build: Bump the npm-minor group across 1 directory with 4 updates

[dependabot]

Bumps the npm-minor group with 4 updates in the / directory: @biomejs/biome, @types/node, highlight.js and solid-js.

Updates @biomejs/biome from 2.5.7 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Updates @types/node from 26.2.0 to 26.4.0

Commits

• See full diff in compare view

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]
• enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
• fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
• fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits

• f7f7d38 (release) release v11.12.0
• c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
• 9142292 bump version to 11.12.0
• 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
• ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
• 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
• 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
• 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
• 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
• 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.

Updates solid-js from 1.9.14 to 1.9.15

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions