build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #2982 · CoderLine/alphaTab

dependabot · 2026-10-29T09:53:47Z

Bumps the development-dependencies group with 6 updates in the / directory:

Package	From	To
@biomejs/biome	`2.5.14`	`2.6.3`
@types/node	`26.6.2`	`26.6.5`
vite	`8.3.0`	`8.3.5`
@microsoft/api-extractor	`7.59.1`	`7.59.4`
@rollup/plugin-terser	`1.0.0`	`1.0.2`
webpack	`5.111.1`	`5.112.2`

Updates @biomejs/biome from 2.5.14 to 2.6.3

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes
#12275 807e616 Thanks @dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.
const minimum = array.toSorted((a, b) => a - b)[0];
#12432 cf61682 Thanks @dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.
#12304 b4654c5 Thanks @dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.
for (const name of users.map((user) => user.name)) {
  console.log(name);
}
#12121 66c3791 Thanks @dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").
#12316 34b520d Thanks @dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.
<table bgcolor="#ffffff" cellpadding="5"></table>
#12258 cce2385 Thanks @dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.
const fullPath = __dirname + "/foo.js"; // reported
#12287 e12ad78 Thanks @dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.
await page.locator("button").first().click();
#12343 62ad123 Thanks @vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.
@layer components {
  @layer components {
    .button {
      color: red;
    }

... (truncated)

Commits

c5c3383 ci: release (#12500)
7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
807e616 feat(lint): add noArraySortForMinMax (#12275)
407604d feat(lint): add useVueComponentIs (#12400)
f748ec0 feat(lint): add noSvelteInternal (#12431)
ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
bf1a55a feat(lint): add useVueVOnExact (#12423)
c371520 feat(lint): add useVueToggleInsideTransition (#12337)
8a5974a chore: add syntaxfm to sponsors (#12577)
0be8d10 feat(lint): add noUnsafeReturn (#12422)
Additional commits viewable in compare view

Updates @types/node from 26.6.2 to 26.6.5

Commits

See full diff in compare view

Updates vite from 8.3.0 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

build: handle missing chunk import maps (#23777) (8d7623d)

build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)

bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)

bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)

bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)

bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)

bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

bundled-dev: normalize served output files (#23684) (df4e02c)

bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)

css: don't fail on a literal % in url() (#23676) (50b382d)

deps: update all non-major dependencies (#23731) (cf80aa5)

deps: update all non-major dependencies (#23826) (77d8373)

deps: update rolldown-related dependencies (#23733) (43f0d05)

deps: update rolldown-related dependencies (#23827) (c2e0418)

optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)

optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)

optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)

optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)

resolve: support subpath imports with multiple # (#23631) (0d86b34)

resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)

server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)

server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

migrate to Oxlint (#23746) (5b73935)

Code Refactoring

deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)

dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)

dev: separate import resolution from URL conversion (#23791) (6116689)

dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)

dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

build: handle missing chunk import maps (#23777) (8d7623d)

build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)

bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)

bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)

bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)

bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)

bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)

bundled-dev: normalize served output files (#23684) (df4e02c)

bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)

css: don't fail on a literal % in url() (#23676) (50b382d)

deps: update all non-major dependencies (#23731) (cf80aa5)

deps: update all non-major dependencies (#23826) (77d8373)

deps: update rolldown-related dependencies (#23733) (43f0d05)

deps: update rolldown-related dependencies (#23827) (c2e0418)

optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)

optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)

optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)

optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)

resolve: support subpath imports with multiple # (#23631) (0d86b34)

resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)

server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)

server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

migrate to Oxlint (#23746) (5b73935)

Code Refactoring

deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)

dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)

dev: separate import resolution from URL conversion (#23791) (6116689)

dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)

dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

981f07f release: v8.3.5 (#23856)
0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
6116689 refactor(dev): separate import resolution from URL conversion (#23791)
446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
Additional commits viewable in compare view

Updates @microsoft/api-extractor from 7.59.1 to 7.59.4

Changelog

Sourced from @microsoft/api-extractor's changelog.

7.59.4

Tue, 06 Oct 2026 00:04:37 GMT

Version update only

7.59.3

Mon, 28 Sep 2026 20:08:26 GMT

Version update only

7.59.2

Tue, 22 Sep 2026 17:35:41 GMT

Patches

Update the @microsoft/tsdoc dependency to ~0.17.0 and the @microsoft/tsdoc-config dependency to ~0.18.2.

Commits

See full diff in compare view

Updates @rollup/plugin-terser from 1.0.0 to 1.0.2

Changelog

Sourced from @rollup/plugin-terser's changelog.

v1.0.2

2026-10-21

Updates

terser: update terser to ^5.49.2 (#2019)

v1.0.1

2026-10-21

Bugfixes

terser: share nameCache between chunks by serializing minify tasks (#2020)

Commits

See full diff in compare view

Updates webpack from 5.111.1 to 5.112.2

Release notes

Sourced from webpack's releases.

v5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

v5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

Keep the digits Firefox lays out a minified CSS percentage with. (by @alexander-akait in #22718)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.112.2

Patch Changes

Reduce repeated scans when concatenating imported modules. (by @xiaoxiaojx in #22865)

Avoid allocating CSS module sets for single-group chunks. (by @xiaoxiaojx in #22866)

Return the value of every module type loaded with importModule(). (by @alexander-akait in #22869)

5.112.1

Patch Changes

Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by @aryanraj45 in #22699)

Rebuild under cacheUnaffected a module whose re-export target goes or returns. (by @aryanraj45 in #22749)

Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by @alexander-akait in #22791)

Fix exportType: "style" CSS modules throwing outside the runtime chunk. (by @lazerg in #22833)

Fix crash when a CSS module with exportType: "style" imports an ignored stylesheet. (by @codeXsidd in #22846)

Keep empty process environment variables that .env files don't define in DotenvPlugin. (by @alexander-akait in #22794)

Rehash an ESM entry chunk when a chunk it imports by file name changes. (by @alexander-akait in #22804)

Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by @dependabot in #22811)

Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by @alexander-akait in #22733)

Await asynchronous modules that ProvidePlugin injects into ES modules. (by @alexander-akait in #22728)

Keep a resolve that ends after the compiler closed from throwing. (by @alexander-akait in #22795)

Preserve string names passed to SharedWorker constructors. (by @bjohansebas in #22770)

Preserve string contents when extracting source map comments. (by @bjohansebas in #22768)

Scope strict-mode, async and generator block function declarations to their block. (by @alexander-akait in #22800)

Preserve raw dotenv values when reusing cached environment files. (by @Eshiv-Pandey in #22787)

Preserve assigned or patched built-ins, conversions and pattern targets. (by @aryanraj45 in #22761)

Keep globals a globalThis write replaces, and slice on a patched array. (by @alexander-akait in #22862)

Skip HTML script tags for shared chunks that emit no JavaScript. (by @bjohansebas in #22779)

... (truncated)

Commits

e95a7f2 chore(release): new release (#22867)
6e43fc2 fix: return the value of every module type from importModule() (#22869)
4ffac8d ci: rename the parser job to spec and run CSS, HTML and XML in one leg (#22870)
0c02242 test: split the syntax unit tests into tokenizer, parser and printer (#22825)
660608c perf(css): cut CPU and allocation in the CSS minifier (#22868)
8c3cbd3 perf: avoid allocating unused CSS module sets (#22866)
a1e5f6a perf: avoid duplicate scans in module concatenation (#22865)
759b539 chore(release): new release (#22720)
539f8de fix(minify): keep globals a globalThis write replaces, and slice on a pat...
9668155 ci: run the deep-imports check in the lint job (#22859)
Additional commits viewable in compare view

…ectory with 6 updates Bumps the development-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.6.3` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.5` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.5` | | [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) | `7.59.1` | `7.59.4` | | [@rollup/plugin-terser](https://github.com/rollup/plugins/tree/HEAD/packages/terser) | `1.0.0` | `1.0.2` | | [webpack](https://github.com/webpack/webpack) | `5.111.1` | `5.112.2` | Updates `@biomejs/biome` from 2.5.14 to 2.6.3 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.3/packages/@biomejs/biome) Updates `@types/node` from 26.6.2 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `vite` from 8.3.0 to 8.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite) Updates `@microsoft/api-extractor` from 7.59.1 to 7.59.4 - [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md) - [Commits](https://github.com/microsoft/rushstack/commits/HEAD/apps/api-extractor) Updates `@rollup/plugin-terser` from 1.0.0 to 1.0.2 - [Changelog](https://github.com/rollup/plugins/blob/master/packages/terser/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/beep-v1.0.2/packages/terser) Updates `webpack` from 5.111.1 to 5.112.2 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.111.1...v5.112.2) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.6.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies - dependency-name: "@microsoft/api-extractor" dependency-version: 7.59.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@rollup/plugin-terser" dependency-version: 1.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: vite dependency-version: 8.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development-dependencies - dependency-name: webpack dependency-version: 5.112.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added area-dependencies Pull requests that update a dependency file platform-javascript Related to the JavaScript version of alphaTab labels Oct 29, 2026

github-actions Bot enabled auto-merge (squash) October 29, 2026 09:54

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-49c55a6113 branch from 97899fc to 795c6fa Compare October 29, 2026 10:00

dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-49c55a6113 branch from 795c6fa to 5882024 Compare October 29, 2026 16:33

Navigation Menu

Repository navigation

build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates - #2982

build(deps-dev): bump the development-dependencies group across 1 directory with 6 updates#2982
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/development-dependencies-49c55a6113

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.6.3

2.6.3

Patch Changes

v8.3.5

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

v8.3.4

Features

Bug Fixes

8.3.5 (2026-10-21)

Bug Fixes

Performance Improvements

Miscellaneous Chores

Code Refactoring

8.3.4 (2026-10-08)

Features

Bug Fixes

7.59.4

7.59.3

7.59.2

Patches

v1.0.2

Updates

v1.0.1

Bugfixes

v5.112.2

Patch Changes

v5.112.1

Patch Changes

5.112.2

Patch Changes

5.112.1

Patch Changes

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 29, 2026 •

edited

Loading