[dependabot]

Bumps the development group with 1 update: @biomejs/biome.

Updates @biomejs/biome from 2.6.2 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates the development-only Biome dependency and its platform binaries from 2.6.2 to 2.6.3.

Example: A contributor runs pnpm lint after installing dependencies.

• Before: The command uses Biome 2.6.2.
• After: The command uses Biome 2.6.3 with the existing repository configuration.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused maintenance with consistent lockfile changes, passing exact-head validation, and no concrete correctness or security findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored development dependency update is outside the ordinary contributor proof gate; successful CI supports compatibility but is not claimed as separate runtime proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors currently use the previous Biome patch release for repository checks.
Reason: The routine patch update fits established dependency maintenance and preserves the existing lint and formatting policy.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the focused Biome update is not on current main, exact-head checks pass, and inspection found no actionable defect.

Priority: P3
Reviewed head: 52a9a4191e1d8fa86c3840ae8071f4c5a1c9f713

Before merge

None.

Findings

None.

Agent review details

How this fits together

Biome checks repository source during local development and CI, producing formatting and lint diagnostics without participating in production flag evaluation.

flowchart LR
  A[Package manifest] --> B[pnpm lockfile]
  B --> C[Biome platform binary]
  D[Repository source and configuration] --> C
  E[Local lint command and CI] --> C
  C --> F[Diagnostics and exit status]

Loading

Technical review

Best possible solution:

Land the focused dependency update while preserving the existing formatter scope and security pins.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported application bug; no local target code was executed.

Is this the best way to solve the issue?

Updating the exact manifest pin and matching platform lockfile entries is the smallest complete change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 311476e9ae21.

Provenance checked

• Biome version and platform dependency graph keeps the original intent (311476e: The merged build(deps): patch security overrides and refresh compatible tooling #171 refreshed compatible tooling while preserving formatting scope, security overrides, and the dependency cooldown.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Pinned patch is limited to Biome: The complete introduced diff changes the manifest pin, matching lockfile importer, and ten optional platform packages; no unrelated dependencies, scripts, permissions, or security overrides change. (package.json:27, 52a9a4191e1d)
• Update remains absent from main: The GitHub main branch still points to 311476e, whose manifest pins Biome 2.6.2. (package.json:27, 311476e9ae21)
• Prior tooling intent is preserved: The merged build(deps): patch security overrides and refresh compatible tooling #171 adopted Biome 2.6.2 while deliberately disabling Markdown and YAML formatting; this PR preserves those settings and the dependency cooldown. (biome.json:14, 311476e9ae21)
• Exact-head validation: GitHub reports 11 successful checks and two skipped dispatch checks for the reviewed head, including successful Lint, Typecheck, Test, Build, CodeQL, workflow lint, and platform keyring checks. (.github/workflows/ci.yml, 52a9a4191e1d)
• Policy and history inspection: The full root AGENTS.md applies to both changed root files; no maintainer notes or pr-simplify skill are present. The requested single-reviewer procedure supersedes the repository helper instruction. Scoped history identifies repeated tooling updates and the pnpm migration; unavailable historical blobs limit introduction tracing but do not affect the verified patch. (AGENTS.md, 311476e9ae21)

Labels

Label changes:

• add P3: Routine development-tool patch maintenance with no demonstrated production impact or urgent regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development-tool patch maintenance with no demonstrated production impact or urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 2:54 PM ET / 18:54 UTC.

[dependabot]

Looks like @biomejs/biome is updatable in another way, so this is no longer needed.