Skip to content

fix(deps): update npm non-major dependencies#4677

Merged
Barsnes merged 4 commits intomainfrom
renovate/npm-minor-patch
Mar 31, 2026
Merged

fix(deps): update npm non-major dependencies#4677
Barsnes merged 4 commits intomainfrom
renovate/npm-minor-patch

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 30, 2026

This PR contains the following updates:

Package Change Age Confidence Type Update
@biomejs/biome (source) 2.4.8 → 2.4.9 age confidence devDependencies patch
@react-router/dev (source) ^7.13.1 → ^7.13.2 age confidence devDependencies patch
@react-router/express (source) ^7.13.1 → ^7.13.2 age confidence dependencies patch
@react-router/node (source) ^7.13.1 → ^7.13.2 age confidence dependencies patch
@storybook/addon-a11y (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
@storybook/addon-docs (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
@storybook/addon-themes (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
@storybook/addon-vitest (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
@storybook/react-vite (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
@vitest/browser (source) 4.1.0 → 4.1.2 age confidence devDependencies patch
@vitest/browser-playwright (source) 4.1.0 → 4.1.2 age confidence devDependencies patch
@vitest/coverage-v8 (source) 4.1.0 → 4.1.2 age confidence devDependencies patch
i18next (source) ^25.10.5 → ^25.10.10 age confidence dependencies patch
node (source) >=20.20.1 → >=20.20.2 age confidence engines patch
node (source) >=24.14.0 → >=24.14.1 age confidence engines patch
pnpm (source) 10.32.1+sha512.a706938f0e89ac1456b6563eab4edf1d1faf3368d1191fc5c59790e96dc918e4456ab2e67d613de1043d2e8c81f87303e6b40d4ffeca9df15ef1ad567348f2be → 10.33.0 age confidence packageManager minor
pnpm (source) 10.32.1 → 10.33.0 age confidence packageManager minor
react-i18next ^16.6.2 → ^16.6.6 age confidence dependencies patch
react-router (source) ^7.13.1 → ^7.13.2 age confidence dependencies patch
storybook (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
storybook-addon-pseudo-states (source) ^10.3.2 → ^10.3.3 age confidence devDependencies patch
vitest (source) 4.1.0 → 4.1.2 age confidence devDependencies patch

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

biomejs/biome (@​biomejs/biome)

v2.4.9

Compare Source

Patch Changes

  • #​9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

    For example, the following snippet triggers the rule because the second selector and the first selector are the same:

    /* First selector */
.x .y .z {
}

/* Second selector */
.x {
  .y {
    .z {
    }
  }
}

  • #​9567 b7ab931 Thanks @​ematipico! - Fixed #​7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

    !foo || !foo.bar;

  • #​8670 607ebf9 Thanks @​tt-a1i! - Fixed #​8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

    class Kek {
  static kek(): number {
    return 0;
  }
  another(): string {
    return "";
  }
  kek(): number {
    return 1;
  } // no longer reported as non-adjacent
}

  • #​9476 97b80a8 Thanks @​masterkain! - Fixed #9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

  • #​9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

    For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.

  • #​9586 4cafb71 Thanks @​dyc3! - Fixed #​8828: Grit patterns using export { $foo } from $source now match named re-exports in JavaScript and TypeScript files.

  • #​9550 d4e3d6e Thanks @​dyc3! - Fixed #​9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.

  • #​8696 a7c19cc Thanks @​Faizanq! - Fixed #​8685 where noUselessLoneBlockStatements would remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.

  • #​9557 6671ac5 Thanks @​datalek! - Fixed #​9557: Biome's LSP server no longer crashes on startup when used with editors that don't send workspaceFolders during initialization. This affected any LSP client that only sends rootUri, which is valid per the LSP specification.

  • #​9455 1710cf1 Thanks @​omar-y-abdi! - Fixed #​9174: useExpect now correctly rejects asymmetric matchers in Vitest or Jest like expect.stringContaining(), expect.objectContaining(), and utilities like expect.extend() that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.

  • #​9584 956e367 Thanks @​ematipico! - Fixed a bug where Vue directive attribute values like v-bind:class="{'dynamic': true}" were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like :class, v-if, and v-html are now correctly parsed as expressions, preventing spurious parse errors.

  • #​9474 e168494 Thanks @​ematipico! - Added the new nursery rule noUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.

    The rule has the following options:

    • allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.
    • deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.
      When both deny and allow are provided, deny takes precedence.
    • requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.
    • requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.

  • #​9544 723798b Thanks @​ViniciusDev26! - Added an unsafe fix to useConsistentMethodSignatures that automatically converts between method-style and property-style signatures.

  • #​9555 8a3647b Thanks @​ematipico! - Fixed #188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.

  • #​9605 f65c637 Thanks @​ematipico! - Fixed #​9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:

    <style is:global define:vars={{ bgLight: light }}>
<Component name={{ first, name }} />

  • #​9565 ccb249e Thanks @​eyupcanakman! - Fixed #​9505: noUselessStringConcat no longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with + is not equivalent to a single template literal.

  • #​9534 4d050df Thanks @​Netail! - Added the nursery rule noInlineStyles. The rule disallows the use of inline style attributes in HTML and the style prop in JSX, including React.createElement calls. Inline styles make code harder to maintain and can interfere with Content Security Policy.

  • #​9611 cddaa44 Thanks @​gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent through workspace/didChangeConfiguration when the payload was wrapped in a top-level biome key. This caused requireConfiguration and related settings to be ignored in some editors.

remix-run/react-router (@​react-router/dev)

v7.13.2

Compare Source

Patch Changes

  • Fix react-router dev crash when Unix socket files exist in the project root (#​14854)

  • Escape redirect locations in prerendered redirect HTML (#​14880)

  • Add future.unstable_passThroughRequests flag (#​14775)

    By default, React Router normalizes the request.url passed to your loader, action, and middleware functions by removing React Router's internal implementation details (.data suffixes, index + _routes query params).

    Enabling this flag removes that normalization and passes the raw HTTP request instance to your handlers. This provides a few benefits:

    • Reduces server-side overhead by eliminating multiple new Request() calls on the critical path
    • Allows you to distinguish document from data requests in your handlers base don the presence of a .data suffix (useful for observability purposes)

    If you were previously relying on the normalization of request.url, you can switch to use the new sibling unstable_url parameter which contains a URL instance representing the normalized location:

    // ❌ Before: you could assume there was no `.data` suffix in `request.url`
export async function loader({ request }: Route.LoaderArgs) {
  let url = new URL(request.url);
  if (url.pathname === "/path") {
    // This check will fail with the flag enabled because the `.data` suffix will
    // exist on data requests
  }
}

// ✅ After: use `unstable_url` for normalized routing logic and `request.url`
// for raw routing logic
export async function loader({ request, unstable_url }: Route.LoaderArgs) {
  if (unstable_url.pathname === "/path") {
    // This will always have the `.data` suffix stripped
  }

  // And now you can distinguish between document versus data requests
  let isDataRequest = new URL(request.url).pathname.endsWith(".data");
}

  • Add a new unstable_url: URL parameter to route handler methods (loader, action, middleware, etc.) representing the normalized URL the application is navigating to or fetching, with React Router implementation details removed (.datasuffix, index/_routes query params) (#​14775)

    This is being added alongside the new future.unstable_passthroughRequests future flag so that users still have a way to access the normalized URL when that flag is enabled and non-normalized request's are being passed to your handlers. When adopting this flag, you will only need to start leveraging this new parameter if you are relying on the normalization of request.url in your application code.

    If you don't have the flag enabled, then unstable_url will match request.url.

  • Updated dependencies:

    • react-router@7.13.2
    • @react-router/node@7.13.2
    • @react-router/serve@7.13.2
remix-run/react-router (@​react-router/express)

v7.13.2

Compare Source

Patch Changes
  • Updated dependencies:
    • react-router@7.13.2
    • @react-router/node@7.13.2
remix-run/react-router (@​react-router/node)

v7.13.2

Compare Source

Patch Changes
  • Updated dependencies:
    • react-router@7.13.2
vitest-dev/vitest (@​vitest/browser)

v4.1.2

Compare Source

This release bumps Vitest's flatted version and removes version pinning to resolve flatted's CVE related issues (#​9975).

   🐞 Bug Fixes
    View changes on GitHub

v4.1.1

Compare Source

   🚀 Features
   🐞 Bug Fixes
    View changes on GitHub
i18next/i18next (i18next)

v25.10.10

Compare Source

  • feat: suppress support notice automatically in production environments (NODE_ENV=production)
nodejs/node (node)

v20.20.2: 2026-03-24, Version 20.20.2 'Iron' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes
  • (CVE-2026-21717) fix array index hash collision (Joyee Cheung)
  • (CVE-2026-21713) use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan)
  • (CVE-2026-21710) use null prototype for headersDistinct/trailersDistinct (Matteo Collina)
  • (CVE-2026-21716) include permission check on lib/fs/promises (RafaelGSS)pull/795>
  • (CVE-2026-21715) add permission check to realpath.native (RafaelGSS)
  • (CVE-2026-21714) handle NGHTTP2_ERR_FLOW_CONTROL error code (RafaelGSS)
  • (CVE-2026-21637) wrap SNICallback invocation in try/catch (Matteo Collina)
Commits
pnpm/pnpm (pnpm)

v10.33.0

Compare Source

remix-run/react-router (react-router)

v7.13.2

Compare Source

Patch Changes

  • Fix clientLoader.hydrate when an ancestor route is also hydrating a clientLoader (#​14835)

  • Fix type error when passing Framework Mode route components using Route.ComponentProps to createRoutesStub (#​14892)

  • Fix percent encoding in relative path navigation (#​14786)

  • Add future.unstable_passThroughRequests flag (#​14775)

    By default, React Router normalizes the request.url passed to your loader, action, and middleware functions by removing React Router's internal implementation details (.data suffixes, index + _routes query params).

    Enabling this flag removes that normalization and passes the raw HTTP request instance to your handlers. This provides a few benefits:

    • Reduces server-side overhead by eliminating multiple new Request() calls on the critical path
    • Allows you to distinguish document from data requests in your handlers base don the presence of a .data suffix (useful for observability purposes)

    If you were previously relying on the normalization of request.url, you can switch to use the new sibling unstable_url parameter which contains a URL instance representing the normalized location:

    // ❌ Before: you could assume there was no `.data` suffix in `request.url`
export async function loader({ request }: Route.LoaderArgs) {
  let url = new URL(request.url);
  if (url.pathname === "/path") {
    // This check will fail with the flag enabled because the `.data` suffix will
    // exist on data requests
  }
}

// ✅ After: use `unstable_url` for normalized routing logic and `request.url`
// for raw routing logic
export async function loader({ request, unstable_url }: Route.LoaderArgs) {
  if (unstable_url.pathname === "/path") {
    // This will always have the `.data` suffix stripped
  }

  // And now you can distinguish between document versus data requests
  let isDataRequest = new URL(request.url).pathname.endsWith(".data");
}

  • Internal refactor to consolidate framework-agnostic/React-specific route type layers - no public API changes (#​14765)

  • Sync protocol validation to rsc flows (#​14882)

  • Add a new unstable_url: URL parameter to route handler methods (loader, action, middleware, etc.) representing the normalized URL the application is navigating to or fetching, with React Router implementation details removed (.datasuffix, index/_routes query params) (#​14775)

    This is being added alongside the new future.unstable_passthroughRequests future flag so that users still have a way to access the normalized URL when that flag is enabled and non-normalized request's are being passed to your handlers. When adopting this flag, you will only need to start leveraging this new parameter if you are relying on the normalization of request.url in your application code.

    If you don't have the flag enabled, then unstable_url will match request.url.

Configuration

📅 Schedule: Branch creation - "before 07:00 on Thursday" in timezone Europe/Oslo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 30, 2026 •
edited
Loading

🦋 Changeset detected

Latest commit: 06cbf76

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages
Name Type
@digdir/designsystemet Patch
@digdir/designsystemet-react Patch
@digdir/designsystemet-web Patch
@digdir/designsystemet-css Patch
@digdir/designsystemet-types Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 30, 2026 •
edited
Loading

Preview deployments for this pull request:

storybook - 31. Mar 2026 - 08:58

themebuilder - 31. Mar 2026 - 08:59

www - 31. Mar 2026 - 09:05

@renovate renovate bot force-pushed the renovate/npm-minor-patch branch from e926482 to f5a7bf0 Compare March 30, 2026 07:17
@renovate
Copy link
Copy Markdown
Contributor Author

renovate bot commented Mar 30, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Barsnes
Barsnes approved these changes Mar 31, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@Barsnes Barsnes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good to me

@Barsnes Barsnes merged commit 381a51d into main Mar 31, 2026
25 of 27 checks passed
@Barsnes Barsnes deleted the renovate/npm-minor-patch branch March 31, 2026 07:37
@github-actions github-actions bot mentioned this pull request Mar 31, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mimarz mimarz mimarz approved these changes

@Barsnes Barsnes Barsnes approved these changes

@eirikbacker eirikbacker Awaiting requested review from eirikbacker eirikbacker is a code owner

@oddvernes oddvernes Awaiting requested review from oddvernes oddvernes is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mimarz @Barsnes