build(deps-dev): bump @biomejs/biome from 2.4.16 to 2.5.4

[dependabot]

Bumps @biomejs/biome from 2.4.16 to 2.5.4.

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

• #1066555ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #108425e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #1088660c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {- expect(a).toBe(b);- });+ test.each([[1, 2]])(+ "a description that is long enough to push the hugged opening line beyond the print width",+ (a, b) => {+ expect(a).toBe(b);+ },+ );

• #1089501a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

• feat(yml/fmt): basic block properties by @​ematipico in biomejs/biome#10873
• feat(useSortedClasses): sort important-suffix classes in sort_v4 by @​johncarmack1984 in biomejs/biome#10880
• fix(format/js): wrap curried test each calls by @​dyc3 in biomejs/biome#10886
• fix(markdown): parse whitespace after list markers by @​tidefield in biomejs/biome#10869
• fix(inference): use correct function when cloning data by @​ematipico in biomejs/biome#10891
• docs(noDuplicateProperties): note that @​keyframes declarations are ignored by @​dfedoryshchev in biomejs/biome#10893
• fix(lint): prevent noCommentText fix from looping forever by @​JamBalaya56562 in biomejs/biome#10842
• fix(core): cleanup old sockets in Unix by @​ematipico in biomejs/biome#10895
• feat(inference): inference engine via salsa by @​ematipico in biomejs/biome#10888
• chore(deps): update dependency @​types/node to v24.13.3 by @​renovate[bot] in biomejs/biome#10920
• chore(deps): update github-actions by @​renovate[bot] in biomejs/biome#10921

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

• #1066555ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #108425e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #1088660c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {- expect(a).toBe(b);- });+ test.each([[1, 2]])(+ "a description that is long enough to push the hugged opening line beyond the print width",+ (a, b) => {+ expect(a).toBe(b);+ },+ );

• #1089501a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

2.5.3

Patch Changes

• #1081586613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #10534da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #10827098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #107733c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #10721d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

• #108656450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

... (truncated)

Commits

• bfc3f3d ci: release (#10887)
• 9e1999f chore: revert the revert
• 0b0fd8d chore: revert
• 0afa35a ci: release (#10817)
• 3447b2f feat(useDomQuerySelector): add ignore option (#10835)
• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• ffe7d33 chore: revert
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldscript-studio	Ready	Preview, Comment	Jul 28, 2026 8:27am

[deepsource-io]

DeepSource Code Review

We reviewed changes in 79aace8...f98fbb2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Docker		Jun 29, 2026 11:50p.m.	Review ↗
JavaScript		Jun 29, 2026 11:50p.m.	Review ↗
CSS		Jun 29, 2026 11:50p.m.	Review ↗
Rust		Jun 29, 2026 11:50p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​biomejs/​biome@​2.5.4

View full report

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit:f98fbb29
Scan Time: 2026-07-26 17:42:24 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

[qnbs]

Pushed a fix for the immediate CI failure: `biome.json`'s `$schema` still pointed at 2.4.16 while the bumped CLI is 2.5.4 — biome's own parser flags that mismatch as a warning, escalated to a hard failure by `--error-on-warnings`.

That fix alone isn't enough to merge, though. Biome 2.5.x enables/tightens two rules this repo doesn't yet satisfy:

• `lint/correctness/noUnsafeOptionalChaining` (4 errors) — in `tests/unit/collaborationService.test.ts`, `tests/unit/hooks/useManuscriptView.test.ts` (×2), `tests/unit/ragVectorMigration.test.ts`. Pattern: `(x?.[n] as (...) => T)()` — optional chaining protects the property access but not the subsequent call; biome now flags that as unsafe even where the mock assertion above guarantees the value is defined.
• `lint/suspicious/noUndeclaredEnvVars` (21 warnings) — across `vite.config.ts`, `app/store.ts`, `services/logger.ts`, several scripts, and more. This is a new rule requiring declared env vars (likely needs a biome.json config entry or equivalent, not a per-call fix).

Both need real fixes (or, for the env-var rule, a deliberate config decision), not a suppression — leaving this open rather than merging with new lint debt or a fresh `biome-ignore`. Full list reproducible locally with `pnpm exec biome lint --max-diagnostics=200` after this branch's schema fix.

[qnbs]

Pushed the remaining fixes — this should now be fully mergeable:

• lint/correctness/noUnsafeOptionalChaining (4 errors): fixed in tests/unit/collaborationService.test.ts, tests/unit/hooks/useManuscriptView.test.ts (×2), tests/unit/ragVectorMigration.test.ts — each was an optional-chain result immediately cast+called/accessed outside the chain; extracted to its own variable first, which is both safe and satisfies the rule.
• lint/suspicious/noUndeclaredEnvVars (16 warnings, escalated to failures): declared all 16 env vars in turbo.json's globalEnv so Turborepo's cache correctness accounts for them.
• Also ran biome migrate for the linter.rules.recommended → linter.rules.preset rename (deprecation notice from 2.5.x).

Verified locally: pnpm run lint clean, pnpm run typecheck clean, pnpm run suppressions:check (52/52, no new suppressions), and all previously-failing test files passing (81 tests). No suppressions added anywhere.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qnbs]

@CodeAnt-AI review