Bump the all group across 1 directory with 6 updates

[dependabot]

Bumps the all group with 6 updates in the /plugins/fchub-thank-you/admin directory:

Package	From	To
vue	3.5.41	3.5.42
@biomejs/biome	1.9.4	2.5.11
typescript	5.9.3	7.0.2
vite	8.2.1	8.2.2
vue-router	5.2.0	5.3.0
vue-tsc	3.3.10	3.3.11

Updates vue from 3.5.41 to 3.5.42

Release notes

Sourced from vue's releases.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.42 (2026-08-27)

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
• runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
• server-renderer: reject CR in attribute names (#15266) (a2b40db)
• shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
• v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

Commits

• d63616c release: v3.5.42
• b8543dc Revert "fix(compiler-core): handle invalid static arg in same-name v-bind sho...
• 3857716 fix(compiler-core): handle invalid static arg in same-name v-bind shorthand (...
• 31da934 fix(runtime-dom): support !important on CSS custom properties in style bindin...
• f8d42e1 fix(runtime-core): keep .trim result when combined with .number v-model modif...
• cd19745 fix(suspense): don't treat the leaving branch as the fallback while its mount...
• 8654f35 fix(runtime-core): resolve $el for dev root comment fragment (#15313)
• ef82a26 fix(shared): correctly compare Map and Set values (#15328)
• 6eaecc1 fix(v-model): re-sync select when model is overridden in change handler (#15298)
• b535917 fix(runtime-core): avoid caching unmounted suspense children (#15291)
• Additional commits viewable in compare view

Updates @biomejs/biome from 1.9.4 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​biomejs/biome since your current version.

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Updates vue-router from 5.2.0 to 5.3.0

Release notes

Sourced from vue-router's releases.

v5.3.0

   🚀 Features

• Prevent race condition dev-only error  -  by @​meihao550 in vuejs/router#2789 (d2b87)
• scroll: Skip scroll computation based on history.scrollRestoration  -  by @​posva (033f1)
• unplugin: Don't crash on duplicate definePage() calls  -  by @​posva in vuejs/router#2753 (686bf)
• volar: Narrow typeof useRoute in a type context  -  by @​Anoesj in vuejs/router#2759 (7a4c8)

   🐞 Bug Fixes

• history:
  • Remove visibilitychange listener to prevent focus steal in Edge  -  by @​Mini-Sylar in vuejs/router#2704 (17b58)
• router:
  • Skip scroll saving for unknown pop direction  -  by @​ifer47 in vuejs/router#1431 and vuejs/router#2780 (23150)
• types:
  • Allow unsetting a route name with false in EditableTreeNode  -  by @​Anoesj in vuejs/router#2752 (8e2e1)
• unplugin:
  • Sort and dedupe params in generated types  -  by @​posva (a25fa)
  • Skip unnamed params in generated route types  -  by @​posva (c694e)
  • Report unnamed params once per route  -  by @​posva (52058)
  • Generate param types from override paths and stop inheritance on absolute overrides  -  by @​G100my in vuejs/router#2646 (67bab)

   🏎 Performance

• Replace json5 and yaml with confbox  -  by @​danielroe in vuejs/router#2769 (aab28)
• Avoid depending on the current route to resolve absolute locations  -  by @​danielroe (9b7e3)
• experimental: Avoid tracking currentRoute in absolute string locations  -  by @​posva (084fc)

    View changes on GitHub

Commits

• 0e91ac8 release: vue-router@5.3.0
• b19cce2 chore: dark mode e2e
• 2315047 fix(router): skip scroll saving for unknown pop direction (fix #1431) (#2780)
• d2b87d5 feat: prevent race condition dev-only error (#2789)
• b75d5a8 docs: scroll off
• 033f1c7 feat(scroll): skip scroll computation based on history.scrollRestoration
• 67babd4 fix(unplugin): generate param types from override paths and stop inheritance ...
• 48566ba refactor: isAbsolutePath
• 084fcfc perf(experimental): avoid tracking currentRoute in absolute string locations
• dfb373d test: load resolved location before passing it as currentLocation
• Additional commits viewable in compare view

Updates vue-tsc from 3.3.10 to 3.3.11

Release notes

Sourced from vue-tsc's releases.

v3.3.11

language-core

• fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

• fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
• refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

• fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

• fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

• feat: allow disabling the welcome page (#6165) - Thanks to @​pierreedbrg!

Our Sponsors ❤️

... (truncated)

Changelog

Sourced from vue-tsc's changelog.

3.3.11 (2026-08-21)

language-core

• fix: generate full fragment props for type checking (#6155) - Thanks to @​serkodev!

language-service

• fix: invalidate tag and prop casing detection after template changes (#6172) - Thanks to @​serkodev!
• refactor: make name casing detection reactive (#6173) - Thanks to @​KazariEX!

component-meta

• fix: invalidate module resolution caches when deleting files (#6163) - Thanks to @​serkodev!

tsc

• fix: make extension retry errors serializable across IPC (#6162) - Thanks to @​KazariEX!

vscode

• feat: allow disabling the welcome page (#6165) - Thanks to @​pierreedbrg!

Commits

• f521b39 v3.3.11 (#6174)
• 05ab009 fix(tsc): replace symbol retryToken with error to allow IPC serialization (...
• fd6dada fix(language-core): generate full fragment props for typecheck (#6155)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7353f3ed0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Migrate the Biome configuration with the major bump

After installing these dependencies, npm run check exits while parsing admin/biome.json: Biome 2 no longer accepts the existing v1 keys such as files.include, the top-level organizeImports, and linter.rules.recommended. The repository's other Biome 2 configurations use files.includes, assist.actions.source.organizeImports, and rules.preset, so this major upgrade must migrate this configuration as well or the admin lint command remains unusable.

Useful? React with 👍 / 👎.