Skip to content

fix(deps): update npm minor/patch (apps/web) - #656

Merged
scttbnsn merged 3 commits into
dev/v1.6from
renovate/npm-minor-patch-appsweb
Aug 4, 2026
Merged

fix(deps): update npm minor/patch (apps/web)#656
scttbnsn merged 3 commits into
dev/v1.6from
renovate/npm-minor-patch-appsweb

Conversation

@renovate

@renovate renovate Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.5.52.5.6 age confidence
@radix-ui/react-slot (source) 1.3.21.3.3 age confidence
@types/react (source) 19.2.1719.2.18 age confidence
@types/react-dom (source) 19.2.319.2.4 age confidence
fumadocs-core 16.12.116.14.0 age confidence
fumadocs-mdx 15.2.015.2.1 age confidence
fumadocs-ui 16.12.116.14.0 age confidence
js-yaml 4.3.04.3.1 age confidence
lucide-react (source) 1.26.01.28.0 age confidence
next (source) 16.2.1116.2.12 age confidence
postcss (source) 8.5.238.5.25 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.6

Compare Source

Patch Changes
  • #​11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

  • #​11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

     .example {
       value: outer(
         1,
         /* comment */
         nested(
    -      first,
    -      second
    -    )
    +        first,
    +        second
    +      )
       );
     }
  • #​11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #​9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

  • #​10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #​10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

  • #​11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #​11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

  • #​10533 5809875 Thanks @​Mokto! - Fixed #​10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

  • #​11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

  • #​10858 6d18204 Thanks @​ruidosujeira! - Fixed #​10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

  • #​11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

    The following statements are now reported:

    type AsyncCallback = () => Promise<void>;
    declare const callback: AsyncCallback;
    callback();
    
    [1, 2, 3].map(async (value) => value);
  • #​10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

    function unresolvedReturnType(): MissingType {
      return "value" as const;
    }
  • #​11071 15047a2 Thanks @​dyc3! - The HTML parser now accepts mixed-case doctype declarations.

  • #​11030 cc90e65 Thanks @​marschattha! - The rdjson reporter now populates the severity field of each diagnostic (ERROR, WARNING, or INFO), so tools consuming Reviewdog Diagnostic Format output no longer need to assume a default severity.

  • #​11009 2c36626 Thanks @​ematipico! - Fixed a performance regression in type-aware JavaScript lint rules by inferring only requested types and memoizing export resolution.

  • #​11056 903b177 Thanks @​dyc3! - Added support for Svelte declaration tags using let and const. Biome can now parse, format, and lint bindings declared in these tags.

  • #​11045 89c27c6 Thanks @​ematipico! - Improved the performance of Biome formatter up to ~7% across the board.

  • #​9806 781d68d Thanks @​dyc3! - Added the nursery rule noJsRestrictedProperties, which ports ESLint's no-restricted-properties rule. Biome now flags restricted member access and object destructuring, and biome migrate eslint preserves the rule's options.

radix-ui/primitives (@​radix-ui/react-slot)

v1.3.3

  • Reverted breaking changes that caused compatibility issues with React Server Components.
nodeca/js-yaml (js-yaml)

v4.3.1

Compare Source

lucide-icons/lucide (lucide-react)

v1.28.0

Compare Source

v1.27.0: Version 1.27.0

Compare Source

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.26.0...1.27.0

vercel/next.js (next)

v16.2.12

Compare Source

postcss/postcss (postcss)

v8.5.25

Compare Source

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

v8.5.24

Compare Source

  • Preserve the BOM after the processing (by @​hdimer).

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Aug 3, 2026
@vercel

vercel Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
drydock-website Ready Ready Preview Aug 4, 2026 8:25pm
drydockdemo-website Ready Ready Preview Aug 4, 2026 8:25pm

@renovate

renovate Bot commented Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

scttbnsn added a commit that referenced this pull request Aug 4, 2026
…xact pin (#664)

Renovate's apps/web minor/patch group (#656) fails the `Next.js is
pinned past the 16.2.9 security advisory batch` guard because it asserts
`next === '16.2.11'` exactly — every legitimate bump past the floor
breaks CI. Same disease as the fast-uri allowlist fixed in #659.

Now: `>= 16.2.11` with an explicit 16.x-line assertion so a new major
still fails until deliberately vetted. Lockfile assertion was already a
floor. Unblocks #656 and every future next bump.
@vercel

vercel Bot commented Aug 4, 2026

Copy link
Copy Markdown

Deployment failed with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/codeswhat?upgradeToPro=build-rate-limit

@scttbnsn
scttbnsn merged commit 178c7d3 into dev/v1.6 Aug 4, 2026
21 of 23 checks passed
@scttbnsn
scttbnsn deleted the renovate/npm-minor-patch-appsweb branch August 4, 2026 22:02
scttbnsn added a commit that referenced this pull request Aug 4, 2026
## Summary

rc.12 release prep: renames `[Unreleased]` to `[1.6.0-rc.12] —
2026-08-04` and rolls the release identity forward across README (badge
+ highlights), site config/content, quickstart tag matrix, demo mocks,
API docs, the updates highlights page, and the identity/changelog-link
tests. Adds the routine dependency-maintenance rollup (#653, #654, #655,
#656, #664) and the Crowdin sync note (#665) to the changelog entry.

Version files stay at `1.6.0` (base version, set at rc.1 — the
release-cut workflow validates base version, full-tag changelog
heading).

## rc.12 contents

- 🔒 #659 security pins: brace-expansion 5.0.9 (app/ui/e2e), ip-address
10.3.1 (app runtime), fast-uri 4.1.2 (app/ui)
- 🐛 #604 maturity badge/gate threshold agreement + surfaced publish-date
auth failures
- 🐛 #605 agent-mismatch grace during component (re)registration (display
only, admission fail-closed)
- 🐛 #636 WS log streams accept anonymous-auth sessions
- 🐛 #637 explicit 501 for agent containers without controller lifecycle
transport

After merge: dev→main wholesale-tree sync, then dispatch
`release-cut.yml --ref main -f release_tag=v1.6.0-rc.12`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Changelog

🔧 **Changed**
- Updated release identity from `1.6.0-rc.11` to `1.6.0-rc.12` across
documentation, site content, quickstart materials, API examples, demo
mocks, and tests.
- Added `v1.6.0-rc.12` release highlights dated August 4, 2026.
- Updated changelog links and release metadata expectations.
- Kept version files at `1.6.0`.

🔒 **Security**
- Added security dependency updates for `#653`, `#654`, `#655`, `#656`,
and `#664`.
- Added the Crowdin synchronization note for `#665`.
- Documented security dependency pins from `#659`.

✨ **Added**
- Maturity badge and publish-date authentication updates from `#604`.
- Agent-mismatch grace during component registration from `#605`.
- Anonymous authentication support for WebSocket log streams from
`#636`.
- Explicit `501` responses when agent containers lack controller
lifecycle transport from `#637`.

## Concerns

- Verify all `1.6.0-rc.11` references are intentionally replaced or
retained.
- Verify the August 4, 2026 release date matches the release workflow.
- Run changelog and release-identity tests after the updates.
- Confirm the planned `dev` to `main` sync and release-cut workflow
occur after merge.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
scttbnsn added a commit that referenced this pull request Aug 5, 2026
Wholesale-tree sync ahead of the v1.6.0-rc.12 cut: the head commit's
tree is `origin/dev/v1.6`'s tree verbatim (`630c64ec`), parented on
main's current head (`67f23419`). Squash-merging makes main
tree-identical to `dev/v1.6`, satisfying the release-cut drift guard
(`git diff --quiet origin/main origin/dev/v1.6`).

Brings in since rc.11: #659 security pins, #662/#660/#661/#663 runtime
fixes (#636/#604/#605/#637), #664 guard floor, #653#656 deps, #665
Crowdin, #666 rc.12 prep.

After merge: dispatch `release-cut.yml --ref main -f
release_tag=v1.6.0-rc.12`.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Changelog

- 🔒 Updated dependency security pins and security-version tests.
- ✨ Added anonymous-authenticated WebSocket log streams with IP-based
rate limits.
- ✨ Added agent component-registration state tracking.
- 🔧 Downgraded selected update blockers during agent registration.
- 🔧 Added controller-Docker transport detection.
- 🐛 Added HTTP `501` responses for unsupported agent lifecycle actions.
- 🐛 Fixed maturity filtering to use per-container thresholds.
- 🐛 Changed Docker publish-date lookup failures to warning logs.
- 🔧 Updated dependency versions, release metadata, documentation, mocks,
and changelog links from `v1.6.0-rc.11` to `v1.6.0-rc.12`.
- ✨ Added release highlights for `v1.6.0-rc.12`.

## Concerns

- Fix the French `containerLogs.stderr` value if `"sdterr"` is not
intentional.
- Verify the release date `August 4, 2026`.
- Dispatch the release-cut workflow for `main` with
`release_tag=v1.6.0-rc.12` after merging.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant