chore(deps): bump the monorepo-dependencies group across 1 directory with 27 updates

[dependabot]

Bumps the monorepo-dependencies group with 27 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.3	2.5.13
@changesets/changelog-github	0.7.0	1.0.1
@changesets/cli	2.31.0	3.0.2
@modelcontextprotocol/sdk	1.29.0	1.30.0
@types/node	26.1.1	26.5.1
esbuild	0.28.1	0.28.2
lint-staged	17.0.8	17.5.1
playwright	1.61.1	1.63.0
preact	10.29.7	10.29.8
tinybench	6.0.2	6.2.0
tsx	4.23.0	4.23.13
turbo	2.10.4	2.10.12
typescript	6.0.3	7.0.2
@babel/standalone	8.0.4	8.0.5
fumadocs-core	16.11.5	16.15.10
fumadocs-mdx	15.2.0	15.4.0
fumadocs-ui	16.11.5	16.15.10
lucide-react	0.545.0	1.45.0
mermaid	11.16.0	12.0.0
next	16.2.10	16.3.5
react	19.2.7	19.3.0
@types/react	19.2.17	19.3.0
react-dom	19.2.7	19.3.0
@types/react-dom	19.2.3	19.3.0
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
postcss	8.5.20	8.5.28
undici	8.7.0	8.10.2
es-module-lexer	2.3.1	3.0.2

Updates @biomejs/biome from 2.5.3 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Updates @changesets/changelog-github from 0.7.0 to 1.0.1

Release notes

Sourced from @​changesets/changelog-github's releases.

@​changesets/changelog-github@​1.0.1

Patch Changes

• Updated dependencies [4d7b4fb]:
  • @​changesets/get-github-info@​1.0.1

@​changesets/changelog-github@​1.0.0

Major Changes

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

Minor Changes

• #2059 070f531 Thanks @​jycouet! - Add an opt-in, experimental template option to render changelog lines from tokens ({summary}, {ref}, {pull}, {commit}, {authors}). Default output is unchanged. The token syntax may change in a patch release; pin the version if you rely on it.

• #1871 dfefc4e Thanks @​mihkeleidast! - Use GITHUB_REPOSITORY as the default repo when no repo option is configured

• #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

  The default export is slated for removal in the next major release, so this ensures a smoother transition path.

Patch Changes

• #2040 88f2abb Thanks @​bluwy! - Improve type-check for options object

• #2160 162419d Thanks @​beeequeue! - Added or modified the files property in the manifest. This should not change any behavior.

• #1947 492b0ca Thanks @​bluwy! - Use parseEnv instead of dotenv to load the .env file and avoid loading them to process.env

• Updated dependencies [5b02e2f, 062530b, 88f2abb, dae394c, dae394c, df424a4, b5e1762, c19b112, 162419d, 4c26f2f, 96b65ee, 813bbf3, df424a4, a0b5326, 492b0ca]:

  • @​changesets/get-github-info@​1.0.0
  • @​changesets/types@​7.0.0

@​changesets/changelog-github@​1.0.0-next.9

Patch Changes

• Updated dependencies [96b65ee]:
  • @​changesets/types@​7.0.0-next.9

@​changesets/changelog-github@​1.0.0-next.3

Major Changes

• #1954 ed6728c Thanks @​beeequeue! - Bumped supported Node versions to ^22.11 || ^24 || >=26

Minor Changes

• #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

  The default export is slated for removal in the next major release, so this ensures a smoother transition path.

... (truncated)

Changelog

Sourced from @​changesets/changelog-github's changelog.

1.0.1

Patch Changes

• Updated dependencies [4d7b4fb]:
  • @​changesets/get-github-info@​1.0.1

1.0.0

Major Changes

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

Minor Changes

• #2059 070f531 Thanks @​jycouet! - Add an opt-in, experimental template option to render changelog lines from tokens ({summary}, {ref}, {pull}, {commit}, {authors}). Default output is unchanged. The token syntax may change in a patch release; pin the version if you rely on it.

• #1871 dfefc4e Thanks @​mihkeleidast! - Use GITHUB_REPOSITORY as the default repo when no repo option is configured

• #1969 2c7c043 Thanks @​marcalexiei! - Add a named export that mirrors the current default export

  The default export is slated for removal in the next major release, so this ensures a smoother transition path.

Patch Changes

• #2040 88f2abb Thanks @​bluwy! - Improve type-check for options object

• #2160 162419d Thanks @​beeequeue! - Added or modified the files property in the manifest. This should not change any behavior.

• #1947 492b0ca Thanks @​bluwy! - Use parseEnv instead of dotenv to load the .env file and avoid loading them to process.env

• Updated dependencies [5b02e2f, 062530b, 88f2abb, dae394c, dae394c, df424a4, b5e1762, c19b112, 162419d, 4c26f2f, 96b65ee, 813bbf3, df424a4, a0b5326, 492b0ca]:

  • @​changesets/get-github-info@​1.0.0
  • @​changesets/types@​7.0.0

1.0.0-next.9

Patch Changes

• Updated dependencies [96b65ee]:
  • @​changesets/types@​7.0.0-next.9

1.0.0-next.8

Patch Changes

• Updated dependencies [b5e1762]:
  • @​changesets/types@​7.0.0-next.8

... (truncated)

Commits

• d7e4a2d Version Packages (#2266)
• f442221 Version Packages (#2235)
• baa658d Version Packages (next) (#2192)
• 1b9687f Add new docs site (#1979)
• 7fd0d91 Version Packages (next) (#2173)
• 180833e Version Packages (next) (#2142)
• 162419d add or modify files (#2160)
• c35c350 Version Packages (next) (#2122)
• 070f531 Add template option to changelog-github (#2059)
• dfefc4e Use GITHUB_REPOSITORY as the default repo when no repo option is configur...
• Additional commits viewable in compare view

Updates @changesets/cli from 2.31.0 to 3.0.2

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.2

Patch Changes

• #2270 a0a4dc6 Thanks @​bluwy! - Add review message on pre exit
• Updated dependencies [1f4eb61, 059f70a]:
  • @​changesets/apply-release-plan@​8.1.0
  • @​changesets/git@​4.0.1
  • @​changesets/read@​1.0.1

@​changesets/cli@​3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

@​changesets/cli@​3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

• #1961 07278a7 Thanks @​beeequeue! - CommitFunctions can now be both sync and async, and the defaultCommitFunctions are now sync.

• #1482 df424a4 Thanks @​Andarist! - From now on this package is going to be published as ES module.

... (truncated)

Changelog

Sourced from @​changesets/cli's changelog.

3.0.2

Patch Changes

• #2270 a0a4dc6 Thanks @​bluwy! - Add review message on pre exit
• Updated dependencies [1f4eb61, 059f70a]:
  • @​changesets/apply-release-plan@​8.1.0
  • @​changesets/git@​4.0.1
  • @​changesets/read@​1.0.1

3.0.1

Patch Changes

• #2239 fdfdc93 Thanks @​bluwy! - Update links in default generated .changeset/README.md file
• Updated dependencies [d0386b6]:
  • @​changesets/write@​1.0.1

3.0.0

Major Changes

• #2128 7113c01 Thanks @​Andarist! - Renamed the changeset tag command to changeset git-tag.

• #2074 3599e47 Thanks @​bluwy! - Set supported package manager versions in "engines" field, including npm >=10.9.0, pnpm >=10.0.0, and yarn >=4.5.2.

• #1860 92b1c1b Thanks @​mixelburg! - changeset version now exits with code 1 when there are no unreleased changesets, instead of silently exiting with code 0.

  This makes it easier to detect when a version step is a no-op — for example, to prevent accidentally publishing packages with incorrect version tags when using --snapshot mode.

• #1482 df424a4 Thanks @​Andarist! - Bumped supported Node versions to ^22.11 || ^24 || >=26

• #1994 062530b Thanks @​bluwy! - The prettier option in .changeset/config.json has been removed in favor of format. format supports "auto", "prettier", "oxfmt", "deno", and "dprint", and false disables formatting. If you previously used prettier: false, migrate to format: false or remove the option to use automatic formatter detection.

• #2190 96b65ee Thanks @​bluwy! - Move versioned prerelease changesets to .changeset/pre/ folder instead of accumulating in the root and tracking the versioned changeset ids in the .changeset/pre.json file. Existing pre.json will auto-migrate to this new structure on the next run of changeset version or when calling changeset status.

  This change allows easier management of versioned prerelease changesets (for the final stable release) and current queued changesets (for the next prerelease). Changesets in .changeset/pre/ can be edited or deleted depending if it's still relevant for the final stable release of a package. There's no need to synchronize the changeset ids in pre.json if certain changesets are deleted.

• #2145 f5887ff Thanks @​Andarist! - Removed Yarn Classic support

• #2097 8c88f6a Thanks @​Andarist! - Packages with only prerelease versions published will now be published with the prerelease tag in the prerelease mode if the target registry doesn't auto-assign latest tag. npm registry itself does that and such packages will continue to be released with latest tag (and not with the configured prerelease tag).

• #1879 c76b232 Thanks @​beeequeue! - Removed warning messages about using v1 configs. They will now be silently ignored.

• #1655 db46911 Thanks @​bluwy! - Update @manypkg/get-packages which drops support for detecting packages in Bolt monorepos and adds support for npm monorepos

• #1651 e1df862 Thanks @​bluwy! - Remove support for the --sinceMaster flag for changeset status. Use --since=master or --since=main instead.

• #2117 813bbf3 Thanks @​bluwy! - Remove the pre.json initialVersions property and handling as it's unused internally

... (truncated)

Commits

• d7e4a2d Version Packages (#2266)
• 68affee Upgrade to Vitest 5 (#2281)
• 5eeb012 Build(deps): Bump human-id in the production-dependencies group (#2279)
• a0a4dc6 Add review message on pre exit (#2270)
• 1f4eb61 Add default changelog message for empty release (#2265)
• 2eb65ba Add script to run unit and e2e tests separately (#2267)
• ff2b075 Build(deps-dev): Bump @​lydell/node-pty (#2254)
• 8eff462 Build(deps-dev): Bump the development-dependencies group across 1 directory w...
• bed4581 Version Packages (#2242)
• fdfdc93 Update default generated readme (#2239)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

• fix(server): prioritize zod issues and format them by @​mozmo15 in modelcontextprotocol/typescript-sdk#1503
• chore(ci): switch publish to OIDC trusted publishing by @​felixweinberger in modelcontextprotocol/typescript-sdk#1839
• Add end-to-end test suite by @​felixweinberger in modelcontextprotocol/typescript-sdk#2167
• v1 stdio buffer limit by @​KKonstantinov in modelcontextprotocol/typescript-sdk#2239
• fix: support Zod 3.25 method literals by @​mattzcarey in modelcontextprotocol/typescript-sdk#2368
• Validate Content-Type by parsed media type instead of substring match (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2444
• fix: send SSE keep-alive comment frames from Streamable HTTP server transport (v1.x) by @​mattzcarey in modelcontextprotocol/typescript-sdk#2538
• fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 by @​arimu1 in modelcontextprotocol/typescript-sdk#2549
• Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x) by @​felixweinberger in modelcontextprotocol/typescript-sdk#2547
• chore: bump version to 1.30.0 by @​felixweinberger in modelcontextprotocol/typescript-sdk#2563

New Contributors

• @​mozmo15 made their first contribution in modelcontextprotocol/typescript-sdk#1503
• @​arimu1 made their first contribution in modelcontextprotocol/typescript-sdk#2549

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits

• 2d889f2 chore: bump version to 1.30.0 (#2563)
• e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
• bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
• 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
• 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
• 369513d fix: support Zod 3.25 method literals (#2368)
• e7ee57c v1 stdio buffer limit (#2239)
• c36e1ef Add end-to-end test suite (#2167)
• bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
• 9edbab7 fix(server): prioritize zod issues and format them (#1503)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.

Updates @types/node from 26.1.1 to 26.5.1

Commits

• See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (Description has been truncated