Skip to content

chore(deps): bump the minor-and-patch group across 1 directory with 4 updates#455

Open
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/staging/minor-and-patch-0b49d56af4
Open

chore(deps): bump the minor-and-patch group across 1 directory with 4 updates#455
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/npm_and_yarn/staging/minor-and-patch-0b49d56af4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 12, 2026

Bumps the minor-and-patch group with 4 updates in the / directory: @biomejs/biome, @opentelemetry/sdk-node, @json-render/react and fumadocs-mdx.

Updates @biomejs/biome from 2.4.13 to 2.4.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.15

2.4.15

Patch Changes

  • #9394 ba3480e Thanks @​dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.

  • #10254 e0a54cc Thanks @​dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

    For example, the following snippet triggers the rule:

    import { nextTick } from "vue";
    nextTick(() => {
    updateDom();
    });

  • #10219 64aee45 Thanks @​dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

    For example, the following snippet triggers the rule:

    <input @keyup.13="submit" />
  • #10195 7b8d4e1 Thanks @​dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

  • #10238 1110256 Thanks @​dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

  • #10201 1a08f89 Thanks @​realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

  • #9574 3bd2b6a Thanks @​Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.

  • #10205 a704a6c Thanks @​Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

    The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.

    {
      "assist": {
        "actions": {
          "source": {
            "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
          }
        }
      }
    }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.15

Patch Changes

  • #9394 ba3480e Thanks @​dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.

  • #10254 e0a54cc Thanks @​dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

    For example, the following snippet triggers the rule:

    import { nextTick } from "vue";
    nextTick(() => {
    updateDom();
    });

  • #10219 64aee45 Thanks @​dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

    For example, the following snippet triggers the rule:

    <input @keyup.13="submit" />
  • #10195 7b8d4e1 Thanks @​dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

  • #10238 1110256 Thanks @​dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

  • #10201 1a08f89 Thanks @​realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

  • #9574 3bd2b6a Thanks @​Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.

  • #10205 a704a6c Thanks @​Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

    The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.

    {
      "assist": {
        "actions": {
          "source": {
            "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
          }
        }
      }
    }

... (truncated)

Commits

Updates @opentelemetry/sdk-node from 0.215.0 to 0.217.0

Release notes

Sourced from @​opentelemetry/sdk-node's releases.

experimental/v0.217.0

0.217.0

🚀 Features

  • feat(otlp-transformer): replace protobufjs trace serialization with custom implementation #6625 @​pichlermarc
  • feat(configuration): auto-generate TypeScript types from OTel declarative config JSON schema (stable v1.0.0) using json-schema-to-typescript and ajv #6533 @​MikeGoldsmith
  • feat(configuration, sdk-node): startNodeSDK() code path now uses log_level configuration to setup a DiagConsoleLogger #6668 @​trentm
    • Note that allowed values for log_level in a configuration YAML file are not the same set as for OTEL_LOG_LEVEL. Use log_level: trace to see all logs (equivalent of OTEL_LOG_LEVEL=ALL). Use log_level: fatal to effectively disable the SDK's internal diagnostic logger (equivalent of OTEL_LOG_LEVEL=NONE).
    • If log_level is not specified, a diagnostic console logger at "info" level will be setup.
    • An invalid YAML config file will now result in a noop OTel SDK.

🐛 Bug Fixes

  • fix(configuration): do not validate OTEL_CONFIG_FILE value before using it for file config #6643 @​trentm
  • fix(configuration): improve how 'additionalProperties' in JSON schema is translated to TS types #6650 @​trentm
  • fix(configuration): remove stripMinItems and preprocessNullArrays from validation/parsing #6657 @​trentm
  • fix(configuration): improve handling of enums in generated types #6659 @​trentm
  • fix(configuration): improve the technique for removing '| null' on types the JSON Schema #6662 @​trentm
  • fix(sampler-jaeger-remote): add missing axios dep #6656 @​trentm
  • fix(exporter-prometheus): handle malformed URLs in Prometheus exporter request handler #6674 @​homanp

experimental/v0.216.0

0.216.0

🚀 Features

🐛 Bug Fixes

  • fix(instrumentation-xml-http-request): avoid unwrapping XMLHttpRequest API when disabling #6611 @​david-luna
  • fix(instrumentation-fetch): tolerate non-writable globalThis.fetch and fix premature _isEnabled / _isFetchPatched flips in enable() @​brunorodmoreira
  • fix(instrumentation-xhr): resolve relative URLs before matching ignoreUrls #6551 @​Maximiliano-Zeballos
  • fix(sdk-node): fix setting of ViewOption#name from ConfigurationModel #6620 @​trentm
  • fix(web-common): add limit for timeout #6601 @​maryliag
  • fix(otlp-transformer): pin protobufjs@8.0.1 as protobufjs@8.0.3 is broken for browser use #6646

🏠 Internal

  • test(otlp-transformer): add metrics transform benchmark #6628 @​pichlermarc
  • refactor(opentelemetry-exporter-prometheus): do not call enforcePrometheusNamingConvention() multiple times per metric #6636 @​cjihrig
Commits
  • 74cde1b chore: prepare next release (#6675)
  • e8f439a fix: handle malformed URLs in Prometheus exporter request handler (#6674)
  • ab3a2e2 feat(sdk-node, configuration): diag log handling updates for startNodeSDK(), ...
  • d5b7d1e fix(deps): update dependency axios to v1.15.2 [security] (#6670)
  • c163618 chore(deps): update github/codeql-action digest to e46ed2c (#6661)
  • ec2bfbe chore(configuration): move config generation scripts into the configuration p...
  • acc9ecd chore(configuration): cosmetic changes to generated types.ts (#6663)
  • 8f008ec chore: Move inactive members to emeritus (#6649)
  • 435431e fix(configuration): improve the technique for removing '| null' on types due ...
  • 4222024 fix(configuration): improve handling of enums in generated types (#6659)
  • Additional commits viewable in compare view

Updates @json-render/react from 0.18.0 to 0.19.0

Changelog

Sourced from @​json-render/react's changelog.

0.19.0

New Features

  • Custom directives API@json-render/core now supports custom directives via defineDirective, letting you declare new JSON shapes (like $format, $math) that resolve to computed values at render time. Directives compose naturally — nest $format over $math over $state and they resolve inside-out. All four renderers (React, Vue, Svelte, Solid) have built-in directive resolution (#279)
  • @json-render/directives — New package shipping seven ready-made directives: $format (date, currency, number, percent via Intl), $math (add, subtract, multiply, divide, mod, min, max, round, floor, ceil, abs), $concat, $count, $truncate, $pluralize, and $join. Also exports createI18nDirective for $t translation keys with {{param}} interpolation, and standardDirectives for one-line registration (#279)

Improvements

  • Example READMEs — Added documentation to the chat, dashboard, game-engine, and no-ai examples (#277)

Contributors

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​json-render/react since your current version.


Updates fumadocs-mdx from 14.3.0 to 14.3.2

Release notes

Sourced from fumadocs-mdx's releases.

fumadocs-mdx@14.3.2

Patch Changes

  • 79d3209: Deprecate forwarded schemas at fumadocs-mdx/config, recommend fumadocs-core/source/schema instead.
  • Updated dependencies [79d3209]
    • fumadocs-core@16.8.5
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 12, 2026
@dependabot dependabot Bot requested a review from izadoesdev as a code owner May 12, 2026 20:57
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 12, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 12, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
dashboard Ready Ready Preview, Comment May 13, 2026 7:21pm
databuddy-status Ready Ready Preview, Comment May 13, 2026 7:21pm
documentation Ready Ready Preview, Comment May 13, 2026 7:21pm

@unkey-deploy
Copy link
Copy Markdown

unkey-deploy Bot commented May 12, 2026

The latest updates on your projects. Learn more about Unkey Deploy

Name Status Preview Inspect Updated (UTC)
uptime (preview) Failed Visit Preview Inspect May 13, 2026 7:19pm

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 4 files

Confidence score: 3/5

  • There is a concrete compatibility risk in apps/docs/package.json: fumadocs-mdx was bumped to 14.3.2, which expects fumadocs-core ^16.7.0, while the PR still pins 15.5.0.
  • Given the medium severity (6/10) and high confidence (9/10), this could cause install/build or runtime issues in the docs app until versions are aligned.
  • This is likely fixable with a targeted dependency update, but it introduces enough regression risk to warrant a cautious merge.
  • Pay close attention to apps/docs/package.json - align fumadocs-core with the new fumadocs-mdx requirement to avoid version mismatch failures.
Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/docs/package.json">

<violation number="1" location="apps/docs/package.json:60">
P2: Bump fumadocs-core alongside fumadocs-mdx; 14.3.2 requires fumadocs-core ^16.7.0, but this package still pins 15.5.0.</violation>
</file>
Architecture diagram
sequenceDiagram
    participant App as Application
    participant SDK as OTel SDK
    participant Config as YAML Config
    participant Diag as Diagnostic Logger
    participant Core as json-render Core
    participant Dir as @json-render/directives
    participant Schema as fumadocs-core/source/schema
    participant Biome as Biome CLI

    Note over App,Biome: Runtime flows after dependency updates

    App->>SDK: startNodeSDK()
    alt NEW: log_level in YAML config
        App->>Config: Read declarative config file
        alt Config valid
            Config-->>SDK: config object with log_level
            SDK->>Diag: Setup DiagConsoleLogger at specified level
            Diag-->>SDK: Diagnostic logger active
        else Config invalid
            Config-->>SDK: parse error
            SDK->>SDK: Noop SDK initialization
            SDK-->>App: TracerProvider as noop
        end
    else No log_level set
        SDK->>Diag: Setup default "info" DiagConsoleLogger
    end
    SDK->>SDK: Set TracerProvider
    SDK-->>App: Running TracerProvider

    Note over Core,Dir: Dashboard rendering flow (NEW directive resolution)
    App->>Core: Render JSON template with directives
    Core->>Dir: Resolve custom directives ($format, $math, $concat, etc.)
    Dir->>Dir: Process nested directives (inside-out)
    Dir-->>Core: Computed values
    Core->>App: Rendered React components

    Note over App,Schema: Docs MDX schema import (CHANGED source)
    App->>Schema: Import schema utilities (NEW preferred path)

    Note over App,Biome: Dev-time linting (CHANGED: new nursery rules)
    App->>Biome: Run lint
    Biome-->>App: Diagnostics including new rules
Loading

Shadow auto-approve: would not auto-approve because issues were found.
Fix all with cubic

Comment thread apps/docs/package.json
"fumadocs-core": "15.5.0",
"fumadocs-docgen": "^2.1.0",
"fumadocs-mdx": "14.3.0",
"fumadocs-mdx": "14.3.2",
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Bump fumadocs-core alongside fumadocs-mdx; 14.3.2 requires fumadocs-core ^16.7.0, but this package still pins 15.5.0.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/docs/package.json, line 60:

<comment>Bump fumadocs-core alongside fumadocs-mdx; 14.3.2 requires fumadocs-core ^16.7.0, but this package still pins 15.5.0.</comment>

<file context>
@@ -57,7 +57,7 @@
     "fumadocs-core": "15.5.0",
     "fumadocs-docgen": "^2.1.0",
-    "fumadocs-mdx": "14.3.0",
+    "fumadocs-mdx": "14.3.2",
     "fumadocs-ui": "15.5.0",
     "gray-matter": "^4.0.3",
</file context>
Fix with Cubic

… updates

Bumps the minor-and-patch group with 4 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [@opentelemetry/sdk-node](https://github.com/open-telemetry/opentelemetry-js), [@json-render/react](https://github.com/vercel-labs/json-render/tree/HEAD/packages/react) and [fumadocs-mdx](https://github.com/fuma-nama/fumadocs).


Updates `@biomejs/biome` from 2.4.13 to 2.4.15
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome)

Updates `@opentelemetry/sdk-node` from 0.215.0 to 0.217.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-js@experimental/v0.215.0...experimental/v0.217.0)

Updates `@json-render/react` from 0.18.0 to 0.19.0
- [Release notes](https://github.com/vercel-labs/json-render/releases)
- [Changelog](https://github.com/vercel-labs/json-render/blob/main/CHANGELOG.md)
- [Commits](https://github.com/vercel-labs/json-render/commits/v0.19.0/packages/react)

Updates `fumadocs-mdx` from 14.3.0 to 14.3.2
- [Release notes](https://github.com/fuma-nama/fumadocs/releases)
- [Commits](https://github.com/fuma-nama/fumadocs/compare/fumadocs-mdx@14.3.0...fumadocs-mdx@14.3.2)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@json-render/react"
  dependency-version: 0.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@opentelemetry/sdk-node"
  dependency-version: 0.217.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: fumadocs-mdx
  dependency-version: 14.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@socket-security
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm entities is 91.0% likely obfuscated

Confidence: 0.91

Location: Package overview

From: ?npm/unbuild@3.6.1npm/entities@4.5.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@4.5.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants