build(deps-dev): bump the dev-dependencies group with 3 updates

[dependabot]

Bumps the dev-dependencies group with 3 updates: @biomejs/biome, @types/node and knip.

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #114999743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #1143788f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
  <div />
  <div />
  )}

• #1143788f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #115166f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  constresult=computed(()=>list.find((item)=>item.label==="a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #114076ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #113225c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <divset:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #114999743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #1143788f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
  <div />
  <div />
  )}

• #1143788f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #115166f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  constresult=computed(()=>list.find((item)=>item.label==="a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #114076ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #113225c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <divset:html={content} />

• #1146218883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• See full diff in compare view

Updates @types/node from 26.3.0 to 26.4.0

Commits

• See full diff in compare view

Updates knip from 6.32.3 to 6.33.0

Release notes

Sourced from knip's releases.

Release 6.33.0

• Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @​WooWan!
• Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @​DreierF!
• Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @​renovate[bot]!
• Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @​theRizwan!
• Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @​DreamLongYT!
• Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @​remcohaszing!
• fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @​DreamLongYT!
• Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)
• Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)
• Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)
• Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)
• Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)
• Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)
• Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)
• Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)
• Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)
• fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @​DreamLongYT!
• fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @​addielaruee!
• Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @​DreierF!
• fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @​DreamLongYT!
• Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)
• Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)
• Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)
• Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)
• Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)
• Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)
• Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)
• Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Commits

• fb25ece Release knip@6.33.0
• 74954c2 Report unused exports behind Vitest module promise mocks (resolve #1966)
• db13615 Resolve nuxt layer sources from all extends entry shapes
• 9fe2b2b Normalize line endings in nuxt-config-string fixture
• 2ac1fbc Resolve named string-key access on namespace-qualified enums
• 347967d Resolve Object.* enum enumeration through import aliases
• bcbac3a Keep element access precise for number-like enum member names
• 505decd Wrap up webpack entry resolution
• 4a5d706 fix(nuxt): resolve string extends configs (#1984)
• c1165b7 Resolve oxlint/vite-plus import resolvers from settings (#1983)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions