[dependabot]

Bumps the development group with 2 updates in the / directory: @biomejs/biome and @cloudflare/workers-types.

Updates @biomejs/biome from 2.6.2 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Updates @cloudflare/workers-types from 5.20261024.1 to 5.20261025.1

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​cloudflare/​workers-types@​5.20261024.1 ⏵ 5.20261025.1	+1
	@​biomejs/​biome@​2.6.2 ⏵ 2.6.3			+1

View full report

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates Biome to 2.6.3 and Cloudflare Workers types to 5.20261025.1, with matching lockfile changes.

Example: A contributor installs the workspace and runs pnpm lint.

• Before: The command uses Biome 2.6.2.
• After: The command uses Biome 2.6.3 with the existing lint and formatting configuration.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance with consistent lockfile changes and passing reviewed-head checks; validation evidence is limited to CI, with no contributor proof requirement.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot-authored development dependency update is outside the ordinary contributor proof gate; passing CI supports compatibility and is not claimed as separate runtime proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors use older patch releases of the repository linter and Worker type declarations.
Reason: The narrow update follows established dependency maintenance without introducing a new product behavior, option, schema, or SDK contract.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the focused dependency updates are absent from main, checks pass for the reviewed head, and no actionable correctness or security defect was found.

Priority: P3
Reviewed head: 921836e6eb0f5d867ca818d5989ba2ccc78220ed

Before merge

None.

Findings

None.

Agent review details

How this fits together

The development dependency graph supplies Biome for repository checks and Cloudflare declarations for Worker tooling, producing diagnostics and typechecking results.

flowchart LR
  A[Package manifests] --> B[pnpm lockfile]
  B --> C[Biome binary]
  B --> D[Worker type declarations]
  E[Repository source and configuration] --> C
  E --> D
  C --> F[Lint diagnostics]
  D --> G[Typechecking results]

Loading

Technical review

Best possible solution:

Land the focused dependency update while retaining the existing formatter scope, security overrides, and dependency cooldown.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported application bug; source inspection verifies the version changes, and no target code was executed locally.

Is this the best way to solve the issue?

Updating the existing dependency declarations and matching lockfile entries is the smallest complete change and preserves the established tooling policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fa559f4be47b.

Provenance checked

• Biome version and platform dependency graph keeps the original intent (311476e: The merged tooling refresh adopted Biome 2.6.2 while preserving the existing formatting scope.)
• Workers types and dependent peer resolutions keeps the original intent (311476e: The merged tooling refresh selected compatible Cloudflare dependencies while retaining the patched Worker runtime and security overrides.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Verified introduced change: The introduced diff changes only two development dependency declarations and their lockfile resolutions, platform binaries, and peer identifiers; existing security overrides remain intact. (pnpm-lock.yaml:21, 921836e6eb0f)
• Updates remain absent from main: GitHub main remains at the fetched base, where Biome is 2.6.2 and the lockfile resolves Workers types to 5.20261024.1. (package.json:27, fa559f4be47b)
• Prior tooling decisions preserved: The merged build(deps): patch security overrides and refresh compatible tooling #171 intentionally preserved security overrides, the dependency cooldown, and disabled Markdown/YAML formatting; this PR retains those choices. (biome.json:14, 311476e9ae21)
• Reviewed-head validation: GitHub reports 13 successful checks and two skipped dispatch checks for the reviewed head, including Lint, Typecheck, Test, Build, CodeQL, and Socket checks. (.github/workflows/ci.yml, 921836e6eb0f)
• Earlier overlapping update: The earlier Biome-only build(deps-dev): bump @biomejs/biome from 2.6.2 to 2.6.3 in the development group #172 is closed without merging; Dependabot states that Biome is updatable another way, and this PR contains that update.
• Registry metadata cross-check: npm metadata for @biomejs/biome 2.6.3, its Linux x64 binary, and @cloudflare/workers-types 5.20261025.1 matches the corresponding lockfile integrities; those manifests declare no lifecycle scripts.

Likely related people:

• Josh Avant: Raw commit 02d9f04 adds pnpm-lock.yaml:8 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 02d9f0410e82; files: pnpm-lock.yaml)

Labels

Label changes:

• add P3: Routine development dependency maintenance with no demonstrated production failure or urgent regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development dependency maintenance with no demonstrated production failure or urgent regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 10:21 PM ET / October 27, 2026, 02:21 UTC.

[steipete]

The Biome 2.6.3 and Cloudflare Workers types 5.20261025.1 updates were consolidated into #176 and merged as 666708d. The combined change passed the full documented Linux gate and exact-head CI, including native keyring checks on Linux, Windows, and xcode-27. Thanks for the update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml