Skip to content

chore: bump the picker group in /app with 8 updates - #78

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/picker-8977fb568a
Closed

chore: bump the picker group in /app with 8 updates#78
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/app/picker-8977fb568a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the picker group in /app with 8 updates:

Package From To
react 19.3.0 19.3.1
react-dom 19.3.0 19.3.1
@biomejs/biome 2.5.14 2.6.3
@stryker-mutator/core 10.0.0 10.1.1
@stryker-mutator/vitest-runner 10.0.0 10.1.1
@testing-library/user-event 14.6.7 14.6.8
@vitejs/plugin-react 6.1.1 6.1.2
jsdom 30.1.1 30.1.3

Updates react from 19.3.0 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates react-dom from 19.3.0 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Commits

Updates @biomejs/biome from 2.5.14 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

  • #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

    const minimum = array.toSorted((a, b) => a - b)[0];

  • #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

  • #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

    for (const name of users.map((user) => user.name)) {
  console.log(name);
}

  • #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

  • #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

    <table bgcolor="#ffffff" cellpadding="5"></table>

  • #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

    const fullPath = __dirname + "/foo.js"; // reported

  • #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

    await page.locator("button").first().click();

  • #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

    @layer components {
  @layer components {
    .button {
      color: red;
    }

... (truncated)

Commits

Updates @stryker-mutator/core from 10.0.0 to 10.1.1

Release notes

Sourced from @​stryker-mutator/core's releases.

v10.1.1

10.1.1 (2026-10-23)

Due to the below provenance issue in the release process, this is a re-release of v10.1.0.

For more information on the provenance issue, see: sigstore/sigstore-js#1708 and npm/cli#10078

v10.1.0

10.1.0 (2026-10-23)

Bug Fixes

  • core: prevent test runners racing to populate shared caches on startup (#6251) (c931a93), closes #6250
  • instrumenter: crash when mutating ts non null expression in babel >= 8 (#6221) (e873a24), closes #6185
  • vitest-runner: do not select tests whose name only starts with a filtered name (#6246) (6ad4adb)
  • vitest-runner: report mutant collection failures instead of surviving mutants (#6269) (cf5695e)

Features

Changelog

Sourced from @​stryker-mutator/core's changelog.

10.1.1 (2026-10-23)

Note: Version bump only for package @​stryker-mutator/core

10.1.0 (2026-10-23)

Bug Fixes

  • core: prevent test runners racing to populate shared caches on startup (#6251) (c931a93), closes #6250

Features

Commits
  • 9591277 v10.1.1
  • d6148ff v10.1.0
  • c931a93 fix(core): prevent test runners racing to populate shared caches on startup (...
  • 7284a4a feat(core): report mutant duration in the mutation report (#6252)
  • 8419413 chore(deps): update dependency prettier to v3.9.4 (#6089)
  • aa7f3bb feat(core): cli option for command runner (#6006)
  • 201dce8 feat: add opt-in mutation-phase test timing diagnostics with sidecar reporter...
  • 61c7a59 chore(deps): update dependency @​types/semver to v7.8.0 (#6165)
  • See full diff in compare view

Updates @stryker-mutator/vitest-runner from 10.0.0 to 10.1.1

Release notes

Sourced from @​stryker-mutator/vitest-runner's releases.

v10.1.1

10.1.1 (2026-10-23)

Due to the below provenance issue in the release process, this is a re-release of v10.1.0.

For more information on the provenance issue, see: sigstore/sigstore-js#1708 and npm/cli#10078

v10.1.0

10.1.0 (2026-10-23)

Bug Fixes

  • core: prevent test runners racing to populate shared caches on startup (#6251) (c931a93), closes #6250
  • instrumenter: crash when mutating ts non null expression in babel >= 8 (#6221) (e873a24), closes #6185
  • vitest-runner: do not select tests whose name only starts with a filtered name (#6246) (6ad4adb)
  • vitest-runner: report mutant collection failures instead of surviving mutants (#6269) (cf5695e)

Features

Changelog

Sourced from @​stryker-mutator/vitest-runner's changelog.

10.1.1 (2026-10-23)

Note: Version bump only for package @​stryker-mutator/vitest-runner

10.1.0 (2026-10-23)

Bug Fixes

  • vitest-runner: do not select tests whose name only starts with a filtered name (#6246) (6ad4adb)
  • vitest-runner: report mutant collection failures instead of surviving mutants (#6269) (cf5695e)

Features

Commits
  • 9591277 v10.1.1
  • d6148ff v10.1.0
  • cf5695e fix(vitest-runner): report mutant collection failures instead of surviving mu...
  • 3073ea2 feat(vitest-runner): support vitest pool options (#6268)
  • 6ad4adb fix(vitest-runner): do not select tests whose name only starts with a filtere...
  • 10e2cca feat(vitest-runner): support vitest v5 (#6214)
  • 7284a4a feat(core): report mutant duration in the mutation report (#6252)
  • d763db3 chore(deps): update dependency vite to v8.3.2 (#6091)
  • 8419413 chore(deps): update dependency prettier to v3.9.4 (#6089)
  • 201dce8 feat: add opt-in mutation-phase test timing diagnostics with sidecar reporter...
  • Additional commits viewable in compare view

Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

  • treat programmatic null input values as empty string (#1329) (1951eb7)
Commits

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

Updates jsdom from 30.1.1 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

  • Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
  • Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
  • Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
  • Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
  • Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
  • Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
  • Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
  • Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
  • Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
  • Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
  • Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
  • Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
  • Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
  • Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

v30.1.2

  • Updated URLs to support Unicode v18.0.0 in internationalized domain names.
  • Reduced package size and memory use for CSS property definitions. (@​scttcper)
  • Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
  • Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
  • Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
  • Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
  • Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
  • Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
  • Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
  • Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
  • Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
  • Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
  • Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)
Commits
  • 058c0f5 30.1.3
  • fcd1fd1 Cascade parsed longhands independently
  • a3ee786 Cascade computed style properties on demand
  • f42dc15 Resolve colors before caching or using currentcolor
  • 074b1fb Compute background-position lengths against the final font size
  • d19598c Apply style rules nested in multiple @​media rules
  • 45d626c Rule out attribute selector subjects before matching
  • 3ff0a5b Upgrade Undici and remove abort workarounds
  • 8813bb1 Ignore CSS declarations with unparseable math functions
  • 63712d8 Fix XHR credentials across redirects
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore: bump the picker group in /app with 8 updates
6ef01ec 
Bumps the picker group in /app with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.14` | `2.6.3` |
| [@stryker-mutator/core](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/core) | `10.0.0` | `10.1.1` |
| [@stryker-mutator/vitest-runner](https://github.com/stryker-mutator/stryker-js/tree/HEAD/packages/vitest-runner) | `10.0.0` | `10.1.1` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.7` | `14.6.8` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.1` | `6.1.2` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.3` |


Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `@biomejs/biome` from 2.5.14 to 2.6.3
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.3/packages/@biomejs/biome)

Updates `@stryker-mutator/core` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/core/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/core)

Updates `@stryker-mutator/vitest-runner` from 10.0.0 to 10.1.1
- [Release notes](https://github.com/stryker-mutator/stryker-js/releases)
- [Changelog](https://github.com/stryker-mutator/stryker-js/blob/master/packages/vitest-runner/CHANGELOG.md)
- [Commits](https://github.com/stryker-mutator/stryker-js/commits/v10.1.1/packages/vitest-runner)

Updates `@testing-library/user-event` from 14.6.7 to 14.6.8
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.7...v14.6.8)

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react)

Updates `jsdom` from 30.1.1 to 30.1.3
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.1...v30.1.3)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: picker
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: picker
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: picker
- dependency-name: "@stryker-mutator/core"
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: picker
- dependency-name: "@stryker-mutator/vitest-runner"
  dependency-version: 10.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: picker
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: picker
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: picker
- dependency-name: jsdom
  dependency-version: 30.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: picker
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@rgdevment rgdevment mentioned this pull request Nov 2, 2026
Merged
rgdevment added a commit that referenced this pull request Nov 2, 2026
@rgdevment
chore(deps): Dependabot's Rust, npm and Actions updates land together. (
4945100 
#82)

Lands the five open Dependabot PRs as one change, so they merge and get
tested together.

## What changed

- **Rust (#81):** `global-hotkey` 0.8 → 0.9 (major). It builds with no
change to `crates/linkunbound-shell/src/hotkey.rs`.
- **Rust (#80):** `interprocess` 2.4.7, `serde_json` 1.0.154, `psl`
2.1.245, `libc` 0.2.191, `objc2` 0.6.5, `tauri-winres` 0.3.7. These are
the same versions Dependabot proposed, pinned with `cargo update
--precise`.
- **Actions (#79):** `rust-cache`, `setup-node`, `install-action`,
`upload-artifact`, `download-artifact` and `setup-uv`, each pinned to
its new SHA.
- **Picker npm (#78):** react / react-dom 19.3.1, Biome 2.6.3, Stryker
10.1.1, user-event 14.6.8, plugin-react 6.1.2, jsdom 30.1.3.
- **Tooling npm (#77):** `js-yaml` 5.5.0.
- **Notices:** regenerated `THIRD-PARTY-BUNDLED.md` and
`THIRD-PARTY-LICENSES.md` with `npm run notices`, so the rules check
matches the lockfiles.

## Added on top

- **`minimatch` override (^11.0.4), scoped to `@stryker-mutator/core`.**
Stryker pins minimatch 10, which is hit by GHSA-g3hv-75wg-m249
(moderate). The `npm audit` step for the picker would fail on `main`
too. This follows the existing scoped `qs` override.
- **`app/biome.json` migrated with `biome migrate`.** The schema moves
to 2.6.3, and `"recommended": true` becomes `"preset": "recommended"`.
Without this, Biome 2.6 warns that the schema doesn't match.

## Checked locally (Windows)

- `cargo clippy --workspace --all-targets`: no warnings.
- `cargo check -p` passes for each crate on its own.
- `cargo nextest`: 457 passed.
- `cargo fmt --check`: clean.
- Picker: `npm run lint`, `npm run build`, 203 vitest tests.
- `npm audit --audit-level=moderate` is clean in `app` and at the root.
- `npm run lint:md` is clean.
- `npm run notices` leaves no diff.

## For the reviewer

- **The global shortcut was not tried by hand.** `global-hotkey` is a
major bump, so it's worth one manual press to see it still opens the
picker.
- **`stryker run --dryRunOnly` fails locally, the same way on `main`.**
`src/markdown.test.ts` imports `../../THIRD-PARTY-*.md`, which sits
outside Stryker's sandbox. It happens with minimatch 10 as well, so this
branch doesn't cause it. This PR doesn't touch `app/src`, so the mutants
job won't run it here.

Supersedes #77, #78, #79, #80 and #81. Dependabot closes them on its own
once these versions are on `main`.
@dependabot @github

dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Nov 2, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/app/picker-8977fb568a branch November 2, 2026 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants