.14`](https://renovatebot.com/diffs/npm/@biomejs%2fbiome/2.4.16/2.5.14)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@biomejs%2fbiome/2.5.14?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@biomejs%2fbiome/2.4.16/2.5.14?slim=true)
|

---

### Release Notes

<details>
<summary>biomejs/biome (@&#8203;biomejs/biome)</summary>

###
[`v2.5.14`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2514)

[Compare
Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.13...@biomejs/biome@2.5.14)

##### Patch Changes

- [#&#8203;9022](https://redirect.github.com/biomejs/biome/pull/9022)
[`0d49e24`](https://redirect.github.com/biomejs/biome/commit/0d49e24f51af4568d9c64f0f18a5b2a2758b7fe3)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery rule
[`noReturnInFinally`](https://biomejs.dev/linter/rules/no-return-in-finally/).
This rule disallows return statements in `Promise.prototype.finally()`
callbacks, including inside nested blocks and conditional branches.
Returns in nested functions are ignored by the rule.

  ```js
  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })

  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })
  ```

Returning a value from a `Promise.prototype.finally()` callback does not
replace the original promise's fulfillment value, which can be
confusing. Returned promises and thenables are awaited, and their
rejection rejects the resulting promise.

- [#&#8203;11754](https://redirect.github.com/biomejs/biome/pull/11754)
[`71eaa0d`](https://redirect.github.com/biomejs/biome/commit/71eaa0d66b47af90329adb83ba125089f31d9484)
Thanks [@&#8203;griff-rees](https://redirect.github.com/griff-rees)! -
Added the nursery rule
[`noSvelteAtDebugTags`](https://biomejs.dev/linter/rules/no-svelte-at-debug-tags/),
which disallows Svelte's `{@debug}` tag.

  ```svelte
  <!-- Invalid: leftover debugging tag -->
  {@debug user}
  ```

The `{@debug}` tag is a debugging aid and should be removed once you no
longer need it, as it should not remain in production code. The rule
provides a safe fix that removes the tag.

- [#&#8203;11725](https://redirect.github.com/biomejs/biome/pull/11725)
[`5eb5f09`](https://redirect.github.com/biomejs/biome/commit/5eb5f09b867bf8b6693cbf8004c4534089cbfc43)
Thanks [@&#8203;m1handr](https://redirect.github.com/m1handr)! - Added
the nursery rule
[`useValidTestTitle`](https://biomejs.dev/linter/rules/use-valid-test-title/),
which enforces valid titles for unit test cases and suites.

- [#&#8203;11735](https://redirect.github.com/biomejs/biome/pull/11735)
[`9bd70c7`](https://redirect.github.com/biomejs/biome/commit/9bd70c7fd887242536d4bf135bb63e64bd96e2e7)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;8471](https://redirect.github.com/biomejs/biome/issues/8471):
`source.fixAll.biome` ignored `formatter.formatWithErrors`. It now
applies safe fixes without formatting files that have parse errors when
the option is disabled.

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7771](https://redirect.github.com/biomejs/biome/issues/7771):
Grit plugins that use `sequential` no longer panic when Biome processes
files.

- [#&#8203;11766](https://redirect.github.com/biomejs/biome/pull/11766)
[`c2542c6`](https://redirect.github.com/biomejs/biome/commit/c2542c613e5c8d7fb8ca6cbb66f67322446c621a)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
validation of `readonly` and `accessor` modifiers: combining them in
either order now reports that they cannot be used together.

- [#&#8203;11461](https://redirect.github.com/biomejs/biome/pull/11461)
[`22e9966`](https://redirect.github.com/biomejs/biome/commit/22e9966804906969d1fa9d411aacf31ebfa63d76)
Thanks [@&#8203;FoundDream](https://redirect.github.com/FoundDream)! -
Fixed
[#&#8203;11423](https://redirect.github.com/biomejs/biome/issues/11423):
Multiline template interpolations now preserve the indentation of their
closing brace when the source indentation is not a multiple of
`tabWidth`.

  ```diff
   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;
  ```

- [#&#8203;11766](https://redirect.github.com/biomejs/biome/pull/11766)
[`c2542c6`](https://redirect.github.com/biomejs/biome/commit/c2542c613e5c8d7fb8ca6cbb66f67322446c621a)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11763](https://redirect.github.com/biomejs/biome/issues/11763):
TypeScript class members using `override accessor`, such as `override
accessor value = 1`, now parse correctly. The reversed order, `accessor
override`, now reports that `override` must precede `accessor`.

- [#&#8203;11790](https://redirect.github.com/biomejs/biome/pull/11790)
[`17d0ff0`](https://redirect.github.com/biomejs/biome/commit/17d0ff027a87c4fe6e07b9fa6f0708bed37aeb52)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;10248](https://redirect.github.com/biomejs/biome/issues/10248):
[`noUselessFragments`](https://biomejs.dev/linter/rules/no-useless-fragments/)
now allows fragments with props in Astro files, such as `<Fragment
slot="name">{text}</Fragment>` inside template expressions.

- [#&#8203;11777](https://redirect.github.com/biomejs/biome/pull/11777)
[`7ee3a6c`](https://redirect.github.com/biomejs/biome/commit/7ee3a6cf44d578547eb62aca412693f6cc4d4d0d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7573](https://redirect.github.com/biomejs/biome/issues/7573):
added the `requireExplicitCase` option to
[`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/).
When set to `true`, the rule reports missing cases even when the switch
has a `default` clause, so you can keep a runtime fallback while
checking that every value in the union has its own case. The option
defaults to `false`.

- [#&#8203;11751](https://redirect.github.com/biomejs/biome/pull/11751)
[`d37f24b`](https://redirect.github.com/biomejs/biome/commit/d37f24b5fa901916a1e1b488857dd3ee4c8e74ec)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;8347](https://redirect.github.com/biomejs/biome/issues/8347):
the fix from
[`useConsistentArrowReturn`](https://biomejs.dev/linter/rules/use-consistent-arrow-return/)
now parenthesizes returned expressions that begin with object literals
before removing the arrow function body braces, preventing invalid
output for expressions such as object property access.

- [#&#8203;11784](https://redirect.github.com/biomejs/biome/pull/11784)
[`46e8912`](https://redirect.github.com/biomejs/biome/commit/46e8912580b2fbf96c6417da9bf1a822e0d13584)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11782](https://redirect.github.com/biomejs/biome/issues/11782):
[`noUndeclaredCustomProperties`](https://biomejs.dev/linter/rules/no-undeclared-custom-properties/)
could hang while checking stylesheets imported by JavaScript modules
with many shared dependencies.

- [#&#8203;11731](https://redirect.github.com/biomejs/biome/pull/11731)
[`1534885`](https://redirect.github.com/biomejs/biome/commit/15348855723550556333cdecfc6cfa6e08a28a00)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7984](https://redirect.github.com/biomejs/biome/issues/7984):
The fix from
[`useSimplifiedLogicExpression`](https://biomejs.dev/linter/rules/use-simplified-logic-expression/)
now preserves line breaks in multiline conditions with line comments,
preventing the right-hand side condition from being commented out.

- [#&#8203;11735](https://redirect.github.com/biomejs/biome/pull/11735)
[`9bd70c7`](https://redirect.github.com/biomejs/biome/commit/9bd70c7fd887242536d4bf135bb63e64bd96e2e7)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7304](https://redirect.github.com/biomejs/biome/issues/7304):
the HTML formatter now preserves authored segment breaks between CJK
characters, and next to CJK punctuation, instead of replacing them with
spaces.

  ```diff
   <div lang="zh-Hant-TW">
  -  這個段落是那麼長, 在一行寫不行。
  +  這個段落是那麼長,
  +  在一行寫不行。
   </div>
  ```

- [#&#8203;11749](https://redirect.github.com/biomejs/biome/pull/11749)
[`ff992a1`](https://redirect.github.com/biomejs/biome/commit/ff992a19d91d022dc28960c0153b369ed828d274)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;11747](https://redirect.github.com/biomejs/biome/issues/11747):
formatting and checking large parenthesized object expressions no longer
exhibit quadratic slowdowns.

- [#&#8203;11736](https://redirect.github.com/biomejs/biome/pull/11736)
[`1dd1fc4`](https://redirect.github.com/biomejs/biome/commit/1dd1fc420534dcb6104e7000d7905e88ce512631)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;8177](https://redirect.github.com/biomejs/biome/issues/8177):
code actions no longer modify the wrong part of Vue, Svelte, or Astro
files when experimental full HTML support is disabled.

- [#&#8203;11743](https://redirect.github.com/biomejs/biome/pull/11743)
[`3835945`](https://redirect.github.com/biomejs/biome/commit/3835945f0638c88162351318b7bc8b64c5f2fba7)
Thanks [@&#8203;santichausis](https://redirect.github.com/santichausis)!
- Fixed
[#&#8203;10247](https://redirect.github.com/biomejs/biome/issues/10247):
`biome check --write`/`biome lint --write` now correctly writes fixes
for code inside an HTML attribute expression (for example a Svelte
`onclick={...}` handler, or a mustache expression like `{count}`),
instead of silently reporting the diagnostic as fixable and applying
nothing.

For example, running `biome lint --write --unsafe` for
[`useBlockStatements`](https://biomejs.dev/linter/rules/use-block-statements/)
(an unsafe fix) on this Svelte component used to leave the file
unchanged:

  ```svelte
  <button onclick={() => { if (open) close(); }}>Close</button>
  ```

- [#&#8203;11740](https://redirect.github.com/biomejs/biome/pull/11740)
[`8ea8b4a`](https://redirect.github.com/biomejs/biome/commit/8ea8b4a4eceb7098b67bc031cc101306847df8e3)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11453](https://redirect.github.com/biomejs/biome/issues/11453):
[`useConsistentTestIt`](https://biomejs.dev/linter/rules/use-consistent-test-it/)
now updates imports alongside calls, preserving the original export
through an alias. The rule ignores locally declared functions and
withholds fixes when the preferred name would conflict with another
binding or global reference.

- [#&#8203;11355](https://redirect.github.com/biomejs/biome/pull/11355)
[`27177ca`](https://redirect.github.com/biomejs/biome/commit/27177ca7ea1e60c16c44ee0de645038610d5a921)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed the
HTML formatter incorrectly applying native HTML element formatting to
PascalCase component names such as `<Ul>` and `<Body>` in Vue, Svelte,
and Astro files.

  ```diff
  -<Body>
  -  <div>content</div>
  -</Body>
  +<Body><div>content</div></Body>
  ```

- [#&#8203;11355](https://redirect.github.com/biomejs/biome/pull/11355)
[`27177ca`](https://redirect.github.com/biomejs/biome/commit/27177ca7ea1e60c16c44ee0de645038610d5a921)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed the
HTML formatter incorrectly applying SVG block formatting to unknown
elements whose names matched SVG element names.

  ```diff
  -<foreignobject>
  -  <div>content</div>
  -</foreignobject>
  +<foreignobject><div>content</div></foreignobject>
  ```

- [#&#8203;11741](https://redirect.github.com/biomejs/biome/pull/11741)
[`fc69047`](https://redirect.github.com/biomejs/biome/commit/fc690476f317270d6e7e0604cabb16657cbbe8a3)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;8893](https://redirect.github.com/biomejs/biome/issues/8893):
[`useImportExtensions`](https://biomejs.dev/linter/rules/use-import-extensions/)
no longer suggests adding `.ts` to `.jsx` imports when a colocated
`.d.ts` file provides type declarations.

- [#&#8203;11642](https://redirect.github.com/biomejs/biome/pull/11642)
[`c87341c`](https://redirect.github.com/biomejs/biome/commit/c87341cbddfd2fd59fc024727e70583bc04122db)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery rule
[useConsistentFunctionStyle](https://biomejs.dev/linter/rules/use-consistent-function-style/),
which requires a consistent style for defining functions.

By default, the rule reports the following declaration because it
requires a function expression assigned to a variable:

  ```js
  function greet() {
      return "Hello";
  }
  ```

- [#&#8203;11770](https://redirect.github.com/biomejs/biome/pull/11770)
[`ddfd622`](https://redirect.github.com/biomejs/biome/commit/ddfd622d23cc99ccc39199ca98f6c890fe33900b)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;8980](https://redirect.github.com/biomejs/biome/issues/8980):
suppression comments targeting the entire `assist` category are now
respected, including `biome-ignore-all assist` when running `check`.

- [#&#8203;11792](https://redirect.github.com/biomejs/biome/pull/11792)
[`7a4b895`](https://redirect.github.com/biomejs/biome/commit/7a4b895345002b63add6b2a9ef130cbf33837bc5)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed dashed
utility base names in the Tailwind parser, including `border-bs`,
`font-features`, and `scrollbar-thumb`. Classes such as
`min-inline-[12rem]` now preserve the complete base name and parse the
arbitrary value separately.

- [#&#8203;11739](https://redirect.github.com/biomejs/biome/pull/11739)
[`1fc17e3`](https://redirect.github.com/biomejs/biome/commit/1fc17e34eb090e203b6961a0cad52533454c8c99)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - The rule
[`useIncludes`](https://biomejs.dev/linter/rules/use-includes/) now also
reports `lastIndexOf()` comparisons and `some()` calls with a
strict-equality callback.

  ```js
  arr.lastIndexOf(x) !== -1

  arr.some(item => item === x)
  ```

- [#&#8203;11735](https://redirect.github.com/biomejs/biome/pull/11735)
[`9bd70c7`](https://redirect.github.com/biomejs/biome/commit/9bd70c7fd887242536d4bf135bb63e64bd96e2e7)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6888](https://redirect.github.com/biomejs/biome/issues/6888).
GritQL plugins can now use `contains` on import-clause metavariables
such as `$clause` in `import $clause from "module"` patterns.

- [#&#8203;11790](https://redirect.github.com/biomejs/biome/pull/11790)
[`17d0ff0`](https://redirect.github.com/biomejs/biome/commit/17d0ff027a87c4fe6e07b9fa6f0708bed37aeb52)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;11786](https://redirect.github.com/biomejs/biome/issues/11786):
[`useAnchorContent`](https://biomejs.dev/linter/rules/use-anchor-content/)
now reports anchors without accessible content in HTML, Astro, Vue, and
Svelte even when they have an `aria-label`, `aria-labelledby`, or
`title` attribute, matching JSX behavior.

- [#&#8203;11651](https://redirect.github.com/biomejs/biome/pull/11651)
[`a9c4aa0`](https://redirect.github.com/biomejs/biome/commit/a9c4aa020b0b0a03a0e334dc6b107ac30ad5f774)
Thanks
[@&#8203;saberoueslati](https://redirect.github.com/saberoueslati)! -
Added the new nursery rule
[`noVueUndeclaredDirectives`](https://biomejs.dev/linter/rules/no-vue-undeclared-directives/),
which reports custom Vue directives that are not declared by a `<script
setup>` binding, the component's `directives` option, or the rule's
`globals` option. Closes
[#&#8203;11478](https://redirect.github.com/biomejs/biome/issues/11478).

  ```vue
  <template>
    <!-- v-highlight is not declared anywhere -->
    <div v-highlight></div>
  </template>
  ```

Aliased named imports in single-file components are now tracked under
their local name, so `noUndeclaredVariables` recognizes `vHighlight` in
`import { highlight as vHighlight } from "./directives"`.

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7795](https://redirect.github.com/biomejs/biome/issues/7795).
The [`noJsxLiterals`](https://biomejs.dev/linter/rules/no-jsx-literals/)
rule now ignores surrounding whitespace when matching literals against
`allowedStrings`.

- [#&#8203;11780](https://redirect.github.com/biomejs/biome/pull/11780)
[`99c7049`](https://redirect.github.com/biomejs/biome/commit/99c704908566b40eec4516046e250620b51de44d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed false positives in
[`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/)
when numeric cases use different spellings of the same value. For
example, `case 0x1` now covers the numeric literal type `1`.

- [#&#8203;11720](https://redirect.github.com/biomejs/biome/pull/11720)
[`c7c4e2b`](https://redirect.github.com/biomejs/biome/commit/c7c4e2b4495c50381852ff9d0102d561c8f76cd5)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7880](https://redirect.github.com/biomejs/biome/issues/7880):
[`noUselessStringConcat`](https://biomejs.dev/linter/rules/no-useless-string-concat/)
no longer reports literal concatenations split across multiple lines
when a numeric literal ends the chain.

- [#&#8203;11355](https://redirect.github.com/biomejs/biome/pull/11355)
[`27177ca`](https://redirect.github.com/biomejs/biome/commit/27177ca7ea1e60c16c44ee0de645038610d5a921)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Improved
performance of the HTML formatter for documents that contain many
HTML-native or SVG-native tags.

- [#&#8203;11720](https://redirect.github.com/biomejs/biome/pull/11720)
[`c7c4e2b`](https://redirect.github.com/biomejs/biome/commit/c7c4e2b4495c50381852ff9d0102d561c8f76cd5)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7949](https://redirect.github.com/biomejs/biome/issues/7949):
[`useReadonlyClassProperties`](https://biomejs.dev/linter/rules/use-readonly-class-properties/)
now reports static class properties that are never reassigned.

- [#&#8203;11751](https://redirect.github.com/biomejs/biome/pull/11751)
[`d37f24b`](https://redirect.github.com/biomejs/biome/commit/d37f24b5fa901916a1e1b488857dd3ee4c8e74ec)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7644](https://redirect.github.com/biomejs/biome/issues/7644):
[`useImportExtensions`](https://biomejs.dev/linter/rules/use-import-extensions/)
now resolves path aliases declared by referenced TypeScript project
configurations.

- [#&#8203;11791](https://redirect.github.com/biomejs/biome/pull/11791)
[`f88793c`](https://redirect.github.com/biomejs/biome/commit/f88793cec17a2c5bd22a774cbe01890f32b75463)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed a false
positive in
[`useTailwindShorthandClasses`](https://biomejs.dev/linter/rules/use-tailwind-shorthand-classes/)
for strings in conditional tests, such as `cn(m === "w-2 h-2" ?
"bg-red-800" : "bg-red-400")`.

- [#&#8203;11720](https://redirect.github.com/biomejs/biome/pull/11720)
[`c7c4e2b`](https://redirect.github.com/biomejs/biome/commit/c7c4e2b4495c50381852ff9d0102d561c8f76cd5)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7783](https://redirect.github.com/biomejs/biome/issues/7783):
[`noNoninteractiveElementInteractions`](https://biomejs.dev/linter/rules/no-noninteractive-element-interactions/)
no longer reports event handlers on native `<dialog>` elements.

- [#&#8203;11733](https://redirect.github.com/biomejs/biome/pull/11733)
[`7030068`](https://redirect.github.com/biomejs/biome/commit/7030068bc57fe53c9e311ef12dc19e97cbb4369a)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11730](https://redirect.github.com/biomejs/biome/issues/11730):
[`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/)
reports missing cases when iterating over a class property with
`for...of`.

- [#&#8203;11717](https://redirect.github.com/biomejs/biome/pull/11717)
[`2107dae`](https://redirect.github.com/biomejs/biome/commit/2107dae2003546bdc59a288b947a6f3c39f6d4e9)
Thanks [@&#8203;ternaus](https://redirect.github.com/ternaus)! - Fixed
[#&#8203;11716](https://redirect.github.com/biomejs/biome/issues/11716):
the
[`noUnknownAttribute`](https://biomejs.dev/linter/rules/no-unknown-attribute/)
rule now accepts fullscreen event handlers, the `credentialless` iframe
property, and the SVG `maskType` property when the React dependency
range allows React 19.3 or later. The `credentialless` and `maskType`
properties are restricted to `<iframe>` and `<mask>` elements,
respectively.

- [#&#8203;11737](https://redirect.github.com/biomejs/biome/pull/11737)
[`b7e3559`](https://redirect.github.com/biomejs/biome/commit/b7e3559aa35024aa8f793fd763b5e14c06ee6c62)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11692](https://redirect.github.com/biomejs/biome/issues/11692):
[`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/)
now detects unhandled promises returned through generic method
signatures, including Playwright fixtures.

- [#&#8203;11780](https://redirect.github.com/biomejs/biome/pull/11780)
[`99c7049`](https://redirect.github.com/biomejs/biome/commit/99c704908566b40eec4516046e250620b51de44d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7747](https://redirect.github.com/biomejs/biome/issues/7747):
[`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/)
now reports missing cases for literal unions derived from const tuples
with `(typeof values)[number]` and objects with `keyof typeof object`.

Other type-aware rules, including
[`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/)
and
[`noUselessTypeConversion`](https://biomejs.dev/linter/rules/no-useless-type-conversion/),
also recognize supported indexed-access results.

- [#&#8203;11724](https://redirect.github.com/biomejs/biome/pull/11724)
[`a9a5e9a`](https://redirect.github.com/biomejs/biome/commit/a9a5e9a9f8d74784bc7198911e8d00cde18f4dc2)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
redundant parentheses around binary and logical unary operands with
leading line comments.

  ```diff
   !(
     // leading
  -  (a || b)
  +  a || b
   );
  ```

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7722](https://redirect.github.com/biomejs/biome/issues/7722):
[`noUnusedImports`](https://biomejs.dev/linter/rules/no-unused-imports/)
no longer reports type-only imports used in computed names of declared
class properties.

- [#&#8203;11731](https://redirect.github.com/biomejs/biome/pull/11731)
[`1534885`](https://redirect.github.com/biomejs/biome/commit/15348855723550556333cdecfc6cfa6e08a28a00)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6390](https://redirect.github.com/biomejs/biome/issues/6390):
Biome now offers suppression actions for
[`noDynamicNamespaceImportAccess`](https://biomejs.dev/linter/rules/no-dynamic-namespace-import-access/)
in editors.

- [#&#8203;11751](https://redirect.github.com/biomejs/biome/pull/11751)
[`d37f24b`](https://redirect.github.com/biomejs/biome/commit/d37f24b5fa901916a1e1b488857dd3ee4c8e74ec)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7533](https://redirect.github.com/biomejs/biome/issues/7533):
[`noDescendingSpecificity`](https://biomejs.dev/linter/rules/no-descending-specificity/)
no longer compares selector specificity across separate cascade layer
blocks.

- [#&#8203;11735](https://redirect.github.com/biomejs/biome/pull/11735)
[`9bd70c7`](https://redirect.github.com/biomejs/biome/commit/9bd70c7fd887242536d4bf135bb63e64bd96e2e7)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6206](https://redirect.github.com/biomejs/biome/issues/6206):
[`useUniqueElementIds`](https://biomejs.dev/linter/rules/use-unique-element-ids)
no longer reports static IDs on elements in SVG contexts.

  ```jsx
  <svg>
      <defs>
          <pattern id="dots" width="10" height="10" />
      </defs>
      <rect fill="url(#dots)" width="100%" height="100%" />
  </svg>
  ```

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;5447](https://redirect.github.com/biomejs/biome/issues/5447),
so the GitHub reporter now associates annotations with the correct files
when Biome runs from a nested directory.

- [#&#8203;11720](https://redirect.github.com/biomejs/biome/pull/11720)
[`c7c4e2b`](https://redirect.github.com/biomejs/biome/commit/c7c4e2b4495c50381852ff9d0102d561c8f76cd5)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7816](https://redirect.github.com/biomejs/biome/issues/7816):
[`useHookAtTopLevel`](https://biomejs.dev/linter/rules/use-hook-at-top-level/)
no longer reports methods named like hooks when called on another
function's result, such as
`Reactotron.configure(...).useReactNative(...)`.

- [#&#8203;11355](https://redirect.github.com/biomejs/biome/pull/11355)
[`27177ca`](https://redirect.github.com/biomejs/biome/commit/27177ca7ea1e60c16c44ee0de645038610d5a921)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Removed
special HTML formatter handling for the obsolete `<listing>` element.

- [#&#8203;11731](https://redirect.github.com/biomejs/biome/pull/11731)
[`1534885`](https://redirect.github.com/biomejs/biome/commit/15348855723550556333cdecfc6cfa6e08a28a00)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed an issue where Grit plugin code fixes weren't available as editor
code actions.

- [#&#8203;11726](https://redirect.github.com/biomejs/biome/pull/11726)
[`dea163f`](https://redirect.github.com/biomejs/biome/commit/dea163f8fe3cccbfd8518b054c30560d87212f2f)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11722](https://redirect.github.com/biomejs/biome/issues/11722):
the JavaScript formatter inserts a newline before the closing angle
bracket when a leading comment forces type arguments onto multiple
lines.

  ```diff
   type Foo = Record<
     // comment
     string,
  -  number>;
  +  number
  +>;
  ```

- [#&#8203;9758](https://redirect.github.com/biomejs/biome/pull/9758)
[`02ea438`](https://redirect.github.com/biomejs/biome/commit/02ea438ca753faca8a87fc6935de501096dd4188)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - Added the
nursery rule
[`noJsonUnsafeValues`](https://biomejs.dev/linter/rules/no-json-unsafe-values/),
which disallows JSON values that are unsafe to use between different
tools or languages.

  **Invalid:**

  ```json5
  [
    2e308, // Number evaluating to Infinity
    -2e308, // Number evaluating to -Infinity
    "\ud83d", // String with lone surrogate
    1e-400, // Unsafe zero (too small, will evaluate to 0)
    9007199254740992, // Unsafe integer (outside safe integer range)
    2.2250738585072009e-308, // Subnormal number
  ]
  ```

- [#&#8203;11790](https://redirect.github.com/biomejs/biome/pull/11790)
[`17d0ff0`](https://redirect.github.com/biomejs/biome/commit/17d0ff027a87c4fe6e07b9fa6f0708bed37aeb52)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;8574](https://redirect.github.com/biomejs/biome/issues/8574):
the JavaScript formatter sometimes added extra parentheses and moved
comments when formatting multiline expressions after operators such as
`!`. Comments now stay beside the values they describe, without an extra
pair of parentheses.

  ```diff
   !(
  -  (
  -    cond1 || // force this to be multi line
  -    cond3
  -  ) // comment
  +  cond1 || // force this to be multi line
  +  cond3 // comment
   );
  ```

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7711](https://redirect.github.com/biomejs/biome/issues/7711):
`biome lint --suppress` no longer fails with conflicting rule fixes when
multiple diagnostics target a declaration preceded by a multiline
comment.

- [#&#8203;11700](https://redirect.github.com/biomejs/biome/pull/11700)
[`0e9fe53`](https://redirect.github.com/biomejs/biome/commit/0e9fe53d4b9edb5cb574392772f1ae76f29fd0f8)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery rule
[`noObsoleteTags`](https://biomejs.dev/linter/rules/no-obsolete-tags/),
which reports obsolete HTML elements in HTML and JSX, such as `<font
color="red">Text</font>`.

- [#&#8203;11735](https://redirect.github.com/biomejs/biome/pull/11735)
[`9bd70c7`](https://redirect.github.com/biomejs/biome/commit/9bd70c7fd887242536d4bf135bb63e64bd96e2e7)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7363](https://redirect.github.com/biomejs/biome/issues/7363):
Biome GritQL plugins now match TypeScript interface snippets such as
`interface $name { $body }`.

- [#&#8203;11729](https://redirect.github.com/biomejs/biome/pull/11729)
[`f047985`](https://redirect.github.com/biomejs/biome/commit/f04798503ed913572c78275f1c97995a510fee5c)
Thanks [@&#8203;m1handr](https://redirect.github.com/m1handr)! - Added
support for `suite()` as an alias of `describe()` across test analysis
rules and formatter. Rules now recognize `suite`, `fsuite`, `xsuite`,
and `test.suite` blocks. The formatter recognises them as test
declarations.

- [#&#8203;11778](https://redirect.github.com/biomejs/biome/pull/11778)
[`4b7aa1f`](https://redirect.github.com/biomejs/biome/commit/4b7aa1f2fe1b1301e7c7f4b2e3a9f9edd8c4b26d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7727](https://redirect.github.com/biomejs/biome/issues/7727):
GritQL snippets such as `import $what from $where` now match namespace
imports, including type-only imports. Explicit `import type $what from
$where` patterns also match type-only named and namespace imports.

- [#&#8203;11715](https://redirect.github.com/biomejs/biome/pull/11715)
[`f05a3c3`](https://redirect.github.com/biomejs/biome/commit/f05a3c3bd376a0515da44ab4cd4efde57c71c766)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7603](https://redirect.github.com/biomejs/biome/issues/7603):
[`useSingleJsDocAsterisk`](https://biomejs.dev/linter/rules/use-single-js-doc-asterisk/)
no longer reports asterisks that are part of JSDoc comment content, such
as italic text, as extra line markers.

- [#&#8203;11706](https://redirect.github.com/biomejs/biome/pull/11706)
[`e19512a`](https://redirect.github.com/biomejs/biome/commit/e19512a4c75e6819e679eb9246c1b819d2a2373c)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11704](https://redirect.github.com/biomejs/biome/issues/11704):
files re-included by negation patterns in a nested `.gitignore` are
processed when `vcs.useIgnoreFile` is enabled, even when the ignore file
contains `*`.

- [#&#8203;11718](https://redirect.github.com/biomejs/biome/pull/11718)
[`76a302a`](https://redirect.github.com/biomejs/biome/commit/76a302ac9d71f3888f298985f7e508148c676465)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;8573](https://redirect.github.com/biomejs/biome/issues/8573):
own-line comments before binary operators stay above the operator when
`javascript.formatter.operatorLinebreak` is `"before"`.

  ```diff
   foo
  -  || // comment
  -  bar;
  +  // comment
  +  || bar;
  ```

- [#&#8203;9797](https://redirect.github.com/biomejs/biome/pull/9797)
[`64fd314`](https://redirect.github.com/biomejs/biome/commit/64fd31405857b104f0c1a56c29bee70a6388471e)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - Added the
nursery rule
[`useConsistentObjectKeys`](https://biomejs.dev/linter/rules/use-consistent-object-keys),
which requires JSON object keys to follow a consistent Unicode
representation.

###
[`v2.5.13`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2513)

[Compare
Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.12...@biomejs/biome@2.5.13)

##### Patch Changes

- [#&#8203;11379](https://redirect.github.com/biomejs/biome/pull/11379)
[`07a0073`](https://redirect.github.com/biomejs/biome/commit/07a0073c1e1b1de323292968b8988cc6f79ec5c7)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - Added the
nursery rule
[`useLayeredStyles`](https://biomejs.dev/linter/rules/use-layered-styles/),
which enforces that style rules are defined within a cascade layer and
import rules to import its styles into a cascade layer.

  ```css
  /* Invalid */
  @import 'foo.css';

  .my-style {
    color: red;
  }

  /* Valid */
  @import 'foo.css' layer(base);

  @layer base {
    .my-style {
      color: red;
    }
  }
  ```

- [#&#8203;11667](https://redirect.github.com/biomejs/biome/pull/11667)
[`e997900`](https://redirect.github.com/biomejs/biome/commit/e997900c3eaf9d5efaf1ca12a067a962e1a04d0b)
Thanks [@&#8203;devtechedge](https://redirect.github.com/devtechedge)! -
Added the nursery rule
[`useBetterDomTraversing`](https://biomejs.dev/linter/rules/use-better-dom-traversing),
which prefers `.firstChild`, `.firstElementChild`, `.closest()`, and
merged `.querySelector()` calls over positional DOM traversal.

  ```js
  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");
  ```

- [#&#8203;11620](https://redirect.github.com/biomejs/biome/pull/11620)
[`20e513a`](https://redirect.github.com/biomejs/biome/commit/20e513af6fb0127854f4eb5cb9edee0f20d1b543)
Thanks
[@&#8203;jakeleventhal](https://redirect.github.com/jakeleventhal)! -
Fixed
[#&#8203;11610](https://redirect.github.com/biomejs/biome/issues/11610),
[#&#8203;11611](https://redirect.github.com/biomejs/biome/issues/11611),
[#&#8203;11612](https://redirect.github.com/biomejs/biome/issues/11612),
[#&#8203;11615](https://redirect.github.com/biomejs/biome/issues/11615),
and
[#&#8203;11616](https://redirect.github.com/biomejs/biome/issues/11616):
Biome no longer fully infers an imported generic declaration just to
apply its type arguments, restoring type-aware lint performance for
large libraries such as Zod. This improves
[`useRegexpExec`](https://biomejs.dev/linter/rules/use-regexp-exec),
[`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises),
[`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises),
[`useNullishCoalescing`](https://biomejs.dev/linter/rules/use-nullish-coalescing),
and
[`noUnsafePlusOperands`](https://biomejs.dev/linter/rules/no-unsafe-plus-operands).

- [#&#8203;11657](https://redirect.github.com/biomejs/biome/pull/11657)
[`e322040`](https://redirect.github.com/biomejs/biome/commit/e32204014687469e6c6f3684d32caf56311cc118)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7495](https://redirect.github.com/biomejs/biome/issues/7495):
[`noUselessConstructor`](https://biomejs.dev/linter/rules/no-useless-constructor/)
now ignores TypeScript constructors that forward at least one argument
to `super`, preserving constructors that narrow the subclass's accepted
parameter types. The exemption also applies when the parent and child
signatures are identical; JavaScript and zero-argument forwarding
behavior are unchanged.

- [#&#8203;11670](https://redirect.github.com/biomejs/biome/pull/11670)
[`4969ee1`](https://redirect.github.com/biomejs/biome/commit/4969ee1d73b48615f46f024539cfdb847f07064d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7076](https://redirect.github.com/biomejs/biome/issues/7076):
[`useAriaPropsForRole`](https://biomejs.dev/linter/rules/use-aria-props-for-role)
and
[`useFocusableInteractive`](https://biomejs.dev/linter/rules/use-focusable-interactive)
no longer report non-focusable elements with `role="separator"`. A
separator with an explicit `tabIndex` or `tabindex` still requires
`aria-valuenow`.

- [#&#8203;11627](https://redirect.github.com/biomejs/biome/pull/11627)
[`23aad6d`](https://redirect.github.com/biomejs/biome/commit/23aad6df8f71bd9b134633c43d2334771687d10d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6571](https://redirect.github.com/biomejs/biome/issues/6571) so
Grit plugins can capture and inspect multiple named import specifiers.

- [#&#8203;11631](https://redirect.github.com/biomejs/biome/pull/11631)
[`00dbd3a`](https://redirect.github.com/biomejs/biome/commit/00dbd3a30489617d5bb55466006ac9977612a23b)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Reduced unnecessary type inference when type-aware lint rules inspect
members of namespace imports from libraries such as Zod. Fixed type
inference so blanket re-exports do not expose default exports.

- [#&#8203;11628](https://redirect.github.com/biomejs/biome/pull/11628)
[`a2f8ff7`](https://redirect.github.com/biomejs/biome/commit/a2f8ff7a1eb01f5c91e7154937e17f761863e3bc)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery rule
[`noXorAsExponentiation`](https://biomejs.dev/linter/rules/no-xor-as-exponentiation/),
which reports the bitwise XOR operator `^` between two decimal integer
literals, where the exponentiation operator `**` was likely intended.

  ```js
  const kibibyte = 2 ^ 10; // 8, not 1024
  ```

- [#&#8203;11670](https://redirect.github.com/biomejs/biome/pull/11670)
[`4969ee1`](https://redirect.github.com/biomejs/biome/commit/4969ee1d73b48615f46f024539cfdb847f07064d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7192](https://redirect.github.com/biomejs/biome/issues/7192):
[`noUnusedPrivateClassMembers`](https://biomejs.dev/linter/rules/no-unused-private-class-members/)
now considers compound assignments such as `??=` to read and use private
class members.

- [#&#8203;11676](https://redirect.github.com/biomejs/biome/pull/11676)
[`840a52a`](https://redirect.github.com/biomejs/biome/commit/840a52ad14b027e21661a9121b316ccac139d736)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[#&#8203;11672](https://redirect.github.com/biomejs/biome/issues/11672)
and
[#&#8203;11671](https://redirect.github.com/biomejs/biome/issues/11671)
by disabling the experimental capitalized-call and effect-dependency
checks in
[`useReactCompiler`](https://biomejs.dev/linter/rules/use-react-compiler/),
matching their exclusion from upstream's recommended lint preset. Valid
calls such as `Intl.NumberFormat()` and captures of variables declared
inside effects no longer produce these diagnostics.

- [#&#8203;11660](https://redirect.github.com/biomejs/biome/pull/11660)
[`49485ed`](https://redirect.github.com/biomejs/biome/commit/49485eda65813e5b7e2be68cdd56ffd90674f713)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;11653](https://redirect.github.com/biomejs/biome/issues/11653):
Astro template suppression comments (`{/* biome-ignore lint: reason
*/}`) now suppress matching HTML lint diagnostics on the following line
when full HTML support is enabled.

- [#&#8203;11664](https://redirect.github.com/biomejs/biome/pull/11664)
[`9a73b9c`](https://redirect.github.com/biomejs/biome/commit/9a73b9cc4bb1000336dc25704546f4d63a9bb326)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Improved the
performance of
[`useRegexpExec`](https://biomejs.dev/linter/rules/use-regexp-exec/).

- [#&#8203;11661](https://redirect.github.com/biomejs/biome/pull/11661)
[`5341b3f`](https://redirect.github.com/biomejs/biome/commit/5341b3fb9c7bae8ce2426d32e6e72aed9637a82f)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7479](https://redirect.github.com/biomejs/biome/issues/7479).
[`noUnusedVariables`](https://biomejs.dev/linter/rules/no-unused-variables/)
now treats Unicode escapes in identifiers as the same binding as their
decoded spelling.

- [#&#8203;11630](https://redirect.github.com/biomejs/biome/pull/11630)
[`62e1fc5`](https://redirect.github.com/biomejs/biome/commit/62e1fc59621b6ab5c3988ae36b6591180e07d08f)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed the
HTML formatter inserting whitespace between adjacent Svelte expressions
when their combined length exceeds the line width.

  ```diff
   <span>
  -  {head.median - base.median >= 0 ? "+" : "−"}
  -  {formatMs(Math.abs(head.median - base.median))}
+ {head.median - base.median >= 0 ? "+" :
"−"}{formatMs(Math.abs(head.median - base.median))}
   </span>
  ```

- [#&#8203;11658](https://redirect.github.com/biomejs/biome/pull/11658)
[`ed4bfa4`](https://redirect.github.com/biomejs/biome/commit/ed4bfa4a1de63241a7c3586ff12d7f990cf84303)
Thanks [@&#8203;fredrikblau](https://redirect.github.com/fredrikblau)! -
Fixed
[#&#8203;11644](https://redirect.github.com/biomejs/biome/issues/11644):
[`useHeadingContent`](https://biomejs.dev/linter/rules/use-heading-content/)
no longer reports headings that render their text with a directive:
`set:html` and `set:text` in Astro files, `v-html` and `v-text` in Vue
files.

  ```astro
  <h1 set:html={heading} />
  <h2 set:text={heading}></h2>
  ```

  ```vue
  <template>
    <h1 v-html="heading"></h1>
    <h2 v-text="heading"></h2>
  </template>
  ```

- [#&#8203;11613](https://redirect.github.com/biomejs/biome/pull/11613)
[`47d7383`](https://redirect.github.com/biomejs/biome/commit/47d7383d049b36ff8eaba50912176928143dd9e9)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Improved the performance of Biome Formatter up to \~50% in some cases.

- [#&#8203;11655](https://redirect.github.com/biomejs/biome/pull/11655)
[`fd8fc74`](https://redirect.github.com/biomejs/biome/commit/fd8fc741ee2b77b3b127859fabc7a29b19e1fb0b)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6974](https://redirect.github.com/biomejs/biome/issues/6974),
where
[`noUnusedPrivateClassMembers`](https://biomejs.dev/linter/rules/no-unused-private-class-members/)
incorrectly reported TypeScript private constructor properties read
through object destructuring from `this` as unused.

- [#&#8203;11618](https://redirect.github.com/biomejs/biome/pull/11618)
[`21a10cf`](https://redirect.github.com/biomejs/biome/commit/21a10cfcac4db8044e8bff6b24d9b1e197c2b343)
Thanks [@&#8203;siketyan](https://redirect.github.com/siketyan)! - Fixed
[#&#8203;11605](https://redirect.github.com/biomejs/biome/issues/11605):
Type inference now infers the type of an unannotated callback parameter
from the signature of the function the callback is passed to, and
honours explicit type arguments on call expressions. This improves
type-aware analysis for
[`noBaseToString`](https://biomejs.dev/linter/rules/no-base-to-string/),
[`noFloatingPromises`](https://biomejs.dev/linter/rules/no-floating-promises/),
[`noMisleadingReturnType`](https://biomejs.dev/linter/rules/no-misleading-return-type/),
[`noMisusedPromises`](https://biomejs.dev/linter/rules/no-misused-promises/),
[`noUnnecessaryConditions`](https://biomejs.dev/linter/rules/no-unnecessary-conditions/),
[`noUnsafePlusOperands`](https://biomejs.dev/linter/rules/no-unsafe-plus-operands/),
[`noUselessTypeConversion`](https://biomejs.dev/linter/rules/no-useless-type-conversion/),
[`useArrayFind`](https://biomejs.dev/linter/rules/use-array-find/),
[`useArraySortCompare`](https://biomejs.dev/linter/rules/use-array-sort-compare/),
[`useAwaitThenable`](https://biomejs.dev/linter/rules/use-await-thenable/),
[`useDisposables`](https://biomejs.dev/linter/rules/use-disposables/),
[`useExhaustiveSwitchCases`](https://biomejs.dev/linter/rules/use-exhaustive-switch-cases/),
[`useIncludes`](https://biomejs.dev/linter/rules/use-includes/),
[`useNullishCoalescing`](https://biomejs.dev/linter/rules/use-nullish-coalescing/),
[`useRegexpExec`](https://biomejs.dev/linter/rules/use-regexp-exec/),
and
[`useStringStartsEndsWith`](https://biomejs.dev/linter/rules/use-string-starts-ends-with/).
For example, `noFloatingPromises` can now detect Promises reached
through such parameters:

  ```ts
  interface Context {
    doSomething(): Promise<void>;
  }

declare function test(callback: (ctx: Context) => Promise<void>): void;

  test(async (ctx) => {
  	ctx.doSomething(); // now reported as a floating promise
  });
  ```

- [#&#8203;11698](https://redirect.github.com/biomejs/biome/pull/11698)
[`b019982`](https://redirect.github.com/biomejs/biome/commit/b019982bfbf8a9db58bd16b1e5e1a241128540d4)
Thanks [@&#8203;denbezrukov](https://redirect.github.com/denbezrukov)! -
Fixed parsing of unquoted CSS URLs beginning with `@` or `!`, such as
`url(@/assets/icon.svg)` and `url(!font.woff2)`. Preserved escaped and
non-ASCII whitespace in raw URLs during formatting.

  ```diff
  -background-image: url(image\);
  +background-image: url(image\ );
  ```

- [#&#8203;11622](https://redirect.github.com/biomejs/biome/pull/11622)
[`c23e4c7`](https://redirect.github.com/biomejs/biome/commit/c23e4c7e7a33d3f00863d80be663678af8c2a073)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - Added the
nursery rule
[`noUnsafeIframeSandbox`](https://biomejs.dev/linter/rules/no-unsafe-iframe-sandbox/),
which reports `iframe` elements whose `sandbox` attribute combines
`allow-scripts` and `allow-same-origin`, since that combination lets the
embedded document remove its own sandboxing.

  ```jsx
<iframe src="https://example.com" sandbox="allow-scripts
allow-same-origin" />
  ```

- [#&#8203;11606](https://redirect.github.com/biomejs/biome/pull/11606)
[`de0528f`](https://redirect.github.com/biomejs/biome/commit/de0528f940ea41b798816e1923b2b51ffcd0b473)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
recommended
[`noSvelteAtHtmlTags`](https://biomejs.dev/linter/rules/no-svelte-at-html-tags)
nursery rule, which reports Svelte `{@html}` tags that render unescaped
HTML.

- [#&#8203;11670](https://redirect.github.com/biomejs/biome/pull/11670)
[`4969ee1`](https://redirect.github.com/biomejs/biome/commit/4969ee1d73b48615f46f024539cfdb847f07064d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;6782](https://redirect.github.com/biomejs/biome/issues/6782):
GritQL plugins now match captured JSX component names against code
snippets such as `React.Fragment`.

- [#&#8203;11687](https://redirect.github.com/biomejs/biome/pull/11687)
[`09d97d9`](https://redirect.github.com/biomejs/biome/commit/09d97d973b522c6bd95e6d26006cb4b3a221396d)
Thanks [@&#8203;hori-design](https://redirect.github.com/hori-design)! -
Fixed
[#&#8203;11678](https://redirect.github.com/biomejs/biome/issues/11678):
[`useReactCompiler`](https://biomejs.dev/linter/rules/use-react-compiler/)
no longer panics on files that contain non-ASCII characters. This bumps
the React Compiler version.

- [#&#8203;11595](https://redirect.github.com/biomejs/biome/pull/11595)
[`a64d757`](https://redirect.github.com/biomejs/biome/commit/a64d7572d5684f3555be5dc02eb1d29a16f290dc)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery Vue-domain rule
[`useVueBaseImport`](https://biomejs.dev/linter/rules/use-vue-base-import/)
rule, which enforces importing Vue APIs from `vue` instead of internal
`@vue/*` packages.

- [#&#8203;11675](https://redirect.github.com/biomejs/biome/pull/11675)
[`353cbae`](https://redirect.github.com/biomejs/biome/commit/353cbae47056f8e03b27d1d9b69e165b5b72f122)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Fixed
[`useReactCompiler`](https://biomejs.dev/linter/rules/use-react-compiler/)
silently producing no diagnostics in WebAssembly builds, including the
playground.

- [#&#8203;11625](https://redirect.github.com/biomejs/biome/pull/11625)
[`ea20e5a`](https://redirect.github.com/biomejs/biome/commit/ea20e5a4640b4455cd12e0eb6ffaa590803c67a2)
Thanks [@&#8203;denbezrukov](https://redirect.github.com/denbezrukov)! -
Improved linting performance for large CSS and JSON files.

- [#&#8203;11670](https://redirect.github.com/biomejs/biome/pull/11670)
[`4969ee1`](https://redirect.github.com/biomejs/biome/commit/4969ee1d73b48615f46f024539cfdb847f07064d)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;7527](https://redirect.github.com/biomejs/biome/issues/7527):
suppression actions for diagnostics emitted on comments are now inserted
before the diagnostic comment. In particular, suppressing
[`noTsIgnore`](https://biomejs.dev/linter/rules/no-ts-ignore/) now
places the `biome-ignore` comment before `@ts-ignore`.

- [#&#8203;11655](https://redirect.github.com/biomejs/biome/pull/11655)
[`fd8fc74`](https://redirect.github.com/biomejs/biome/commit/fd8fc741ee2b77b3b127859fabc7a29b19e1fb0b)
Thanks [@&#8203;ematipico](https://redirect.github.com/ematipico)! -
Fixed
[#&#8203;8629](https://redirect.github.com/biomejs/biome/issues/8629),
where
[`noUnusedPrivateClassMembers`](https://biomejs.dev/linter/rules/no-unused-private-class-members/)
incorrectly reported used private TypeScript method overload signatures
as unused.

- [#&#8203;11669](https://redirect.github.com/biomejs/biome/pull/11669)
[`579f401`](https://redirect.github.com/biomejs/biome/commit/579f401b0a97760db99d64b97b2bc29ab20e3f8a)
Thanks [@&#8203;denbezrukov](https://redirect.github.com/denbezrukov)! -
Improved the performance of
[`noExcessiveLinesPerFile`](https://biomejs.dev/linter/rules/no-excessive-lines-per-file/)
when `skipBlankLines` is `false`.

###
[`v2.5.12`](https://redirect.github.com/biomejs/biome/blob/HEAD/packages/@biomejs/biome/CHANGELOG.md#2512)

[Compare
Source](https://redirect.github.com/biomejs/biome/compare/@biomejs/biome@2.5.11...@biomejs/biome@2.5.12)

##### Patch Changes

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed Astro attribute expressions rejecting TypeScript and JSX syntax
that is accepted in text expressions.

  ```astro
<Component icon={<Icon />} count={total as number} onSelect={(e: Event)
=> e} />
  ```

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed Astro attribute names being split on `:` and `.` inside an
expression, such as `{x && <button x-on:keyup.enter={go} client:load.foo
/>}`.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed a bare `>` in the children of an Astro expression being treated as
markup, such as `{x && <div>a > b</div>}`.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed HTML comments inside an Astro expression failing to parse. They
are now read as trivia, wherever they appear among the children.

  ```astro
  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}
  ```

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed `is:raw` children inside an Astro expression being read as JSX,
such as `{x && <div is:raw>{not js} < & text</div>}`.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed an apostrophe or quote in the text of a JSX element inside an
Astro expression ending the expression early, such as `{items.map((i) =>
<li>it's {i}</li>)}`.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed the children of a `<script>` or `<style>` inside an Astro
expression being read as JSX. Their contents are text, so braces and
comparisons no longer have to be escaped.

  ```astro
  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}
  ```

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Added support for template literal attribute values inside an Astro
expression, such as ``{x && <C data-x=`t${x}` />}``.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed unquoted attribute values being rejected inside an Astro
expression, such as `{x && <a class=foo maxlength=255
href=/about>go</a>}`.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed a template literal nested inside `${}` breaking the rest of an
Astro file, such as ``const href = `/blog${page === 0 ? '' : `/${page +
1}`}`;``.

- [#&#8203;11440](https://redirect.github.com/biomejs/biome/pull/11440)
[`b88f1ea`](https://redirect.github.com/biomejs/biome/commit/b88f1ea368c727ff8ebeddcaf9448f6ddc7c4878)
Thanks [@&#8203;Princesseuh](https://redirect.github.com/Princesseuh)! -
Fixed a quote inside a regex character class breaking the rest of an
Astro file, such as `const unsafe = /[/"]/;`.

- [#&#8203;11508](https://redirect.github.com/biomejs/biome/pull/11508)
[`54f3a2e`](https://redirect.github.com/biomejs/biome/commit/54f3a2ea2765c80df11d04e47cd8da0354f5f7ca)
Thanks [@&#8203;dyc3](https://redirect.github.com/dyc3)! - Added the
nursery rule
[`useFlatMathMinMax`](https://biomejs.dev/linter/rules/use-flat-math-min-max/).
Because `Math.min()` and `Math.max()` accept any number of arguments,
the rule reports unnecessary nested calls to the same method:

  ```js
  Math.max(Math.max(a, b), c);
  ```

  The fix flattens this expression to `Math.max(a, b, c)`.

- [#&#8203;11585](https://redirect.github.com/biomejs/biome/pull/11585)
[`c5c8315`](https://redirect.github.com/biomejs/biome/commit/c5c8315cc2174b52834513d4c01edd09341e46cd)
Thanks [@&#8203;Netail](https://redirect.github.com/Netail)! - Fixed
[#&#8203;11475](https://redirect.github.com/biomejs/biome/issues/11475):
`noUnresolvedImports` no longer reports Bun runtime built-in modules
(`bun`, `bun:bundle`, `bun:ffi`, `bun:jsc`, `bun:sqlite`, `bun:test`).

- [#&#8203;11368](https://redirect.github.com/biomejs/biome/pull/11368)
[`52a57b3`](https://redirect.github.com/biomejs/biome/commit/52a57b374af947ffcba11f0dd97b3cb9676ce044)
Thanks [@&#8203;Austin1serb](https://redirect.github.com/Austin1serb)! -

> ❗ **Important**
> 
> ✂ PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzEuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-06 12:06:21 +00:00
Gastón Fournier 0688ebd88c fix(docker): use Dockerfile Node version by default in Bake (#12713)
Published images currently use Node 22.22 because docker-bake.hcl passes
a stale build argument over the Dockerfile's 22.23 default.

Set the Bake variable default to null so the Dockerfile ARG is the
single source of truth. Keep the variable and argument mapping so
explicit NODE_VERSION environment overrides still work. Renovate can
continue updating the Dockerfile without a custom manager.

Simpler alternative to #12688. Docker documents this null behaviour:
https://docs.docker.com/build/bake/reference/#variable
2026-10-06 13:48:15 +02:00
Christopher Kolstad de76f2aded chore: security maintenance
This won't fix all warnings, but it should get undici and nodemailer out
of our way.

We'll need to have a look at our mcp server as well as our swagger
dependencies afterwards.
2026-10-06 13:45:40 +02:00
Mateusz Prusaczyk 232bc73b0a feat(tags): rename tag values from the UI
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 13:42:08 +02:00
David Leek 67f9aa1843 feat(addons): add support for array and object-array parameter types 2026-10-06 13:13:58 +02:00
Mateusz Prusaczyk 074a0f0385 feat(tags): delete tag values from the UI
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 13:04:30 +02:00
Adam Bar 23103ff683 feat: left-align the hide/show environments button
Aligns the button to the start of its container.

[DX-4921](https://linear.app/unleash/issue/DX-4921/left-align-the-hideshow-environments-dropdown)

**Before**
<img width="389" height="588" alt="image"
src="https://github.com/user-attachments/assets/1f371340-7d7c-487d-bec4-b9333f069d71"
/>

**After**
<img width="373" height="593" alt="image"
src="https://github.com/user-attachments/assets/e45f90d4-4874-436b-b06f-5b004915fe29"
/>
2026-10-06 12:55:15 +02:00
Gastón Fournier 925ef59cfa fix: drain scheduled jobs before database shutdown
## Problem and change

Stopping the scheduler previously **cleared its timers without waiting
for executions already in progress**. Application shutdown could then
destroy the database pool while a scheduled job, or its maintenance-mode
check, was still using it. This creates a race in which an otherwise
healthy background job can fail during shutdown.

Track each execution, including its maintenance check, reject new
executions once stopping begins, cancel recurring and jitter timers, and
await pending work before destroying the database. Recheck stopping
after the asynchronous maintenance check so it cannot start a job during
teardown.

Use a shared execution path for immediate, jittered, and recurring runs.
Preserve exception logging with the job ID and emit duration events for
failed jobs as well. The jittered callback now handles failures through
the same path rather than leaving a rejected promise unhandled.

## Validation using existing signals

We'll use scheduler error logs as the primary signal looking for
scheduler job failures `scheduled job failed` and database
connection/pool teardown errors after `Shutting down Unleash...`.

<img width="1242" height="153" alt="image"
src="https://github.com/user-attachments/assets/6abf50df-7b30-484d-b10c-d014c0657d4d"
/>

Disappearance of these errors would be a meaningful positive signal.
Also watch for longer shutdowns and forced termination.

## Operational tradeoff

A stuck job can block graceful shutdown until the deployment forcibly
terminates the process.

A startup-only feature flag would require a restart to change behavior,
so it would not provide an immediate runtime rollback
2026-10-06 12:06:12 +02:00
Krzysztof (Kris) Kula ec48c234df refactor: removing extra dependencies
Removing some extra hook dependencies
https://biomejs.dev/linter/rules/use-exhaustive-dependencies/#description
2026-10-06 11:42:54 +02:00
Nuno Góis f5d11a9e36 chore: new invite button in header
https://linear.app/unleash/issue/SA-1077/update-invite-button-in-the-header

Updates the invite button in the header.

This new button has a new design and it redirects users to the users
page (/admin/users). It sits behind the `newUserInviteFlow` feature
flag.

### Default

<img width="268" height="89" alt="image"
src="https://github.com/user-attachments/assets/75f7cc1e-50ea-4632-a50d-e104b558bdf9"
/>

### Hover

<img width="218" height="61" alt="image"
src="https://github.com/user-attachments/assets/a207afc0-65ec-4669-850d-fa8fbe4a9db5"
/>
2026-10-06 10:05:35 +01:00
Kamala d683eacd9e chore: break out CreateFeatureDialog sidebar into reusable component
Copies the `sidebar` from `LegacyCreateFeatureForm` into a shared
`CreateFeatureDialogSidebar` which can then be reused by the new
`CreateFeatureForm` (coming in a separate PR).
2026-10-06 11:01:11 +02:00
Krzysztof (Kris) Kula b5c7e28812 chore(deps): bump @fern-api/search-widget to 0.6.0
instead of disabling Search Docs button we decided that it's fine if
it's movable.
New version of fern widget is movable by default so it's enough to just
bump it's version



https://github.com/user-attachments/assets/b6d1a8a4-487d-4c59-aa34-9dcb39f47875
2026-10-06 08:56:51 +00:00
Mateusz Prusaczyk 86a6ffbd63 chore(e2e): Log docker logs on e2e test fail 2026-10-06 10:55:19 +02:00
Gergo Kekesi 55f876c0b0 chore: remove Plausible tracking from the admin UI
We've decided that we will no longer use Plausible.

- Remove `PlausibleProvider` and `PlausibleContext`
- `EventTrackerProvider` no longer forwards events to Plausible; they go
to the flight recorder only
- Drop the `plausible-tracker` package and `plausible.getunleash.io`
from the CSP
2026-10-06 09:37:38 +01:00
GitHub Actions Bot a066d0eaac chore(oss): sync Unleash/unleash main 2026-10-06 08:25:02 +00:00
Mateusz Prusaczyk 555b49c08e chore(strategies): simplerStrategySetup flag clean up - part 4 - drop unused options and move wizard components
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 10:11:43 +02:00
Mateusz Prusaczyk 3e9da953e4 chore(strategies): simplerStrategySetup flag clean up - part 3 - delete unused code
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 08:13:29 +02:00
renovate[bot] e9a4ba208f chore(deps): update dependency systeminformation to v5.33.14 (#12712)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [systeminformation](https://systeminformation.io)
([source](https://redirect.github.com/sebhildebrandt/systeminformation))
| [`5.33.13` →
`5.33.14`](https://renovatebot.com/diffs/npm/systeminformation/5.33.13/5.33.14)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/systeminformation/5.33.14?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/systeminformation/5.33.13/5.33.14?slim=true)
|

---

### Release Notes

<details>
<summary>sebhildebrandt/systeminformation (systeminformation)</summary>

###
[`v5.33.14`](https://redirect.github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14)

[Compare
Source](https://redirect.github.com/sebhildebrandt/systeminformation/compare/v5.33.13...v5.33.14)

**Full Changelog**:
<https://github.com/sebhildebrandt/systeminformation/compare/v5.33.13...v5.33.14>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-06 01:10:31 +00:00
renovate[bot] b0286786d6 chore(deps): update dependency @types/sanitize-html to v2.16.2 (#12711)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/sanitize-html](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/sanitize-html)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html))
| [`2.16.1` →
`2.16.2`](https://renovatebot.com/diffs/npm/@types%2fsanitize-html/2.16.1/2.16.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fsanitize-html/2.16.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fsanitize-html/2.16.1/2.16.2?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-06 01:09:10 +00:00
renovate[bot] 326a209716 chore(deps): update dependency nodemailer to v10.0.12 (#12710)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [nodemailer](https://nodemailer.com/)
([source](https://redirect.github.com/nodemailer/nodemailer)) |
[`10.0.11` →
`10.0.12`](https://renovatebot.com/diffs/npm/nodemailer/10.0.11/10.0.12)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/nodemailer/10.0.12?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nodemailer/10.0.11/10.0.12?slim=true)
|

---

### Release Notes

<details>
<summary>nodemailer/nodemailer (nodemailer)</summary>

###
[`v10.0.12`](https://redirect.github.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#10012-2026-09-28)

[Compare
Source](https://redirect.github.com/nodemailer/nodemailer/compare/v10.0.11...v10.0.12)

##### Bug Fixes

- settle every send on a connection error, back off pool requeues, turn
a bare CR into CRLF, bound fetch, honour requireTLS
([63ccd66](https://redirect.github.com/nodemailer/nodemailer/commit/63ccd66c894bbaac18c82084ee385bf6488226cf))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-05 21:30:51 +00:00
renovate[bot] 1ba05c88cd chore(deps): update dependency browserslist to v4.29.2 (#12709)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [browserslist](https://redirect.github.com/browserslist/browserslist)
| [`4.29.1` →
`4.29.2`](https://renovatebot.com/diffs/npm/browserslist/4.29.1/4.29.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/browserslist/4.29.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/browserslist/4.29.1/4.29.2?slim=true)
|

---

### Release Notes

<details>
<summary>browserslist/browserslist (browserslist)</summary>

###
[`v4.29.2`](https://redirect.github.com/browserslist/browserslist/blob/HEAD/CHANGELOG.md#4292)

[Compare
Source](https://redirect.github.com/browserslist/browserslist/compare/4.29.1...4.29.2)

- Fixed ignoring `null` usage in `cover X in Y` query (by
[@&#8203;wahidrizka](https://redirect.github.com/wahidrizka)).

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzQuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEzNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-05 21:30:39 +00:00
irstavr 33f133207e feat(session): report user activity from the admin UI - EG-4709
**What this does:** Adds a react hook that listens for _real_ user
activity and pings the `keep-alive` endpoint.

The server only counts data-changing requests as activity, so just
**reading and scrolling don't count** - this hook reports actual input.

### So when does it ping?
when timeouts interval is disabled: no listeners, no timers, no requests
=> no performance overhead.

otherwise, it listens for pointerdown, keydown, wheel, touchstart,
visibilitychange in a visible tab.
Posts to `keep-alive` at most once per server's interval.

### Notes
Scroll is not tracked, and should _never_ be added. The browser fires
scroll events for both user input and scrolling -`isTrusted` doesn't
distinguish between them. One `scrollIntoView` during a re-render would
silently renew a session in a tab nobody's looking at, turning the idle
timeout into dead code on that page.

All _human_ scrolling is covered: wheel and trackpad by wheel, scrollbar
drag by pointerdown, PageDown and arrow keys by keydown, touch by
touchstart.

Listeners use the `capture` phase. Menus and dialogs call
`stopPropagation`, which would otherwise hide real user input from us.

`visibilitychange` fires both ways. The visibility check in `onActivity`
is what prevents a tab going away from counting as activity.

Failed pings back off gracefully. A failed req waits 5'' instead of
burning the whole interval. The backoff is intentionally clamped at 0,
so a short interval can't push the throttle forward and permanently
block pings.

---------

Co-authored-by: irstavr <irini.stavrakantonaki@goeve.com>
2026-10-05 18:31:43 +02:00
irstavr 411ba32ca6 feat(session): add the keep-alive endpoint - EG-4709
**Part of the [idle timeouts
project](https://linear.app/unleash/project/configurable-idle-session-timeout-with-re-authentication-after-68a334e79506)**
- introducing 'keep-alive'

**What this does**: Adds a new public endpoint that the UI can call to
check if the session is about to expire.

### The new endpoint
 POST `/api/admin/session/keep-alive ` 
any signed-in user can call it, regardless of roles - no side effects,
no audit logs .

it returns 200 with {`"expiresInMs": n}` if a timeout is active, or `200
{}` if not. One status code intentionally—callers read a field instead
of branching on HTTP codes.

It does not renew the session. It's the `sessionTimeoutMiddleware` that
handles that for any non-GET request under `/api.`
The keep-alive is for the UI to post telemetry (signals the user is
alive :p)

`expiresInMs`: can also be used in the future for a warn-before-signout
dialog to the user - as it won't need another endpoint call

### Note
an integration test is part of a [separate
PR](https://github.com/bricks-software/unleash-enterprise/pull/1995)
where all e2e are expected to be together.

Co-authored-by: irstavr <irini.stavrakantonaki@goeve.com>
2026-10-05 18:31:42 +02:00
irstavr 0f0df8ee29 feat(session): report the session deadline internally - EG-4709
**Part of the [idle timeouts
project](https://linear.app/unleash/project/configurable-idle-session-timeout-with-re-authentication-after-68a334e79506)**
- introducing 'keep-alive'

[Issue](https://linear.app/unleash/issue/EG-4709/5-keep-alive-endpoint-ui-hook):
We add a feature that keeps user sessions alive when they're still
active (`keep-alive`)

#### Splitting into 3 parts:
**PR#1 (This one)** -> lays all the groundwork - config + internal
plumbing - no new endpoints, no UI changes yet
[PR#2](https://github.com/bricks-software/unleash-enterprise/pull/1992)
-> `keep-alive` endpoint _and_ API
[PR#3](https://github.com/bricks-software/unleash-enterprise/pull/1993)
-> frontend hook to report user's activity

### What's here

-updated `evaluateSession`: it now returns how much time a session has
left (`expiresInMs`) , and caps `authenticatedAt` timestamps at now. We
already cap `lastInteractionAt`, we repeat this here - this handles
cases where the login pod's clock is faster

-added `keep-alive` interval set to one-third of the idle timeout, max
at 60s. Reason: the UI pings on the 1st activity after the interval
passes, so the last ping can land a full interval before the user
actually goes idle. On a 15' timeout, this cap keeps the real window to
14' instead of 10. The one-third ratio is here to tolerate one missed
ping.

-middleware puts the `expiresInMs` on `res.locals` for later handlers to
use.

-mount below `secureHeaders`. Critical: We put it below security headers
but before auth and maintenance mode checks. This means keep-alive
renewals happen early—before we gate requests on admin permissions or
maintenance status. That's what keeps the feature working when the admin
API is read-only. (Added a test)

-config publishes the interval to the UI (0 = don't ping at all).

### Note
When we first deploy with the `SESSION_IDLE_TIMEOUT_MINUTES` flag on,
every pre-existing session will log out immediately. As old sessions
have no `authenticatedAt` timestamp, so we can't assess how long they
last.

---------

Co-authored-by: irstavr <irini.stavrakantonaki@goeve.com>
2026-10-05 18:31:42 +02:00
Mateusz Prusaczyk 3a3bdd70e7 chore(strategies): simplerStrategySetup flag clean up - part 2 - remove the flag
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 15:42:19 +00:00
Gergo Kekesi ce42121869 feat: add viewport height to flight recorder events
Adds `viewportHeight` to flight recorder events next to `viewportWidth`
2026-10-05 16:31:30 +01:00
Mateusz Prusaczyk c0e12163bb chore(strategies): simplerStrategySetup flag clean up - part 1 - move tests
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 14:52:35 +00:00
Mateusz Prusaczyk f9fb498eb7 feat(tags): move tag type form buttons above the values table
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-05 14:26:15 +00:00
Krzysztof (Kris) Kula a86a3dc75c style(frontend): enforce useExhaustiveDependencies in IntegrationForm
https://biomejs.dev/linter/rules/use-exhaustive-dependencies/#description
2026-10-05 14:42:55 +02:00
Mateusz Prusaczyk 7f99a58d47 feat(tags): tag types usage 2026-10-05 10:50:23 +02:00
zagorski 3d04501a27 feat(mcp): Enable remote mcp feedback by default
Treat an unsaved remote MCP feedback opt-in as granted instead of
denied. Instances that have never saved the setting now share feedback
by default, and an explicit opt-out is still honoured. Consent still
requires the remoteMcpFeedback flag to be available.

The admin page mirrors this: the feedback toggle shows as enabled when
the server has no saved value.
2026-10-05 10:16:48 +02:00
Gergo Kekesi 3e4447c3cf fix: show the safeguard trigger window on closed change requests
A closed change request showed a safeguard's stored metric range
(`week`) where the form shows its trigger window (`Last 3 hours`).

- The range-to-window labels now live in one map, used by both the form
and the read-only view
- Closed change requests read "over Last 3 hours"

<img width="1568" height="567" alt="closed-cr-safeguard-last-3-hours"
src="https://github.com/user-attachments/assets/9e0f9ca7-3c70-49c7-928a-2c99749150a3"
/>
2026-10-05 08:44:22 +01:00
Øystein Lorentzen Vesth dc8eb511dd fix(integrations): Return sensitive fields as masked on update/create
When an addon is created or updated, it will now return with sensitive
values filtered.

Before this anyone with `UPDATE_ADDON` or `PROJECT_UPDATE_ADDON`
permission could update a integration and read _all_ sensitive fields as
plaintext in the json returned from the API.

This seems like an obvious vuln that could be used to grab credentials
one should not have access to. The question is if there is anything
relying on the current behavior?
2026-10-05 09:31:58 +02:00
renovate[bot] 615d01753d chore(deps): update dependency orval to v8.38.0 (#12708)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [orval](https://orval.dev)
([source](https://redirect.github.com/orval-labs/orval)) | [`8.31.0` →
`8.38.0`](https://renovatebot.com/diffs/npm/orval/8.31.0/8.38.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/orval/8.38.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/orval/8.31.0/8.38.0?slim=true)
|

---

### Release Notes

<details>
<summary>orval-labs/orval (orval)</summary>

###
[`v8.38.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.38.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.37.0...v8.38.0)

#### What's Changed

- refactor: delete exports nothing imports by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4198](https://redirect.github.com/orval-labs/orval/pull/4198)
- fix(orval): keep binary schemas Blob through
[@&#8203;scalar/openapi-upgrader](https://redirect.github.com/scalar/openapi-upgrader)
>= 0.2.17 by [@&#8203;melloware](https://redirect.github.com/melloware)
in
[#&#8203;4200](https://redirect.github.com/orval-labs/orval/pull/4200)
- refactor: replace remeda with native APIs and a few local helpers by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4201](https://redirect.github.com/orval-labs/orval/pull/4201)
- fix(core,mock): preserve nullable $ref enum branches by
[@&#8203;Spence1115](https://redirect.github.com/Spence1115) in
[#&#8203;4202](https://redirect.github.com/orval-labs/orval/pull/4202)
- chore: stricter openapi types by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4187](https://redirect.github.com/orval-labs/orval/pull/4187)
- chore: enabled oxfmt sort imports by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4205](https://redirect.github.com/orval-labs/orval/pull/4205)
- chore: lint generated code instead of snapshots by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4206](https://redirect.github.com/orval-labs/orval/pull/4206)
- chore: enabled lint type-aware and type-check everywhere by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4208](https://redirect.github.com/orval-labs/orval/pull/4208)
- fix: nullable enum references in enum mode and untyped const mocks by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4209](https://redirect.github.com/orval-labs/orval/pull/4209)
- feat(docs): support JSON schemas in the playground by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4210](https://redirect.github.com/orval-labs/orval/pull/4210)
- feat(mock): add faker importPath and schemasPath for artifact groups
by [@&#8203;the-ult](https://redirect.github.com/the-ult) in
[#&#8203;4189](https://redirect.github.com/orval-labs/orval/pull/4189)
- chore(devcontainer): install bun 1.4.2 to match packageManager by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4212](https://redirect.github.com/orval-labs/orval/pull/4212)
- chore: enabled lint rules missed in the switch to oxlint by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4211](https://redirect.github.com/orval-labs/orval/pull/4211)
- refactor(orval): replace find-up with a local walk-up helper by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4213](https://redirect.github.com/orval-labs/orval/pull/4213)
- Release v8.38.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4214](https://redirect.github.com/orval-labs/orval/pull/4214)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.37.0...v8.38.0>

###
[`v8.37.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.37.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.36.0...v8.37.0)

#### What's Changed

- fix(core): only url-encode path parameters under urlEncodeParameters
by [@&#8203;mridang](https://redirect.github.com/mridang) in
[#&#8203;4179](https://redirect.github.com/orval-labs/orval/pull/4179)
- fix(query): widen onMutateResult for the TanStack releases that made
it optional
([#&#8203;4180](https://redirect.github.com/orval-labs/orval/issues/4180))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4181](https://redirect.github.com/orval-labs/orval/pull/4181)
- docs(zod): document .meta() output for annotated oneOf/const branches
by [@&#8203;the-ult](https://redirect.github.com/the-ult) in
[#&#8203;4182](https://redirect.github.com/orval-labs/orval/pull/4182)
- fix(core): type multipart file parts in shared request body schemas by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4183](https://redirect.github.com/orval-labs/orval/pull/4183)
- feat(mock): add override.mock.exactOptional for
exactOptionalPropertyTypes by
[@&#8203;the-ult](https://redirect.github.com/the-ult) in
[#&#8203;4184](https://redirect.github.com/orval-labs/orval/pull/4184)
- refactor(core): simplify snake/kebab case machinery and drop unused
upper by [@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4186](https://redirect.github.com/orval-labs/orval/pull/4186)
- feat(angular): parse JSON request bodies under
runtimeValidation.requestBodies by
[@&#8203;the-ult](https://redirect.github.com/the-ult) in
[#&#8203;4185](https://redirect.github.com/orval-labs/orval/pull/4185)
- chore: bump vite+ 0.3.1 -> 0.3.3 by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4190](https://redirect.github.com/orval-labs/orval/pull/4190)
- fix(core): serialize factory enum members from their value
(GHSA-w4x4-mpp4-4854) by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4191](https://redirect.github.com/orval-labs/orval/pull/4191)
- refactor: replace fs-extra with node:fs by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4192](https://redirect.github.com/orval-labs/orval/pull/4192)
- build(deps): bump voidzero-dev/setup-vp from 1.20.0 to 1.21.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;4193](https://redirect.github.com/orval-labs/orval/pull/4193)
- fix(swr): apply urlEncodeParameters to the axios request function by
[@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) in
[#&#8203;4195](https://redirect.github.com/orval-labs/orval/pull/4195)
- Release v8.37.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4196](https://redirect.github.com/orval-labs/orval/pull/4196)

#### New Contributors

- [@&#8203;mridang](https://redirect.github.com/mridang) made their
first contribution in
[#&#8203;4179](https://redirect.github.com/orval-labs/orval/pull/4179)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.36.0...v8.37.0>

###
[`v8.36.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.36.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.35.0...v8.36.0)

#### What's Changed

- fix(query): keep suspense queryFn out of the caller options spread
([#&#8203;4163](https://redirect.github.com/orval-labs/orval/issues/4163))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4164](https://redirect.github.com/orval-labs/orval/pull/4164)
- fix(query): pass the invalidation onSuccess to a mutationOptions
mutator
([#&#8203;4165](https://redirect.github.com/orval-labs/orval/issues/4165))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4167](https://redirect.github.com/orval-labs/orval/pull/4167)
- feat(core,orval): warn when mutationInvalidates names an unknown
operation
([#&#8203;4166](https://redirect.github.com/orval-labs/orval/issues/4166))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4168](https://redirect.github.com/orval-labs/orval/pull/4168)
- test: raise vitest timeouts to stop intermittent Windows CI failures
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4174](https://redirect.github.com/orval-labs/orval/pull/4174)
- build(deps): bump
[@&#8203;pinia/colada](https://redirect.github.com/pinia/colada) from
1.4.4 to 1.4.5 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;4173](https://redirect.github.com/orval-labs/orval/pull/4173)
- build(deps): bump get-tsconfig from 4.14.0 to 4.14.3 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;4172](https://redirect.github.com/orval-labs/orval/pull/4172)
- build(deps-dev): bump
[@&#8203;angular-eslint/template-parser](https://redirect.github.com/angular-eslint/template-parser)
from 22.0.0 to 22.5.0 by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;4169](https://redirect.github.com/orval-labs/orval/pull/4169)
- chore(deps): upgrade
[@&#8203;scalar/openapi-parser](https://redirect.github.com/scalar/openapi-parser)
to 0.29.2 by [@&#8203;melloware](https://redirect.github.com/melloware)
in
[#&#8203;4175](https://redirect.github.com/orval-labs/orval/pull/4175)
- Release v8.36.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4176](https://redirect.github.com/orval-labs/orval/pull/4176)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.35.0...v8.36.0>

###
[`v8.35.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.35.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.34.0...v8.35.0)

#### What's Changed

- refactor(core): remove unused count helper by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4150](https://redirect.github.com/orval-labs/orval/pull/4150)
- test(core): rewrite post-boundary fixtures to OAS 3.1
([#&#8203;4116](https://redirect.github.com/orval-labs/orval/issues/4116))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4149](https://redirect.github.com/orval-labs/orval/pull/4149)
- test(zod): rewrite post-boundary fixtures to OAS 3.1
([#&#8203;4117](https://redirect.github.com/orval-labs/orval/issues/4117))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4152](https://redirect.github.com/orval-labs/orval/pull/4152)
- test(mock,effect,orval,query): rewrite post-boundary fixtures to OAS
3.1
([#&#8203;4118](https://redirect.github.com/orval-labs/orval/issues/4118))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4153](https://redirect.github.com/orval-labs/orval/pull/4153)
- fix(core,mock,zod,effect): close the OAS 3.1 nullable/binary gaps
([#&#8203;4141](https://redirect.github.com/orval-labs/orval/issues/4141))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4154](https://redirect.github.com/orval-labs/orval/pull/4154)
- refactor: remove downstream OAS 3.0 handling from generators by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4155](https://redirect.github.com/orval-labs/orval/pull/4155)
- fix(mcp): import mutators in `http-client.ts` instead of `handlers.ts`
by [@&#8203;soartec-lab](https://redirect.github.com/soartec-lab) in
[#&#8203;4158](https://redirect.github.com/orval-labs/orval/pull/4158)
- feat(core): convert dates inside undiscriminated object unions by
[@&#8203;sami286](https://redirect.github.com/sami286) in
[#&#8203;4156](https://redirect.github.com/orval-labs/orval/pull/4156)
- fix(orval): restore the type on schemas left with only content
keywords
([#&#8203;4157](https://redirect.github.com/orval-labs/orval/issues/4157))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4159](https://redirect.github.com/orval-labs/orval/pull/4159)
- fix(core): stop reading a member name as a reference to an import
([#&#8203;4143](https://redirect.github.com/orval-labs/orval/issues/4143))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4160](https://redirect.github.com/orval-labs/orval/pull/4160)
- fix(query): import Angular's QueryClient as a type unless DI injects
it by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4161](https://redirect.github.com/orval-labs/orval/pull/4161)
- Release v8.35.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4162](https://redirect.github.com/orval-labs/orval/pull/4162)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.34.0...v8.35.0>

###
[`v8.34.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.34.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.33.0...v8.34.0)

#### What's Changed

- chore: upgrade vite+ and bun by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4098](https://redirect.github.com/orval-labs/orval/pull/4098)
- chore: remove noise from tests by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4099](https://redirect.github.com/orval-labs/orval/pull/4099)
- fix(core): resolve YAML merge keys when parsing the spec
([#&#8203;4102](https://redirect.github.com/orval-labs/orval/issues/4102))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4103](https://redirect.github.com/orval-labs/orval/pull/4103)
- fix(fetch): validate inline array responses with zod
([#&#8203;4106](https://redirect.github.com/orval-labs/orval/issues/4106))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4108](https://redirect.github.com/orval-labs/orval/pull/4108)
- perf(core): parse JSON specs natively and skip bundling local-only
specs by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4109](https://redirect.github.com/orval-labs/orval/pull/4109)
- fix(core): import the named schema file in single zod schema mode by
[@&#8203;ErfanBagheri404](https://redirect.github.com/ErfanBagheri404)
in
[#&#8203;4101](https://redirect.github.com/orval-labs/orval/pull/4101)
- fix(query): validate inline array responses with zod in angular-query
by [@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) in
[#&#8203;4112](https://redirect.github.com/orval-labs/orval/pull/4112)
- refactor(core): drop unused debug dependency and createDebugger by
[@&#8203;wadakatu](https://redirect.github.com/wadakatu) in
[#&#8203;4110](https://redirect.github.com/orval-labs/orval/pull/4110)
- fix: deep nested allOf in FormData doesnt generate JSON.stringify by
[@&#8203;NiklasVonMinckwitz](https://redirect.github.com/NiklasVonMinckwitz)
in
[#&#8203;4105](https://redirect.github.com/orval-labs/orval/pull/4105)
- fix(mock): emit Blob for binary faker mocks
([#&#8203;4062](https://redirect.github.com/orval-labs/orval/issues/4062))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4104](https://redirect.github.com/orval-labs/orval/pull/4104)
- fix(core): escape the body type when wrapping props in BodyType<T> by
[@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) in
[#&#8203;4123](https://redirect.github.com/orval-labs/orval/pull/4123)
- fix(mcp): omit outputSchema and structuredContent for non-object
responses by
[@&#8203;soartec-lab](https://redirect.github.com/soartec-lab) in
[#&#8203;4126](https://redirect.github.com/orval-labs/orval/pull/4126)
- fix(core): stringify allOf-wrapped array items in form data by
[@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) in
[#&#8203;4125](https://redirect.github.com/orval-labs/orval/pull/4125)
- chore(deps): upgrade
[@&#8203;scalar/openapi-parser](https://redirect.github.com/scalar/openapi-parser)
to 0.29.1 by [@&#8203;melloware](https://redirect.github.com/melloware)
in
[#&#8203;4121](https://redirect.github.com/orval-labs/orval/pull/4121)
- fix(core,query): serialize format: date request bodies as calendar
days by [@&#8203;sami286](https://redirect.github.com/sami286) in
[#&#8203;4130](https://redirect.github.com/orval-labs/orval/pull/4130)
- feat(core): traverse additionalProperties maps in useDatesTransform by
[@&#8203;sami286](https://redirect.github.com/sami286) in
[#&#8203;4131](https://redirect.github.com/orval-labs/orval/pull/4131)
- fix(query): import the element schema passed to a fetch mutator for
inline array responses by
[@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) in
[#&#8203;4134](https://redirect.github.com/orval-labs/orval/pull/4134)
- fix: use queryOptions helper for suspense query functions
([#&#8203;1788](https://redirect.github.com/orval-labs/orval/issues/1788))
by
[@&#8203;ErfanBagheri404](https://redirect.github.com/ErfanBagheri404)
in
[#&#8203;4129](https://redirect.github.com/orval-labs/orval/pull/4129)
- perf(orval): lazy-load generators and defer generation dependencies by
[@&#8203;TETvega](https://redirect.github.com/TETvega) in
[#&#8203;4135](https://redirect.github.com/orval-labs/orval/pull/4135)
- fix(core): guard required containers in the response date deserializer
by [@&#8203;sami286](https://redirect.github.com/sami286) in
[#&#8203;4139](https://redirect.github.com/orval-labs/orval/pull/4139)
- feat(fetch): preserve error response types for custom mutators by
[@&#8203;eai04191](https://redirect.github.com/eai04191) in
[#&#8203;4122](https://redirect.github.com/orval-labs/orval/pull/4122)
- fix(query,swr): import the zod schema the fetch request function
validates with by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4142](https://redirect.github.com/orval-labs/orval/pull/4142)
- fix(query): add exactMatch parameter to setQueriesData for better
cache control by
[@&#8203;ephibian-adietrich](https://redirect.github.com/ephibian-adietrich)
in
[#&#8203;4132](https://redirect.github.com/orval-labs/orval/pull/4132)
- feat(fetch): wire useDatesTransform into the fetch-based clients by
[@&#8203;sami286](https://redirect.github.com/sami286) in
[#&#8203;4144](https://redirect.github.com/orval-labs/orval/pull/4144)
- feat(mcp): wrap non-object responses in structuredContent by
[@&#8203;soartec-lab](https://redirect.github.com/soartec-lab) in
[#&#8203;4127](https://redirect.github.com/orval-labs/orval/pull/4127)
- fix(orval,core): normalize residual OAS 3.0 syntax after upgrade()
([#&#8203;4115](https://redirect.github.com/orval-labs/orval/issues/4115))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4140](https://redirect.github.com/orval-labs/orval/pull/4140)
- fix(mock): guard the faker format lookup against inherited keys by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4147](https://redirect.github.com/orval-labs/orval/pull/4147)
- feat(core,orval)!: make typedoc dependencies optional by
[@&#8203;ReidoBoss](https://redirect.github.com/ReidoBoss) in
[#&#8203;4146](https://redirect.github.com/orval-labs/orval/pull/4146)
- Release v8.34.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4148](https://redirect.github.com/orval-labs/orval/pull/4148)

#### New Contributors

- [@&#8203;Dev-next-gen](https://redirect.github.com/Dev-next-gen) made
their first contribution in
[#&#8203;4112](https://redirect.github.com/orval-labs/orval/pull/4112)
-
[@&#8203;NiklasVonMinckwitz](https://redirect.github.com/NiklasVonMinckwitz)
made their first contribution in
[#&#8203;4105](https://redirect.github.com/orval-labs/orval/pull/4105)
- [@&#8203;eai04191](https://redirect.github.com/eai04191) made their
first contribution in
[#&#8203;4122](https://redirect.github.com/orval-labs/orval/pull/4122)
-
[@&#8203;ephibian-adietrich](https://redirect.github.com/ephibian-adietrich)
made their first contribution in
[#&#8203;4132](https://redirect.github.com/orval-labs/orval/pull/4132)
- [@&#8203;ReidoBoss](https://redirect.github.com/ReidoBoss) made their
first contribution in
[#&#8203;4146](https://redirect.github.com/orval-labs/orval/pull/4146)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.33.0...v8.34.0>

###
[`v8.33.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.33.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.32.0...v8.33.0)

#### What's Changed

- fix(query): warn when an explicit infinite opt-in is silently
suppressed
([#&#8203;4025](https://redirect.github.com/orval-labs/orval/issues/4025))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4086](https://redirect.github.com/orval-labs/orval/pull/4086)
- fix(core): import schemas from the schemas file when output.schemas is
unset by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4087](https://redirect.github.com/orval-labs/orval/pull/4087)
- fix(orval): merge external refs into definitions for Swagger 2.0
([#&#8203;2993](https://redirect.github.com/orval-labs/orval/issues/2993))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4088](https://redirect.github.com/orval-labs/orval/pull/4088)
- fix(zod): write item schemas for composed array responses
([#&#8203;2993](https://redirect.github.com/orval-labs/orval/issues/2993))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4089](https://redirect.github.com/orval-labs/orval/pull/4089)
- fix(fetch): preserve response status precedence by
[@&#8203;dpkass](https://redirect.github.com/dpkass) in
[#&#8203;4077](https://redirect.github.com/orval-labs/orval/pull/4077)
- docs()Expand Client and Configuration Documentation by
[@&#8203;TETvega](https://redirect.github.com/TETvega) in
[#&#8203;4092](https://redirect.github.com/orval-labs/orval/pull/4092)
- fix(angular): validate inline array responses with zod
([#&#8203;3718](https://redirect.github.com/orval-labs/orval/issues/3718))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4090](https://redirect.github.com/orval-labs/orval/pull/4090)
- fix(core): refuse OpenAPI response keys that are not status codes
(GHSA-rw75-cc5p-q7c9, GHSA-4j53-7m38-656f) by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4094](https://redirect.github.com/orval-labs/orval/pull/4094)
- fix(core): stop bundling the mutator at the project's TypeScript
target
([#&#8203;4093](https://redirect.github.com/orval-labs/orval/issues/4093),
[#&#8203;1185](https://redirect.github.com/orval-labs/orval/issues/1185))
by [@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4095](https://redirect.github.com/orval-labs/orval/pull/4095)
- fix(zod): refuse a schema type that is not a known schema type
(GHSA-v263-cp2v-vrrx) by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4096](https://redirect.github.com/orval-labs/orval/pull/4096)
- Release v8.33.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4097](https://redirect.github.com/orval-labs/orval/pull/4097)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.32.0...v8.33.0>

###
[`v8.32.0`](https://redirect.github.com/orval-labs/orval/releases/tag/v8.32.0)

[Compare
Source](https://redirect.github.com/orval-labs/orval/compare/v8.31.0...v8.32.0)

#### What's Changed

- fix(docs): correct the transposed locale in the zh MCP guide link by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4070](https://redirect.github.com/orval-labs/orval/pull/4070)
- feat(pinia-colada): generate Vue queries and mutations by
[@&#8203;pj-workspace](https://redirect.github.com/pj-workspace) in
[#&#8203;4067](https://redirect.github.com/orval-labs/orval/pull/4067)
- feat: implemented logger with log levels by
[@&#8203;snebjorn](https://redirect.github.com/snebjorn) in
[#&#8203;4073](https://redirect.github.com/orval-labs/orval/pull/4073)
- build(deps): bump next from 15.5.21 to 15.5.24 in
/samples/next-app-with-fetch by
[@&#8203;dependabot](https://redirect.github.com/dependabot)\[bot] in
[#&#8203;4075](https://redirect.github.com/orval-labs/orval/pull/4075)
- feat(axios): generate status-discriminated responses by
[@&#8203;dpkass](https://redirect.github.com/dpkass) in
[#&#8203;4076](https://redirect.github.com/orval-labs/orval/pull/4076)
- test(pinia-colada): bound temporary workspace cleanup by
[@&#8203;pj-workspace](https://redirect.github.com/pj-workspace) in
[#&#8203;4078](https://redirect.github.com/orval-labs/orval/pull/4078)
- feat(schemas): allow schemas.path to name the schema file in single
mode by
[@&#8203;jabrailkhalil](https://redirect.github.com/jabrailkhalil) in
[#&#8203;4074](https://redirect.github.com/orval-labs/orval/pull/4074)
- feat(orval): support JSON5 package manifests by
[@&#8203;akkupratap323](https://redirect.github.com/akkupratap323) in
[#&#8203;4080](https://redirect.github.com/orval-labs/orval/pull/4080)
- fix(orval): pin JSON5 dependency by
[@&#8203;akkupratap323](https://redirect.github.com/akkupratap323) in
[#&#8203;4081](https://redirect.github.com/orval-labs/orval/pull/4081)
- fix(mock): reject or escape enum type-cast names in the faker
generator (GHSA-w68h-2r38-4cqq) by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4083](https://redirect.github.com/orval-labs/orval/pull/4083)
- fix(core): serialize object-typed const from its value, not its
declared type (GHSA-x4fj-j9hr-ccr6) by
[@&#8203;melloware](https://redirect.github.com/melloware) in
[#&#8203;4082](https://redirect.github.com/orval-labs/orval/pull/4082)
- Release v8.32.0 by
[@&#8203;github-actions](https://redirect.github.com/github-actions)\[bot]
in
[#&#8203;4084](https://redirect.github.com/orval-labs/orval/pull/4084)

#### New Contributors

- [@&#8203;jabrailkhalil](https://redirect.github.com/jabrailkhalil)
made their first contribution in
[#&#8203;4074](https://redirect.github.com/orval-labs/orval/pull/4074)
- [@&#8203;akkupratap323](https://redirect.github.com/akkupratap323)
made their first contribution in
[#&#8203;4080](https://redirect.github.com/orval-labs/orval/pull/4080)

**Full Changelog**:
<https://github.com/orval-labs/orval/compare/v8.31.0...v8.32.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-05 01:26:49 +00:00
renovate[bot] 9eea405208 chore(deps): update dependency logrocket to v12.4.0 (#12707)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| logrocket | [`12.3.0` →
`12.4.0`](https://renovatebot.com/diffs/npm/logrocket/12.3.0/12.4.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/logrocket/12.4.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/logrocket/12.3.0/12.4.0?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-05 01:25:51 +00:00
renovate[bot] e35c1248b5 chore(deps): update dependency fast-check to v4.10.2 (#12706)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-check](https://fast-check.dev/)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check))
| [`4.9.0` →
`4.10.2`](https://renovatebot.com/diffs/npm/fast-check/4.9.0/4.10.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fast-check/4.10.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-check/4.9.0/4.10.2?slim=true)
|

---

### Release Notes

<details>
<summary>dubzzz/fast-check (fast-check)</summary>

###
[`v4.10.2`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4102)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.1...v4.10.2)

*Fix interrupt plugin (throwing)*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.2)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.1...v4.10.2)]

#### Fixes

- ([PR#7333](https://redirect.github.com/dubzzz/fast-check/pull/7333))
Bug: Plugin `interruptAfterTimeLimit` crashes

###
[`v4.10.1`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4101)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.0...v4.10.1)

*Fix fake-timer compatibility in timeout and interrupt plugins*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.1)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.0...v4.10.1)]

#### Fixes

- ([PR#7293](https://redirect.github.com/dubzzz/fast-check/pull/7293))
Bug: Capture timers for `interruptAfterTimeLimit` plugin
- ([PR#7282](https://redirect.github.com/dubzzz/fast-check/pull/7282))
CI: Temporarily disable documentation updates until v5
- ([PR#7279](https://redirect.github.com/dubzzz/fast-check/pull/7279))
Doc: Release note for 4.10.0

###
[`v4.10.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4100)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.9.0...v4.10.0)

*New plugin API and deprecations ahead of v5*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.9.0...v4.10.0)]

#### Features

- ([PR#7216](https://redirect.github.com/dubzzz/fast-check/pull/7216))
Introduce a plugin API
- ([PR#7221](https://redirect.github.com/dubzzz/fast-check/pull/7221))
Refine plugin API
- ([PR#7222](https://redirect.github.com/dubzzz/fast-check/pull/7222))
Add ability to configure plugins globally
- ([PR#7224](https://redirect.github.com/dubzzz/fast-check/pull/7224))
Add the `beforeEach` plugin to hook in life-cycle
- ([PR#7227](https://redirect.github.com/dubzzz/fast-check/pull/7227))
Create an `afterEach` plugin
- ([PR#7232](https://redirect.github.com/dubzzz/fast-check/pull/7232))
Deprecate life-cycle methods
- ([PR#7235](https://redirect.github.com/dubzzz/fast-check/pull/7235))
Support teardown of `beforeEach` plugin
- ([PR#7228](https://redirect.github.com/dubzzz/fast-check/pull/7228))
Add `timeout` plugin to stop long running predicates
- ([PR#7237](https://redirect.github.com/dubzzz/fast-check/pull/7237))
Deprecate timeout from parameters
- ([PR#7238](https://redirect.github.com/dubzzz/fast-check/pull/7238))
Pass a store to plugins
- ([PR#7239](https://redirect.github.com/dubzzz/fast-check/pull/7239))
Add extra plugin's method called `onAllRunsComplete`
- ([PR#7240](https://redirect.github.com/dubzzz/fast-check/pull/7240))
Deprecate `reporter` and `asyncReporter` from parameters
- ([PR#7229](https://redirect.github.com/dubzzz/fast-check/pull/7229))
Add plugin to interrupt after time limit
- ([PR#7245](https://redirect.github.com/dubzzz/fast-check/pull/7245))
Support `failOnInterrupt` on the plugin
- ([PR#7230](https://redirect.github.com/dubzzz/fast-check/pull/7230))
Add plugins to drop runs on already covered cases
- ([PR#7259](https://redirect.github.com/dubzzz/fast-check/pull/7259))
Add ability to decorate `generate` via Plugins
- ([PR#7231](https://redirect.github.com/dubzzz/fast-check/pull/7231))
Add the `unbiased` plugin to generate without bias
- ([PR#7260](https://redirect.github.com/dubzzz/fast-check/pull/7260))
Deprecate parameters superseded by plugins
- ([PR#7261](https://redirect.github.com/dubzzz/fast-check/pull/7261))
Deprecate v5 removals

#### Fixes

- ([PR#7225](https://redirect.github.com/dubzzz/fast-check/pull/7225))
Bug: Proper ordering between plugins
- ([PR#7127](https://redirect.github.com/dubzzz/fast-check/pull/7127))
CI: Announce on Bluesky when drafting the release
- ([PR#7217](https://redirect.github.com/dubzzz/fast-check/pull/7217))
CI: Dedupe packages for pnpm
- ([PR#7137](https://redirect.github.com/dubzzz/fast-check/pull/7137))
Doc: Release note for 4.9.0
- ([PR#7226](https://redirect.github.com/dubzzz/fast-check/pull/7226))
Doc: Fix admonition titles on the website
- ([PR#7246](https://redirect.github.com/dubzzz/fast-check/pull/7246))
Doc: Add jkomyno as code contributor
- ([PR#7251](https://redirect.github.com/dubzzz/fast-check/pull/7251))
Performance: Single timer for `interruptAfterTimeLimit`

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-04 22:09:41 +00:00
renovate[bot] a6bc3bc58a chore(deps): update dependency nodemailer to v10.0.11 (#12705)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [nodemailer](https://nodemailer.com/)
([source](https://redirect.github.com/nodemailer/nodemailer)) |
[`10.0.10` →
`10.0.11`](https://renovatebot.com/diffs/npm/nodemailer/10.0.10/10.0.11)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/nodemailer/10.0.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nodemailer/10.0.10/10.0.11?slim=true)
|

---

### Release Notes

<details>
<summary>nodemailer/nodemailer (nodemailer)</summary>

###
[`v10.0.11`](https://redirect.github.com/nodemailer/nodemailer/blob/HEAD/CHANGELOG.md#10011-2026-09-27)

[Compare
Source](https://redirect.github.com/nodemailer/nodemailer/compare/v10.0.10...v10.0.11)

##### Bug Fixes

- **fetch:** report a form body that can not be encoded through the
returned stream
([74d40bf](https://redirect.github.com/nodemailer/nodemailer/commit/74d40bf1e4553bc0568b471250a9251bcb569b00))
- keep the CommonJS entry point and the services subpath compatible with
the pre-TypeScript build
([52901ef](https://redirect.github.com/nodemailer/nodemailer/commit/52901ef3725ad179aa56276495a60f53b2c83516))
- **qp:** keep wrap() terminating for short line lengths and a trailing
incomplete escape
([8fa140b](https://redirect.github.com/nodemailer/nodemailer/commit/8fa140b11c62cb1202eac84d35bb3ba28bc3b1a1))
- **smtp-connection:** fail a password login cleanly when the server
offers only XOAUTH2
([90abf7d](https://redirect.github.com/nodemailer/nodemailer/commit/90abf7d11db5ebfeb4292b62c1fff969741c7d33))
- **types:** restore the layout of
[@&#8203;types/nodemailer](https://redirect.github.com/types/nodemailer)
in the bundled declarations
([ac2e40f](https://redirect.github.com/nodemailer/nodemailer/commit/ac2e40ffc69427e0eb33ce3945fae76c4c828c8d))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-04 22:09:17 +00:00
renovate[bot] 1182cd0d5c chore(deps): update dependency browserslist to v4.29.1 (#12704)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [browserslist](https://redirect.github.com/browserslist/browserslist)
| [`4.28.9` →
`4.29.1`](https://renovatebot.com/diffs/npm/browserslist/4.28.9/4.29.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/browserslist/4.29.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/browserslist/4.28.9/4.29.1?slim=true)
|

---

### Release Notes

<details>
<summary>browserslist/browserslist (browserslist)</summary>

###
[`v4.29.1`](https://redirect.github.com/browserslist/browserslist/blob/HEAD/CHANGELOG.md#4291)

[Compare
Source](https://redirect.github.com/browserslist/browserslist/compare/4.29.0...4.29.1)

- Fixed config name loading protection on Windows (by
[@&#8203;oss-security-shop](https://redirect.github.com/oss-security-shop)).
- Fixed case-insensitive negation queries (by
[@&#8203;jakezwang](https://redirect.github.com/jakezwang)).
- Fixed percentage and supports queries case-insensitive (by
[@&#8203;wahidrizka](https://redirect.github.com/wahidrizka)).
- Fixed old Node.js tests (by
[@&#8203;aaron-belenky](https://redirect.github.com/aaron-belenky)).
- Reduced code (by
[@&#8203;charmander](https://redirect.github.com/charmander)).

###
[`v4.29.0`](https://redirect.github.com/browserslist/browserslist/blob/HEAD/CHANGELOG.md#4290)

[Compare
Source](https://redirect.github.com/browserslist/browserslist/compare/4.28.9...4.29.0)

- Added query continuations across lines and array entries (by
[@&#8203;fzlzjerry](https://redirect.github.com/fzlzjerry)).

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-02 20:43:29 +00:00
renovate[bot] e6344c93b1 chore(deps): update dependency @fast-check/vitest to ^0.5.0 (#12703)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@fast-check/vitest](https://redirect.github.com/dubzzz/fast-check/tree/main/packages/vitest#readme)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/vitest))
| [`^0.4.1` →
`^0.5.0`](https://renovatebot.com/diffs/npm/@fast-check%2fvitest/0.4.1/0.5.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@fast-check%2fvitest/0.5.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@fast-check%2fvitest/0.4.1/0.5.0?slim=true)
|

---

### Release Notes

<details>
<summary>dubzzz/fast-check (@&#8203;fast-check/vitest)</summary>

###
[`v0.5.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/vitest/CHANGELOG.md#050)

*Support for plugins and for Vitest v5*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/vitest%2Fv0.5.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/vitest%2Fv0.4.1...vitest%2Fv0.5.0)]

#### Features

- ([PR#7219](https://redirect.github.com/dubzzz/fast-check/pull/7219))
Support plugin API of fast-check
- ([PR#7244](https://redirect.github.com/dubzzz/fast-check/pull/7244))
Support Vitest 5

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-02 20:42:27 +00:00
renovate[bot] 216502970f fix(deps): update dependency @fern-api/search-widget to v0.5.6 (#12701)
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@fern-api/search-widget](https://redirect.github.com/fern-api/fern-platform/tree/app/packages/search-widget)
([source](https://redirect.github.com/fern-api/fern-platform/tree/HEAD/packages/search-widget))
| [`0.5.4` →
`0.5.6`](https://renovatebot.com/diffs/npm/@fern-api%2fsearch-widget/0.5.4/0.5.6)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@fern-api%2fsearch-widget/0.5.6?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@fern-api%2fsearch-widget/0.5.4/0.5.6?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-10-02 17:11:41 +00:00