Bump the linting group across 1 directory with 4 updates

[dependabot]

Bumps the linting group with 4 updates in the / directory: @biomejs/biome, fallow, oxfmt and oxlint.

Updates @biomejs/biome from 2.5.1 to 2.5.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

• feat(yml/fmt): basic block properties by @​ematipico in biomejs/biome#10873
• feat(useSortedClasses): sort important-suffix classes in sort_v4 by @​johncarmack1984 in biomejs/biome#10880
• fix(format/js): wrap curried test each calls by @​dyc3 in biomejs/biome#10886
• fix(markdown): parse whitespace after list markers by @​tidefield in biomejs/biome#10869
• fix(inference): use correct function when cloning data by @​ematipico in biomejs/biome#10891
• docs(noDuplicateProperties): note that @​keyframes declarations are ignored by @​dfedoryshchev in biomejs/biome#10893
• fix(lint): prevent noCommentText fix from looping forever by @​JamBalaya56562 in biomejs/biome#10842
• fix(core): cleanup old sockets in Unix by @​ematipico in biomejs/biome#10895
• feat(inference): inference engine via salsa by @​ematipico in biomejs/biome#10888
• chore(deps): update dependency @​types/node to v24.13.3 by @​renovate[bot] in biomejs/biome#10920
• chore(deps): update github-actions by @​renovate[bot] in biomejs/biome#10921

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

2.5.3

Patch Changes

• #10815 86613d5 Thanks @​WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.

• #10534 da9b403 Thanks @​Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.

• #10827 098ba41 Thanks @​Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().

• #10773 3c6513d Thanks @​otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.

• #10721 d83c66b Thanks @​minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/0) more accurately.

• #10865 6450276 Thanks @​ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.

... (truncated)

Commits

• bfc3f3d ci: release (#10887)
• 9e1999f chore: revert the revert
• 0b0fd8d chore: revert
• 0afa35a ci: release (#10817)
• 3447b2f feat(useDomQuerySelector): add ignore option (#10835)
• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• See full diff in compare view

Updates fallow from 2.103.0 to 3.2.0

Release notes

Sourced from fallow's releases.

v3.2.0: configurable large-function threshold, surfaced in the health summary

Health: a configurable "function too big" threshold, surfaced in the summary

This release makes the unit-size (large-function) check configurable and reports the effective ceiling in the health output.

health.maxUnitSize: raise the large-function bar instead of switching it off

The line count at which a function is reported as an oversized "large function" was hardcoded to 60 LOC. That made test suites noisy: a describe() callback spans hundreds of lines, and each large it() body trips the threshold too. The only escape was health.ignore, which drops every health signal (complexity, CRAP, hotspots) for those files, so you lost complexity checking on your test code as well.

You can now raise the bar rather than turning it off:

• Set a global health.maxUnitSize (default 60).
• Or scope it to a glob with a per-file thresholdOverrides entry, for example { "files": ["**/*.test.*"], "maxUnitSize": 500 }. Leave functions empty so the override covers both the describe() wrapper and the individual it() blocks.

Complexity, cognitive, and CRAP findings on those files are unchanged. Like the existing maxCyclomatic / maxCognitive / maxCrap overrides, this filters the reported "large functions" list; the descriptive unit-size profile and the health score still reflect raw sizes (use health.ignore to remove a file from the score entirely). Resolved thresholds are inspectable via fallow config. Thanks @​digulla for the request. (Closes #1731)

The health JSON summary reports the effective unit-size threshold

The summary block on fallow health --format json already carried max_cyclomatic_threshold, max_cognitive_threshold, and max_crap_threshold, but not a unit-size sibling, so a consumer reading the summary to learn which thresholds a run uses saw only three of the four. It now also carries max_unit_size_threshold (the effective global health.maxUnitSize, default 60). The human report's "Large functions" section reflects the configured global instead of a static "60" when health.maxUnitSize is raised project-wide. This is an additive-required field matching the existing max*Threshold siblings; no change to the unit-size check itself. (Closes #1750)

Other changes

• Reuse the audit analysis context in the programmatic API path for less redundant work per run.
• Benchmark-harness coverage and CI sharding improvements (internal).

Full Changelog: fallow-rs/fallow@v3.1.0...v3.2.0

v3.1.0: dev-dependency-in-production rule, member tracing, conditional dynamic imports

Features

New rule: dev-dependency-in-production

The promote-side mirror of test-only-dependency and type-only-dependency. A package in devDependencies that a production (non-test, non-config) file imports at runtime is flagged so you can promote it to dependencies, because pnpm install --prod omits devDependencies and the import breaks in production.

Only imports from files reachable from a runtime entry point count as evidence, so repo tooling (scripts/, benchmarks, rollup-config chains) does not trigger it, and workspace-owned files are governed by their own manifest. Type-only production imports are not flagged, and a package also present in dependencies / peerDependencies / optionalDependencies is left alone. Defaults to warn; suppress a package via ignoreDependencies. Surfaces in human, JSON, SARIF, Code Climate, compact, and markdown output, in fallow explain, and as an LSP diagnostic.

Thanks @​CallumHoward for the implementation.

Trace tooling now covers class, enum, and store members

fallow dead-code --trace FILE:MEMBER previously errored export 'X' not found when pointed at a class member, so a member finding could not be debugged from the trace tool. On an export miss the trace now falls back to a member trace that names the owning class, reports its reachability and usage, lists who imports it, and points at the right --unused-class-members inspection command. The MCP trace_export tool and Code Mode return the same member trace in-process, so AI agents get parity with the CLI. Trace not-found errors across trace_export / trace_file / trace_clone now carry an actionable help pointer to the right discovery tool.

Bug fixes

Conditional and logical dynamic imports are now traced

import(cond ? './a' : './b') and import(x || './b') previously produced no module-graph edge, so every file reachable only through such an import (and its whole transitive subtree) was falsely reported as unused-files / unused-exports. Extraction now emits one edge per statically-resolvable branch, including parenthesized and no-substitution template forms, across all dynamic-import shapes: bare expressions, const x = await import(...) declarations, .then() callbacks, React.lazy / next/dynamic arrow wrappers, and Angular/Vue route loadComponent / component callbacks. Genuinely runtime arguments (import(someVar)) still yield no edge, and repeated literals across branches deduplicate to a single edge.

Thanks @​Jerc92 for the contribution.

... (truncated)

Changelog

Sourced from fallow's changelog.

[3.2.0] - 2026-07-05

Added

• The fallow health JSON summary now reports the effective unit-size threshold. summary on fallow health --format json already carried max_cyclomatic_threshold, max_cognitive_threshold, and max_crap_threshold, but not a unit-size sibling, so a consumer reading the summary to learn which thresholds a run uses saw only three of the four. It now also carries max_unit_size_threshold (the effective global health.maxUnitSize, default 60), and the human report's "Large functions" section reflects the configured global instead of a static "60" when health.maxUnitSize is raised project-wide. Additive-required field matching the existing max*Threshold siblings; no change to the unit-size check itself. (Closes #1750)

• New health.maxUnitSize threshold for the "function too big" (unit-size) check, configurable globally and per file. Previously the line-count at which a function is reported as an oversized "large function" was hardcoded to 60 LOC with no way to change it, so test suites reported many large functions: a describe() block's callback spans hundreds of lines, and each big it() body trips the threshold too. The only workaround was health.ignore, which drops every health signal (complexity, CRAP, hotspots) for those files, so you also lost complexity checking on your test code. You can now raise the bar instead of switching it off: set a global health.maxUnitSize (default 60), or scope it to a glob with a per-file thresholdOverrides entry, e.g. { "files": ["**/*.test.*"], "maxUnitSize": 500 }. Leave functions empty so the override covers both the describe() wrapper and the individual it() blocks. Complexity, cognitive, and CRAP findings on those files are unchanged. Like the existing maxCyclomatic / maxCognitive / maxCrap overrides, this filters the reported "large functions" list; the descriptive unit-size profile and the health score still reflect raw sizes (use health.ignore to remove a file from the score entirely). Functions within their effective ceiling are simply omitted from the large_functions JSON array; the resolved thresholds are inspectable via fallow config. Thanks @​digulla for the request. (Closes #1731)

[3.1.0] - 2026-07-05

Added

• New dev-dependency-in-production rule (promote-side dependency drift). Fallow already flagged production dependencies that belong in devDependencies (test-only-dependency, type-only-dependency); the new rule is the mirror that catches the opposite drift. A package in devDependencies that is imported by production (non-test, non-config) source code via a runtime/value import is flagged so it can be promoted to dependencies: a production-only install (pnpm install --prod) omits

... (truncated)

Commits

• 0d56827 chore: release v3.2.0
• afa3c17 fix(health): pluralize the large-functions unit-size footer (#1753)
• 185c6a7 feat(health): expose max unit size threshold in summary
• 47220ee ci: shard benchmarks by affected component
• 9dc768e perf: broaden codspeed benchmark coverage
• 1d14a77 feat(health): add maxUnitSize threshold override for the large-function check...
• c6bbfa3 docs: align benchmark file count
• ede3bcd docs: correct benchmark ratio claims
• d461313 chore: guard benchmark harness drift
• 9ea521d chore: stabilize codspeed benchmark shards
• Additional commits viewable in compare view

Updates oxfmt from 0.56.0 to 0.59.0

Changelog

Sourced from oxfmt's changelog.

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

• 43b9978 formatter/sort_imports: Treat subpath imports as internal (#22440) (leaysgur)

[0.49.0] - 2026-05-11

🚀 Features

• 6e8e818 oxfmt: Experimental .svelte support (#21700) (leaysgur)

[0.45.0] - 2026-04-13

🐛 Bug Fixes

• 50c389b oxfmt: Support .editorconfig quote_type (#20989) (leaysgur)

[0.44.0] - 2026-04-06

🐛 Bug Fixes

• dd2df87 npm: Export package.json for oxlint and oxfmt (#20784) (kazuya kawaguchi)
• 4216380 oxfmt: Support .editorconfig tab_width fallback (#20988) (leaysgur)

... (truncated)

Commits

• 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
• 415fe1e fix(oxfmt): error on ignorePatterns that cannot match files outside the confi...
• 39677ba release(apps): oxlint v1.73.0 && oxfmt v0.58.0 (#24219)
• 5306f24 release(apps): oxlint v1.72.0 && oxfmt v0.57.0 (#23935)
• See full diff in compare view

Updates oxlint from 1.71.0 to 1.74.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

• 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
• 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
• bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
• 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
• 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
• 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
• ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

• 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
• 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
• 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
• 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
• a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
• ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
• 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
• ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
• e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
• 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
• 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
• fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
• ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
• dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
• 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
• cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

• 25d577e language_server: Start tools in parallel (#15500) (Sysix)
• 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
• 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
• 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
• 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
• 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

• 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
• 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
• a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
• 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
• 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
• 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.74.0] - 2026-07-13

🚀 Features

• 0433a83 linter/eslint/no-inner-declarations: Add namespaces option (#24044) (Boshen)

🐛 Bug Fixes

• 8337835 linter: Error on ignorePatterns that cannot match files aoutside the config directory (#24341) (leaysgur)
• 2ce5a33 linter: Resolve ignorePatterns relative to the config dir (#24339) (leaysgur)

⚡ Performance

• 7f80cac linter/vue/prop-name-casing: Precompile ignoreProps regex pattern (#24413) (connorshea)
• 6272051 linter/typescript/no-require-imports: Compile allow patterns once (#24417) (connorshea)
• 33805b9 linter/jsdoc/require-param: Compile checkTypesPattern regex once (#24420) (connorshea)

[1.73.0] - 2026-07-06

🚀 Features

• a2c97f3 linter/unicorn: Implement explicit-timer-delay rule (#23612) (Mikhail Baev)
• 85735cb linter/unicorn: Implement no-confusing-array-with rule (#23638) (Shekhu☺️)
• cb4fbb9 linter/eslint: Implement no-unreachable-loop rule (#23975) (Todor Andonov)
• dc32112 linter/eslint/no-constant-binary-expression: Check relational comparisons (#24088) (camc314)
• d963967 linter/unicorn/no-array-sort: Add allowAfterSpread option (#24043) (Boshen)
• 0a75682 linter: Add per-rule timings for type-aware linting (#22488) (camchenry)
• 743e222 linter/react: Add disallowedValues option for forbid-dom-props rule (#23970) (Mikhail Baev)

🐛 Bug Fixes

• bdb51c7 linter/jest/prefer-ending-with-an-expect: Validate config patterns (#24122) (camc314)
• 45d607d linter/react/forbid-component-props: Make allow/disallow lists optional in schema (#24024) (Boshen)

[1.72.0] - 2026-06-29

🚀 Features

• 1c8f50c linter: Add schema for eslint/no-restricted-import (#23642) (Sysix)

🐛 Bug Fixes

• 742be36 refactor/node/handle-callback-err: Reject invalid regex config (#23740) (camc314)

Commits

• 2d4e8d2 release(apps): oxlint v1.74.0 && oxfmt v0.59.0 (#24454)
• 7f80cac perf(linter/vue/prop-name-casing): precompile ignoreProps regex pattern (#2...
• 6272051 perf(linter/typescript/no-require-imports): compile allow patterns once (#24417)
• 33805b9 perf(linter/jsdoc/require-param): compile checkTypesPattern regex once (#24420)
• 0433a83 feat(linter/eslint/no-inner-declarations): add namespaces option (#24044)
• 8337835 fix(linter): error on ignorePatterns that cannot match files aoutside the c...
• 2ce5a33 fix(linter): resolve ignorePatterns relative to the config dir (#24339)
• 39677ba release(apps): oxlint v1.73.0 && oxfmt v0.58.0 (#24219)
• a2c97f3 feat(linter/unicorn): implement explicit-timer-delay rule (#23612)
• bdb51c7 fix(linter/jest/prefer-ending-with-an-expect): validate config patterns (#24122)
• Additional commits viewable in compare view