chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates by dependabot[bot] · Pull Request #425 · knockout/tko

dependabot · 2026-09-07T12:17:28Z

Bumps the dev-dependencies group with 6 updates in the / directory:

Package	From	To
@biomejs/biome	`2.4.16`	`2.5.12`
esbuild	`0.28.0`	`0.28.2`
happy-dom	`20.10.1`	`20.14.0`
knip	`6.16.0`	`6.34.0`
playwright	`1.60.0`	`1.63.0`
sinon	`22.0.0`	`22.1.0`

Updates @biomejs/biome from 2.4.16 to 2.5.12

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.
<Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.
{x && <div>text</div>}
{cond && <a></a><b></b>}
#11440 b88f1ea Thanks @Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.
{cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}
#11440 b88f1ea Thanks @Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.
#11508 54f3a2e Thanks @dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:
Math.max(Math.max(a, b), c);
The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.12

Patch Changes
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.
<Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />
#11440 b88f1ea Thanks @Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.
{x && <div>text</div>}
{cond && <a></a><b></b>}
#11440 b88f1ea Thanks @Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.
#11440 b88f1ea Thanks @Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.
{cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}
#11440 b88f1ea Thanks @Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

#11440 b88f1ea Thanks @Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.
#11508 54f3a2e Thanks @dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:
Math.max(Math.max(a, b), c);
The fix flattens this expression to Math.max(a, b, c).
#11585 c5c8315 Thanks @Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

0a31d7c ci: release (#11530)
a20f44a feat: noBunModules (#11597)
1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
f4e5ebb feat(lint): add useModernMathApis (#11581)
54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
2d55931 feat(js_analyze): added a React naming convention rule (#11554)
ee69e0e fix(schema): domains (#11565)
f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
Additional commits viewable in compare view

Updates esbuild from 0.28.0 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
  let x
  bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
  & .b:not(& .c) {
    color: red;
  }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
  let x

... (truncated)

Commits

609683d publish 0.28.2 to npm
11b1fe4 add to release notes
ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
04627b6 fix #4498: async TLA checks need a worklist
5c15177 disable gopls in the go folder
fc2ee9b css: adjust parser to allow --foo: {...}
209db54 release notes for css nesting bugfix
c625d31 fix #4497: preserve nested ampersands during minification (#4500)
34474e2 better isolation of current part in js parser
07f6e8c fix #4507: import assignment tree-shaking bug
Additional commits viewable in compare view

Updates happy-dom from 20.10.1 to 20.14.0

Release notes

Sourced from happy-dom's releases.

v20.14.0

🎨 Features

Improves computed style cache - By @capricorn86 in task #2357

v20.13.2

👷‍♂️ Patch fixes

Fix problem with getComputedStyle with :host and :host-context selectors - By @capricorn86 in task #2349

v20.13.1

👷‍♂️ Patch fixes

GetComputedStyle should return inherited value when it is set to inherit - By @capricorn86 in task #2347

v20.13.0

🎨 Features

Adds support for :host psuedo query selector - By @capricorn86 in task #2345

v20.12.2

👷‍♂️ Patch fixes

Custom elements should be upgraded when connected to DOM - By @capricorn86 in task #2342

v20.12.1

🎨 Features

Adds support for kebab-case properties on CSSStyleDeclaration - By @capricorn86 in task #2256

Adds support for all Chromium CSS properties to CSSStyleDeclaration - By @capricorn86 in task #2256

Downloads a list from the Chromium project when compiling

👷‍♂️ Patch fixes

Fixes issue with parsing CSS fallback variables - By @capricorn86 in task #2256

v20.12.0

🎨 Features

Adds support for Animation, AnimationTimeline, DocumentTimeline and KeyframeEffect - By @capricorn86

Adds support for Element.animate() - By @capricorn86

v20.11.15

👷‍♂️ Patch fixes

Fixes issue with upgrading custom element caused by previous release - By @capricorn86 in task #2331

v20.11.14

👷‍♂️ Patch fixes

Change prototype of element to the custom element when upgraded to keep the reference - By @capricorn86 in task #2331

The previous solution replaced the element with the custom element and copied it's properties, but this made any reference to the original element invalid

v20.11.13

👷‍♂️ Patch fixes

Copy event listeners when upgrading a custom element - By @capricorn86 in task #2329

v20.11.12

👷‍♂️ Patch fixes

Add check for if the node is still a parent during disconnect - By @capricorn86 in task #2322

... (truncated)

Commits

eac5a38 feat: #2357 Improves computed style cache (#2358)
5b3559b fix: #2349 Fix problem with getComputedStyle with :host and :host-context s...
f33da73 fix: #2347 getComputedStyle should return inherited value when it is set to...
68b9806 feat: #2345 Adds support for :host psuedo query selector (#2346)
9300a9f fix: #2342 Custom elements should be upgraded when connected to DOM (#2343)
103ccde fix: #2256 Fixes issue when parsing CSS fallback variables (#2341)
4b0af0c feat: Adds support for Element.animate (#2335)
e1a8af5 fix: #2331 Fixes issue with upgrading custom element caused by previous rel...
096317b fix: #2331 Change prototype of element to the custom element when upgraded ...
9ff4b47 fix: #2329 Copy event listeners when upgrading a custom element (#2330)
Additional commits viewable in compare view

Updates knip from 6.16.0 to 6.34.0

Release notes

Sourced from knip's releases.

Release 6.34.0

fix: report types used only in private parameters (resolve #1950) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)

💡 Add support for node:fs/promises glob (#1977) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks @DreamLongYT!

Respect JSDoc tags on URL dependencies (resolve #1943) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)

Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)

Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)

Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)

fix(cli): validate numeric options instead of passing NaN through (#1975) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks @devYRPauli!

fix: compile files with workspace-scoped compilers (#1997) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks @gioboa!

Resolve Nuxt #shared imports from the shared directory (#1991) (cc470611042b01761491c21f6987549db4c11df8) - thanks @DreamLongYT!

Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)

Declare webpack directly instead of through @types/webpack (96ff2df58dd1d229d077212e1cd80f10889650ca)

Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)

Release 6.33.0

Support package manifest resolution under Yarn PnP (#1946) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks @WooWan!

Resolve oxlint jsPlugins from .oxlintrc.jsonc (#1973) (d055023182789555a574eaefde80dac997190437) - thanks @DreierF!

Update dependency bun to v1.4.0 (#1964) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks @renovate[bot]!

Expose defineConfig on a ./config entrypoint (#1960) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks @theRizwan!

Preserve all environment variables in exec.ts (#1979) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks @DreamLongYT!

Add support for TypeScript content mappers (#1978) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks @remcohaszing!

fix(vitest): resolve array entries and root-relative setup dependencies (#1982) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks @DreamLongYT!

Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)

Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)

Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)

Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)

Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)

Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)

Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)

Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)

Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)

fix(webpack): resolve entry descriptors using import field (#1981) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks @DreamLongYT!

fix: count enum element access as a whole-object read (#1958) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks @addielaruee!

Resolve oxlint/vite-plus import resolvers from settings (#1983) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks @DreierF!

fix(nuxt): resolve string extends configs (#1984) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks @DreamLongYT!

Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)

Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)

Resolve Object.* enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)

Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)

Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)

Resolve nuxt layer sources from all extends entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)

Report unused exports behind Vitest module promise mocks (resolve #1966) (74954c219367ca1577184cca08c30dbb3fb6222e)

Check line endings against .gitattributes in pnpm run ci (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)

Release 6.32.3

Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)

Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)

Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)

fix(tsup): match config files with .cts and .mts extensions (#1938) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks @codeAnqiang-ma!

fix(lefthook): match all config file names and extensions (#1940) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks @codeAnqiang-ma!

... (truncated)

Commits

4ffebb7 Release knip@6.34.0
f0cf11d Assert counters in targeted regression tests
96ff2df Declare webpack directly instead of through @types/webpack
c4e0f08 Update dependencies
cc47061 Resolve Nuxt #shared imports from the shared directory (#1991)
462ae45 fix: compile files with workspace-scoped compilers (#1997)
ab90e24 fix(cli): validate numeric options instead of passing NaN through (#1975)
964085d Set an explicit Bun test timeout
1c90b49 Make prop access consistent while at it
f93ad09 Respect JSDoc tags on URL dependencies (resolve #1943)
Additional commits viewable in compare view

Updates playwright from 1.60.0 to 1.63.0

Release notes

Sourced from playwright's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:
test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});
A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:
// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();
The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:
await page.locator('button').visible().click();
🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:
await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });
Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

1b025d7 chore: mark v1.63.0 (#42569)
0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
13dbf10 cherry-pick(#42552): docs: release notes for v1.63
e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
2b7a5f2 test: response.body() for content-encoding:identity (#42537)
648a67c fix(mcp): create parent directories for explicitly named files (#42540)
7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
52900a1 devops: restore npm publishing from GitHub Actions (#42550)
8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
Additional commits viewable in compare view

Updates sinon from 22.0.0 to 22.1.0

Changelog

Sourced from sinon's changelog.

22.1.0

d36e921b fix: let returns override returnsArg (王胜)

Signed-off-by: 王胜 2318857637@qq.com

40c4caa0 fix: align restoreObject docs test with idempotent behavior (#2745) (Julia Miller)

restoreObject was made idempotent in #2737 — it no longer throws for objects with no restorable methods. Updates the docs page and its corresponding test to reflect this.

a68dac19 fix: throw a clear error when throwArg index equals the argument count (#2743) (spokodev)

fix: throw a clear error when throwArg index equals the argument count

spyCall.throwArg(pos) guarded with pos > this.args.length, so calling it with pos equal to the number of recorded arguments slipped past the guard and reached throw this.args[pos], throwing undefined instead of the intended TypeError. A thrown undefined cannot be inspected as an Error and is reported by test frameworks as no exception thrown.

Use >= to match ensureArgs in behavior.js and the sibling callArg helpers, which already reject an out-of-range index with a clear error.

9ea504e3 feat: make sinon.restoreObject idempotent (#2737) (Ilia Choly)

Passing an object with no live fakes to restoreObject now restores nothing instead of throwing, giving it symmetry with sinon.restore() and sandbox.restore(). The strict "found no methods" check is retained for spy(object) and stub(object), which now use a dedicated walkObjectStrict export, while restoreObject uses the loose walkObject. Passing a falsy value still throws.

Fixes #2736

4db4feff fix: preserve fake undefined argument validation (Vishal Kumar Singh)

755a40d7 fix: isolate callId counter per sandbox for parallel test support (Vishal Kumar Singh)

The global callId counter in proxy-invoke.js caused calledImmediatelyBefore and calledImmediatelyAfter to fail when tests run in parallel with separate sandboxes. Each sandbox now maintains its own callId counter, passed through the spy/stub/fake creation chain via a context object.

Fixes #2472

Released by Morgan Roderick on 2026-07-20.

Commits

ab289e9 22.1.0
bb3b75a chore: remove Jekyll steps from version hook
bb38f25 chore: run docs tests in preversion hook
d36e921 fix: let returns override returnsArg
11db213 ci: run docs tests on every PR (#2746)
40c4caa fix: align restoreObject docs test with idempotent behavior (#2745)
5ccb7fd build(deps): bump the action-deps group with 4 updates (#2744)
a68dac1 fix: throw a clear error when throwArg index equals the argument count (#2743)
9ea504e feat: make sinon.restoreObject idempotent (#2737)
cf5d9e8 fix: remove dead link and exclude code example URLs from link check
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ith 6 updates Bumps the dev-dependencies group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.16` | `2.5.12` | | [esbuild](https://github.com/evanw/esbuild) | `0.28.0` | `0.28.2` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.10.1` | `20.14.0` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.16.0` | `6.34.0` | | [playwright](https://github.com/microsoft/playwright) | `1.60.0` | `1.63.0` | | [sinon](https://github.com/sinonjs/sinon) | `22.0.0` | `22.1.0` | Updates `@biomejs/biome` from 2.4.16 to 2.5.12 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.12/packages/@biomejs/biome) Updates `esbuild` from 0.28.0 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.0...v0.28.2) Updates `happy-dom` from 20.10.1 to 20.14.0 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.10.1...v20.14.0) Updates `knip` from 6.16.0 to 6.34.0 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.34.0/packages/knip) Updates `playwright` from 1.60.0 to 1.63.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.60.0...v1.63.0) Updates `sinon` from 22.0.0 to 22.1.0 - [Release notes](https://github.com/sinonjs/sinon/releases) - [Changelog](https://github.com/sinonjs/sinon/blob/main/CHANGES.md) - [Commits](sinonjs/sinon@v22.0.0...v22.1.0) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.12 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: happy-dom dependency-version: 20.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: knip dependency-version: 6.34.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: playwright dependency-version: 1.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: sinon dependency-version: 22.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 7, 2026

Navigation Menu

Uh oh!

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates - #425

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates#425
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/dev-dependencies-6460e4b0a4

dependabot Bot commented on behalf of github Sep 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 7, 2026

Biome CLI v2.5.12

2.5.12

Patch Changes

2.5.12

Patch Changes

v0.28.2

0.28.2

v20.14.0

🎨 Features

v20.13.2

👷‍♂️ Patch fixes

v20.13.1

👷‍♂️ Patch fixes

v20.13.0

🎨 Features

v20.12.2

👷‍♂️ Patch fixes

v20.12.1

🎨 Features

👷‍♂️ Patch fixes

v20.12.0

🎨 Features

v20.11.15

👷‍♂️ Patch fixes

v20.11.14

👷‍♂️ Patch fixes

v20.11.13

👷‍♂️ Patch fixes

v20.11.12

👷‍♂️ Patch fixes

Release 6.34.0

Release 6.33.0

Release 6.32.3

v1.63.0

🔒 Test locks

🪟 Locate across frames

👁️ Visible-only locators

🧾 Step params and subtitles

22.1.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants