build(deps-dev): bump the dev-dependencies group with 7 updates

[dependabot]

Bumps the dev-dependencies group with 7 updates:

Package	From	To
@biomejs/biome	2.5.12	2.5.14
@playwright/test	1.62.1	1.63.0
knip	6.34.0	6.37.0
@types/node	22.20.1	22.20.4
drizzle-kit	0.31.10	0.31.11
tsx	4.23.13	4.23.15
vite	8.2.2	8.3.0

Updates @biomejs/biome from 2.5.12 to 2.5.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.14

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.14

Patch Changes

• #9022 0d49e24 Thanks @​dyc3! - Added the nursery rule noReturnInFinally. This rule disallows return statements in Promise.prototype.finally() callbacks, including inside nested blocks and conditional branches. Returns in nested functions are ignored by the rule.

  // Invalid: return in finally callback
  Promise.resolve(1).finally(() => { return 2 })
  // Valid: no return in finally callback
  Promise.resolve(1).finally(() => { console.log(2) })

  Returning a value from a Promise.prototype.finally() callback does not replace the original promise's fulfillment value, which can be confusing. Returned promises and thenables are awaited, and their rejection rejects the resulting promise.

• #11754 71eaa0d Thanks @​griff-rees! - Added the nursery rule noSvelteAtDebugTags, which disallows Svelte's {@debug} tag.

  <!-- Invalid: leftover debugging tag -->
  {@debug user}

  The {@debug} tag is a debugging aid and should be removed once you no longer need it, as it should not remain in production code. The rule provides a safe fix that removes the tag.

• #11725 5eb5f09 Thanks @​m1handr! - Added the nursery rule useValidTestTitle, which enforces valid titles for unit test cases and suites.

• #11735 9bd70c7 Thanks @​ematipico! - Fixed #8471: source.fixAll.biome ignored formatter.formatWithErrors. It now applies safe fixes without formatting files that have parse errors when the option is disabled.

• #11715 f05a3c3 Thanks @​ematipico! - Fixed #7771: Grit plugins that use sequential no longer panic when Biome processes files.

• #11766 c2542c6 Thanks @​dyc3! - Fixed validation of readonly and accessor modifiers: combining them in either order now reports that they cannot be used together.

• #11461 22e9966 Thanks @​FoundDream! - Fixed #11423: Multiline template interpolations now preserve the indentation of their closing brace when the source indentation is not a multiple of tabWidth.

   const value = `
        ${
          condition
            ? "yes"
            : "no"
  -}
  +     }
   `;

• #11766 c2542c6 Thanks @​dyc3! - Fixed #11763: TypeScript class members using override accessor, such as override accessor value = 1, now parse correctly. The reversed order, accessor override, now reports that override must precede accessor.

• #11790 17d0ff0 Thanks @​ematipico! - Fixed #10248: noUselessFragments now allows fragments with props in Astro files, such as <Fragment slot="name">{text}</Fragment> inside template expressions.

... (truncated)

Commits

• af4365d ci: release (#11711)
• 7ee3a6c fix(useExhaustiveSwitchCases): add option requireExplicitCase (#11777)
• 02ea438 feat(json_analyze): implement noJsonUnsafeValues (#9758)
• 64fd314 feat(json_analyze): implement useConsistentObjectKeys (#9797)
• a9c4aa0 feat(html): detect undeclared custom Vue directives (#11651)
• 1fc17e3 feat: expand useIncludes (#11739)
• 71eaa0d feat(lint/html/svelte): add noSvelteAtDebugTags (#11754)
• 9bd70c7 fix: various bug fixes (#11735)
• c7c4e2b fix(analyzer): various bugs (#11720)
• 5eb5f09 feat(biome_js_analyze): implement useValidTestTitle rule (#9176) (#11725)
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates knip from 6.34.0 to 6.37.0

Release notes

Sourced from knip's releases.

Release 6.37.0

• fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (#2048) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks @​RobHannay!
• fix: enable JSX in the config loader (#1959) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks @​addielaruee!
• Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)
• Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)
• Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)
• Separate shell binary expectations from reporting exemptions (resolve #2022) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)
• Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)
• Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)
• Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)
• Fix --format name resolution in the ESLint plugin (#2046) (1269e98bb700384811fadc124d69ea720832037e) - thanks @​bytedoe!

Release 6.36.0

• Add @​tailwindcss/webpack as Tailwind plugin enabler (#2027) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks @​igas!
• Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)
• Explain ambiguous star exports in traces (#2025) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks @​gioboa!
• Fix eslintrc parserOptions.parser handling in ESLint plugin (#2028) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks @​bytedoe!
• fix(compilers): require word boundary around import keyword (#2029) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks @​thanadolps!
• fix: recover from corrupt cache file (#2034) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks @​gioboa!
• fix: fix trailing comma on dependency removal (#2033) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks @​gioboa!
• Document built-in compiler scope (a05e155276dad4ead16992580d17572cebf045e7)
• Add babel, khan and oxc to projects and optimize svgs (1c26560b98bc3109e93d15761d02f089213bfb6c)
• Add section to test preview packages & extension (d911c18385f0aa41f53653a2a15cc90a1e0251b8)
• Fix shared info/exclude handling in linked Git worktrees (#2037) (c1f18d5a7d25fc5a614747bbcbd62d043457eb48) - thanks @​kenfdev!
• Shard Node specs on Windows and enable Bun test parallelism (66e966b6edec4460b40b05847fefa9f90ee69068)
• Add Varlock plugin support (#2000) (e4fbf46acff08e78370e72b142e795bd81f28561) - thanks @​Joehoel!
• Apply NODE_OPTIONS inputs to package manager binaries (#2038) (c8df8a28e9a19484efe7097f984abc0c6556aff5) - thanks @​giaBaoJS!
• Handle array form of import/resolver setting in ESLint plugin (#2041) (a80d386a80fdafc89c610d4887ec82184ac178db) - thanks @​bytedoe!
• fix(node): add valueless Node CLI flags to boolean options (#2042) (4c6768501f7115a894d7ece9e5c32090b684cc6f) - thanks @​shoutoutuoadi325!
• fix(typedoc): accept string form of plugin and theme options (#2043) (ce387b05c8f136546e860ec73e29557563c63afa) - thanks @​giaBaoJS!
• Add textlint plugin (#2039) (532dab595fc9a910e320418dc0390222fb2d7478) - thanks @​anandghegde!
• fix: Correctly resolve Vitest setupFiles from nested configs (#2040) (84a494334e125d229dc865893b21d69d0d201e85) - thanks @​CruseCtrl!
• Add n8n to projects (3f756a7e70c4164d57a7dbbd58f3604afe4043e2)
• Resolve re-export traces to their defining bindings (43b3f9bbd7701ab44fca0554908f7550fbe84649)
• Show ambiguous, shadowed and converged exports (f1e97b998d80906f0cef3f5e3946833b7166cbdc)
• Document export tracing and editor contention (0188e7da1a481c7f6493d50580dfa8a7ecdf8c72)
• Resolve local extends files in eslintrc configs (#2044) (62b5bf5aef5e6d3fc4784a1b5ef9933d383609ea) - thanks @​bytedoe!
• docs: link each page to its own OG image (#2045) (a85eb4e2aab46c3fa0813b1f1e13e93e134b8be7) - thanks @​bytedoe!
• fix: fix language server bundled knip fallback (#2035) (882ba3abb0b99c2bfe3e13a241d889376fe87c4c) - thanks @​gioboa!

Release 6.35.1

• Exit with code 2 when a plugin config file fails to load (#1947) (37b26426694380ef70ee45f63358faf63355a58d) - thanks @​WooWan!
• Fix sponsorship income calculations (0d9cf344b8cc0104c06d11e2c78f3f01b1df548b)
• Update sponsors page (2659063d87f558b4fc18369a4b143849eaa7543e)
• Fix npm alias attribution under Yarn PnP (resolve #2024) (7be11aa4fd50b8a3d6e276f03efb450d6d142c26)

Release 6.35.0

• fix: track pnpm workspace override catalogs (#1999) (c6497a18c6534ee914b27bb459d7778a7b93a914) - thanks @​gioboa!
• fix: track spreads under string-literal keys (#2003) (9ce68ed42a3c22fa4f4711b06d6d80a0e7f2ba13) - thanks @​gioboa!
• fix: don't flag a tag that suppresses member issues (#2004) (2e7d498cf1e53f0bbad5e16c335c5e1417432ffd) - thanks @​devYRPauli!

... (truncated)

Commits

• 675c1b1 Release knip@6.37.0
• 1269e98 Fix --format name resolution in the ESLint plugin (#2046)
• 038ea17 Update dependencies
• 4237010 Respect npx no-install flags before the executable
• c1d7d75 Separate shell binary expectations from reporting exemptions (resolve #2022)
• e67dfcb Correct binary provider metadata in Relay fixtures
• 54af171 Preserve executable references across package manager commands
• c5bdb69 Match binaries only to their actual dependency providers
• 5b21dc9 fix: enable JSX in the config loader (#1959)
• 06a68fc fix(graphql-codegen): mark near-operation-file outputs as entries, not the do...
• Additional commits viewable in compare view

Updates @types/node from 22.20.1 to 22.20.4

Commits

• See full diff in compare view

Updates drizzle-kit from 0.31.10 to 0.31.11

Release notes

Sourced from drizzle-kit's releases.

drizzle-kit@0.31.11

• Warn about silent migration skips on drizzle-kit checks - thanks @​shaneikennedy

Commits

• 15454db +
• 54e436f exclude gel from pull
• 0fd1cc6 remove gel
• d028db7 skip gel
• 93dc01e [All-kit]: Warn when journal timestamps can cause migrations to be skipped (#...
• b786252 Merge pull request #6049 from drizzle-team/drizzle-kit-announcements
• f9fc5bf Add drizzle-kit announcement manifest and schema doc
• 9d64532 Merge pull request #6004 from drizzle-team/pin-npm-11-main
• 0af2f2e Pin the release npm self-update to major 11: the npm 12.0.0 tarball is missin...
• 6968638 Merge pull request #6001 from drizzle-team/release-router-dispatch-inputs
• Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)
• delete unused PluginContainerOptions (#23382) (ee64401)
• use oxfmt sortImports (#23319) (97ad042)

... (truncated)

Commits

• 95e8923 release: v7.3.1
• 9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
• acf7e05 release: v7.3.0
• cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
• 317b3b2 release: v7.2.7
• 721f163 fix: plugin shortcut support (#21211)
• bda5dbb release: v7.2.6
• 3aa7527 release: v7.2.5
• 72e398a fix(deps): update all non-major dependencies (#21175)
• 3765f7b fix: shortcuts not rebound after server restart (#21166)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.