You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by "dependabot[bot] (via GitHub)" <gi...@apache.org> on 2026/08/20 19:26:24 UTC
[PR] chore(deps): bump the minor-and-patch group across 1 directory with 18 updates [maka]
dependabot[bot] opened a new pull request, #3360:
URL: https://github.com/apache/maka/pull/3360
Bumps the minor-and-patch group with 17 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [@astryxdesign/cli](https://github.com/facebook/astryx/tree/HEAD/packages/cli) | `0.4.0` | `0.4.3` |
| [@astryxdesign/core](https://github.com/facebook/astryx/tree/HEAD/packages/core) | `0.4.0` | `0.4.3` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.6` | `2.5.8` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.2` | `26.2.0` |
| [dugite](https://github.com/desktop/dugite) | `3.2.2` | `3.2.3` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.26.0` | `6.32.2` |
| [@ai-sdk/openai-compatible](https://github.com/vercel/ai/tree/HEAD/packages/openai-compatible) | `3.0.30` | `3.0.31` |
| [@larksuiteoapi/node-sdk](https://github.com/larksuite/node-sdk) | `1.72.0` | `1.73.0` |
| [@openai/agents-core](https://github.com/openai/openai-agents-js) | `0.14.3` | `0.16.1` |
| [ws](https://github.com/websockets/ws) | `8.21.2` | `8.21.3` |
| [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` |
| [electron](https://github.com/electron/electron) | `43.2.0` | `43.4.0` |
| [@earendil-works/pi-tui](https://github.com/earendil-works/pi/tree/HEAD/packages/tui) | `0.83.0` | `0.84.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.28.0` | `1.31.0` |
| [@astryxdesign/theme-neutral](https://github.com/facebook/astryx/tree/HEAD/packages/themes/neutral) | `0.4.0` | `0.4.3` |
| [@storybook/react-vite](https://github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite) | `10.5.6` | `10.5.8` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.1` |
Updates `@astryxdesign/cli` from 0.4.0 to 0.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/facebook/astryx/releases">@astryxdesign/cli's releases</a>.</em></p>
<blockquote>
<h2>v0.4.3</h2>
<p>Astryx 0.4.3 — all <code>@astryxdesign/*</code> packages ship at this version.</p>
<pre lang="bash"><code>npx astryx upgrade --apply
</code></pre>
<h2><code>@astryxdesign/core</code></h2>
<h3>New Features</h3>
<ul>
<li>New string utilities: <code>characterCount</code>, <code>firstCharacter</code>, and <code>truncateCharacters</code> — replacements for <code>.length</code>, <code>.charAt(0)</code>, and slice-based truncation that measure and cut user-visible strings by whole characters, so an emoji, flag, or accented letter counts as one and never gets split. Built on <code>Intl.Segmenter</code> with a code-point fallback.</li>
<li>ComplexSelector: support ghost toolbar triggers, leading icons, popup alignment, and an imperative <code>handleRef</code> (open/close/toggle/isOpen) for programmatic control.</li>
<li><code>useContainerReveal</code>: two ways to control the reveal without reaching into the hook's private custom properties. <code>getContainerProps({hoverDelay})</code> gates the reveal on pointer dwell — the hover-intent idea Tooltip and HoverCard already have as <code>delay</code> — so a cursor sweeping down a list no longer lights up every row it grazes, and <code>getContainerProps({forceState})</code> pins the container's trigger state when something else owns the interaction (a scroll, a drag, an open row menu). Per element, <code>getContentRevealProps({forceVisibility})</code> pins how one child looks regardless of its container. Still CSS-only: no hover state in React, no re-render. Keyboard and touch are untouched — focus always reveals, <code>forceState: 'inactive'</code> and <code>forceVisibility: 'hidden'</code> both yield to <code>:focus-within</code>.</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>
<p>Banner: a dismissed banner no longer drops focus, a custom status no longer loses its ARIA role, and the info banner paints again under the neutral theme.
Dismissing unmounted the focused dismiss button, so focus landed on <code><body></code> and a keyboard user lost their place in the page. Banner now records where focus entered from and returns it there, the same handoff <code>ToastViewport</code> makes for a dismissed toast. Measured in Chromium: <code>document.activeElement</code> was <code>BODY</code>, and is now the control the user tabbed in from.</p>
<p><code>BannerStatusMap</code> is documented as augmentable, but all four status lookups were closed <code>Record<BannerStatus, ...></code> maps. Adding the augmentation the docs show produced four TypeScript errors inside <code>Banner.tsx</code> itself, which a consumer cannot fix, and at runtime an unknown status resolved to <code>undefined</code> for its icon, its background and its ARIA role, so the banner stopped being a live region at all. The lookups are partial now: an unrecognized status renders with no status fill, no default glyph and <code>role="status"</code>.</p>
<p>A theme could not reach the banner's radius. <code>--_banner-radius</code> was declared in the doc file and in <code>derivedVarRegistry.ts</code>, but no rule read it, so a theme's <code>borderRadius</code> on the <code>banner</code> target expanded into a variable nothing consumed. The four card-silhouette radii read it now, falling back to <code>--radius-container</code>.</p>
<p>Under <code>@astryxdesign/theme-neutral</code> the info banner had no background at all, light or dark: the override set <code>background-color</code> directly and forced <code>--color-accent-muted</code> to <code>transparent</code>, and a plain CSS property written by a theme lands in <code>@layer astryx-theme</code>, which StyleX's <code>@layer priority4</code> outranks. Info now goes through <code>--color-accent-muted</code> like the other three statuses and like the stone theme already did.</p>
<p>Also in this change: <code>children={false}</code> (the ordinary <code>{cond && <ul/>}</code> idiom) no longer produces an expand toggle that opens an empty box, and <code>description=""</code> no longer leaves an empty 20px row, both via <code>isRenderable</code>; a long unbroken word in the title or description no longer forces the page into horizontal scrolling at a 320px viewport, measured at <code>document.scrollWidth</code> 529px before; and the content area's bottom border uses logical <code>border-block-end</code> alongside its inline siblings.</p>
</li>
<li>
<p>Count and cut text the way people read it: the TextArea character counter (and its over-limit state and screen-reader announcements) counts user-perceived characters — an emoji is 1, not 2; PowerSearch token truncation no longer cuts an emoji or accented letter in half; Table's auto-generated headers capitalize astral-plane letters correctly; Avatar's initials now use the shared character utilities.</p>
</li>
<li>
<p>ComplexSelector: honor the <code>sm</code>, <code>md</code>, and <code>lg</code> element-height tokens exactly.</p>
</li>
<li>
<p>TreeList's <code>variant</code> axis is themeable, and a new guard keeps every extensible axis honest. <code>TreeListVariantMap</code> invites theme packages to add variants — its own JSDoc shows the module augmentation — but <code>themeProps('tree-list', {density})</code> never passed <code>variant</code>, so a custom variant type-checked, rendered, and produced no selector to style. It is passed now, and documented in the target's <code>visualProps</code> so <code>astryx theme build</code> stops calling it an unknown prop.
<code>packages/core/src/theme/extensibleAxes.test.ts</code> is the third theming-drift guard, beside the ones covering <code>targets</code> and <code>vars</code>/<code>derived</code>. Those two check what a component renders against what it documents; neither looked at the open prop unions, which is why this went unnoticed. For every <code>*Map</code> that types a component prop, it now asserts the three places that have to agree: the interface is declared in the index a consumer augments (a re-export is invisible to both module augmentation and the CLI), the prop is reflected through <code>themeProps</code>, and it is documented as a visual prop. It reads the TypeScript AST rather than the type checker, and holds the map's OWNER accountable — a component forwarding <code>actionVariant</code> or <code>statusVariant</code> to the component that owns the map is not separately responsible for it.</p>
<p>Registry maps that widen a set of NAMES rather than a visual prop (<code>IndicatorMap</code>, <code>IndicatorFamilyMap</code>) are out of scope by construction, not by allowlist: the guard only considers maps whose alias types a prop on a <code>*Props</code> interface.</p>
</li>
<li>
<p>Security: reject <code>javascript:</code>, <code>vbscript:</code> and <code>data:text/html</code> URLs in the Markdown parser, so untrusted markdown can no longer produce an executable link href or image src; and fix <code>escapeRegExp</code> in <code>ChatTokenizedText</code>, whose character class closed early and left <code>]</code> and <code>\</code> unescaped, so token values containing them were injected raw into a <code>RegExp</code></p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.
The cause was <code>theme build</code> shadowing its own inputs. It writes <code><name>.js</code> next to <code><name>.ts</code>, and the loader resolved a plain <code>./<name></code> specifier to that generated artifact before the source — so the second build of a family read the artifact, which carries no <code>components</code> and exports <code><name>Theme</code> rather than whatever the source exports. A named import that missed became <code>extends: undefined</code>, and <code>defineTheme</code> treated an absent base as no base at all. The loader now resolves source extensions first, which is also the resolution the author's TypeScript sees, so the CSS a build emits matches the theme that type-checked.</p>
<p>Three things behind it are fixed too, so the failure cannot come back by another route. <code>defineTheme</code> <strong>throws</strong> when <code>extends</code> is present but is not a theme, naming the likely cause, instead of inheriting nothing — the one behavior change here, and it turns a silent stylesheet into a build error. A theme's <code>onDark</code>/<code>onLight</code> surfaces and its <code>__inputTokens</code> are now inherited like its tokens and components were, so a child no longer reverts its base's inverted-surface customizations to the defaults or loses its <code>[light, dark]</code> tuples. And a built theme module now carries the resolved <code>components</code> and surfaces alongside its tokens, so extending one — the <code>./built</code> subpath every shipped theme exposes — is no longer lossy. <code>theme build</code> also stopped hand-picking fields when it re-resolves a plain object theme file, which dropped <code>extends</code>, <code>color</c
ode> and <code>syntax</code> on the way in.</p>
<p>An extended theme is flat: everything it inherits is resolved into its own output, and its stylesheet stands alone. Measured on a 14-theme family (one base, 13 palettes extending it): each palette went from 25 custom properties and no component rules to the base's full 175 and 70, with its own colours still winning.</p>
</li>
</ul>
<h2><code>@astryxdesign/cli</code></h2>
<h3>Fixes</h3>
<ul>
<li>
<p>The unloaded-font advisory is a notice, not a warning. A theme file cannot load a font — Astryx sets <code>--font-family-*</code> and loading is the app's job — so <a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5045">#5045</a>'s advisory fires on any theme naming a webfont, including a perfectly correct one. As a warning that made a clean build read as defective, and it put the shipped template permanently in violation of its own "compiles with no warnings" guard (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5079">#5079</a> had to allowlist the template's two font names in that assertion).
The <code>theme.build</code> receipt now separates the two: <code>warnings</code> are defects the author should fix, <code>notices</code> are advisories about a correct theme. The font advisory moves to <code>notices</code> and to stdout with the rest of the build's progress; stderr stays for defects. The template guard is back to <code>warnings</code> being empty, and no longer needs to know which fonts the template names.</p>
<p>Programmatic callers reading <code>data.warnings</code> for font advisories should read <code>data.notices</code>; the message text is unchanged.</p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/facebook/astryx/blob/main/packages/cli/CHANGELOG.md">@astryxdesign/cli's changelog</a>.</em></p>
<blockquote>
<h1>0.4.3</h1>
<h4>Fixes</h4>
<ul>
<li>
<p>The unloaded-font advisory is a notice, not a warning. A theme file cannot load a font — Astryx sets <code>--font-family-*</code> and loading is the app's job — so <a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5045">#5045</a>'s advisory fires on any theme naming a webfont, including a perfectly correct one. As a warning that made a clean build read as defective, and it put the shipped template permanently in violation of its own "compiles with no warnings" guard (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5079">#5079</a> had to allowlist the template's two font names in that assertion).
The <code>theme.build</code> receipt now separates the two: <code>warnings</code> are defects the author should fix, <code>notices</code> are advisories about a correct theme. The font advisory moves to <code>notices</code> and to stdout with the rest of the build's progress; stderr stays for defects. The template guard is back to <code>warnings</code> being empty, and no longer needs to know which fonts the template names.</p>
<p>Programmatic callers reading <code>data.warnings</code> for font advisories should read <code>data.notices</code>; the message text is unchanged.</p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.
The cause was <code>theme build</code> shadowing its own inputs. It writes <code><name>.js</code> next to <code><name>.ts</code>, and the loader resolved a plain <code>./<name></code> specifier to that generated artifact before the source — so the second build of a family read the artifact, which carries no <code>components</code> and exports <code><name>Theme</code> rather than whatever the source exports. A named import that missed became <code>extends: undefined</code>, and <code>defineTheme</code> treated an absent base as no base at all. The loader now resolves source extensions first, which is also the resolution the author's TypeScript sees, so the CSS a build emits matches the theme that type-checked.</p>
<p>Three things behind it are fixed too, so the failure cannot come back by another route. <code>defineTheme</code> <strong>throws</strong> when <code>extends</code> is present but is not a theme, naming the likely cause, instead of inheriting nothing — the one behavior change here, and it turns a silent stylesheet into a build error. A theme's <code>onDark</code>/<code>onLight</code> surfaces and its <code>__inputTokens</code> are now inherited like its tokens and components were, so a child no longer reverts its base's inverted-surface customizations to the defaults or loses its <code>[light, dark]</code> tuples. And a built theme module now carries the resolved <code>components</code> and surfaces alongside its tokens, so extending one — the <code>./built</code> subpath every shipped theme exposes — is no longer lossy. <code>theme build</code> also stopped hand-picking fields when it re-resolves a plain object theme file, which dropped <code>extends</code>, <code>color</c
ode> and <code>syntax</code> on the way in.</p>
<p>An extended theme is flat: everything it inherits is resolved into its own output, and its stylesheet stands alone. Measured on a 14-theme family (one base, 13 palettes extending it): each palette went from 25 custom properties and no component rules to the base's full 175 and 70, with its own colours still winning.</p>
</li>
</ul>
<h4>Contributors</h4>
<p>Thanks to everyone who contributed to this release:</p>
<ul>
<li><a href="https://github.com/cixzhang"><code>@cixzhang</code></a></li>
</ul>
<hr />
<h1>0.4.2</h1>
<h4>New Features</h4>
<ul>
<li>
<p><code>astryx theme build</code> warns when a theme names fonts it does not load. The resolved <code>--font-family-*</code> tokens and component-override <code>fontFamily</code> values are checked against CSS generics and known system families; anything else gets one warning per family in the receipt and, after the install instructions, the <code><link></code>/<code>@font-face</code> snippet to add. <code>astryx docs typography</code> gains a Loading Custom Fonts section (Google Fonts and self-hosted recipes, <code>font-display: swap</code>, real fallback stacks), and the theme docs' production-build section points at it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5015">#5015</a>).</p>
</li>
<li>
<p><code>astryx theme template</code> writes an annotated theme template into your project (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5048">#5048</a>).
New sibling of <code>theme add</code>: where <code>add</code> starts you from a theme we ship, <code>template</code> starts you from a blank annotated one. <code>astryx init --features theme</code> calls the same leaf, so project setup writes it too — it previously printed a one-line hint and wrote nothing, which is the weakest form of the help a theme author needs, since the first problem is not knowing the command but not knowing what the theme surface contains. The file is <code>theme.template.ts</code>: every <code>defineTheme</code> field with a note on when to reach for it, the token families, the component override syntax, and the consumption steps (providing the theme, loading the fonts you name, building for SSR), each section naming the CLI command that prints its authoritative reference. An existing file is never clobbered.</p>
<p>This came out of a vibe test (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5047">#5047</a>): agents given an annotated template reached twice as far into the theme surface as agents given only the docs (17 component targets vs 8, and the only arm to use interaction states, custom variants and <code>onDark</code>), and shipped a third of the contrast defects.</p>
<p>A template that lies is worse than no template, so its claims are machine-checked against live sources rather than trusted: <code>scripts/check-theme-template.test.mjs</code> fails when a <code>defineTheme</code> field is added and left undocumented, when a token family is missing from the inventory, when a CSS variable or component key it names does not exist, when it cites a docs topic that does not, or when a theme source drops its SYNC reference. <code>theme build</code> compiles it warning-free in CI, and the CLI typecheck now covers it.</p>
</li>
</ul>
<h4>Fixes</h4>
<ul>
<li>
<p>Heading's <code>type</code> is a documented theming target, and the docs stop teaching a CSS variable that does not exist (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5016">#5016</a>).
<code>Heading</code> reflects <code>type</code> as a theme selector — <code>typography.scale</code> generates <code>heading: {'type:display-1' …}</code> rules for it — but <code>theming.targets</code> listed only <code>level</code> and <code>color</code>, so <code>astryx theme build</code> warned <code>Unknown prop "type" on component "heading"</code> on every theme that sets a type scale, including the shipped <code>neutralTheme</code>. The drift guard missed it twice over: it read a conditional spread (<code>{level, color, ...(type && {type})}</code>) as an unknown bag, and it only checked a component against a doc file in its own directory, so <code>Heading/</code> — documented from <code>Text/Text.doc.mjs</code> — was never checked at all. Both are fixed, which brings three more previously unchecked directories under the guard.</p>
<p>Separately, the theme docs' component-override example set <code>--button-press-scale</code>, which no component defines: copying it produces CSS that silently never applies. It now sets a real public var, and the example no longer declares the same <code>button</code> key twice.</p>
</li>
<li>
<p>Two guards left failing on <code>main</code> by their own landings, so every PR since has been red through no fault of its own. <a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/4963">#4963</a> gave Thumbnail's remove button a coarse-pointer hit-area var and did not document it, which the derived-var guard reads as an undocumented private var; the var is an <code>inset</code> on a <code>::after</code> overlay, so it is documented as private and listed alongside the other vars no standard CSS property maps onto. <a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5026">#5026</a> moved <code>borderDefaults</code> into <code>CoreTokenName</code> — the landing the theme-template guard was explicitly waiting for (its comment says "when <a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5017">#5017</a> lands, this guard starts requiring the template to cover it") — so the template's token inventory now
names <code>--border-width</code>.</p>
</li>
</ul>
<h4>Documentation</h4>
<ul>
<li>MobileNavToggle preview simulates a mobile AppShell instead of an empty stage: new playground.appShellMobile for components that render nothing without AppShell mobile context (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/4983">#4983</a>)</li>
</ul>
<h4>Contributors</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/facebook/astryx/commit/d9189c9e50fb4095269c29b6c9dae0613627570d"><code>d9189c9</code></a> chore: version packages for v0.4.3</li>
<li><a href="https://github.com/facebook/astryx/commit/44cde5ea94147863da5eeeaeca58dd8d1171c22e"><code>44cde5e</code></a> test(cli): synchronize watch assertion on rebuilt theme module (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5122">#5122</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/4d004cdb4c3da349dfbe13fa4f72abeb33618a5b"><code>4d004cd</code></a> Banner audit: dismiss focus handoff, status fall-through, empty slots and 320...</li>
<li><a href="https://github.com/facebook/astryx/commit/da6ea6710bd9416d76b8bb8fca0c31d146d242f3"><code>da6ea67</code></a> fix(cli): the unloaded-font advisory is a notice, not a warning (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5090">#5090</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/8b07cb95244b3701aaf7fd40dba71f7cf5fa7bda"><code>8b07cb9</code></a> fix(themes,cli): gate theme dists with check-fully-specified and pin --icons-...</li>
<li><a href="https://github.com/facebook/astryx/commit/01592f7b73613b8432d5e6c551358d9d4eedc8db"><code>01592f7</code></a> feat(core): expand ComplexSelector composition API (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/4769">#4769</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/bb0706256176ded036faa5914ce01757e1dbb850"><code>bb07062</code></a> fix: security — XSS in Markdown parser, ReDoS in ChatTokenizedText, dotfile c...</li>
<li><a href="https://github.com/facebook/astryx/commit/356d2f935c32dacd9fbff8c5895b32a667d5a907"><code>356d2f9</code></a> fix(theme): make <code>extends</code> reach the CSS (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5067">#5067</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/791f3950496384f90bc058a54603fa1cb39cb87f"><code>791f395</code></a> chore: version packages for v0.4.2 (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5083">#5083</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/5ed78adcb371f3d0e2c5fd167694d83a34f5dbb2"><code>5ed78ad</code></a> test(cli): the shipped theme template warns about its own fonts by design (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/cli/issues/5">#5</a>...</li>
<li>Additional commits viewable in <a href="https://github.com/facebook/astryx/commits/v0.4.3/packages/cli">compare view</a></li>
</ul>
</details>
<br />
Updates `@astryxdesign/core` from 0.4.0 to 0.4.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/facebook/astryx/releases">@astryxdesign/core's releases</a>.</em></p>
<blockquote>
<h2>v0.4.3</h2>
<p>Astryx 0.4.3 — all <code>@astryxdesign/*</code> packages ship at this version.</p>
<pre lang="bash"><code>npx astryx upgrade --apply
</code></pre>
<h2><code>@astryxdesign/core</code></h2>
<h3>New Features</h3>
<ul>
<li>New string utilities: <code>characterCount</code>, <code>firstCharacter</code>, and <code>truncateCharacters</code> — replacements for <code>.length</code>, <code>.charAt(0)</code>, and slice-based truncation that measure and cut user-visible strings by whole characters, so an emoji, flag, or accented letter counts as one and never gets split. Built on <code>Intl.Segmenter</code> with a code-point fallback.</li>
<li>ComplexSelector: support ghost toolbar triggers, leading icons, popup alignment, and an imperative <code>handleRef</code> (open/close/toggle/isOpen) for programmatic control.</li>
<li><code>useContainerReveal</code>: two ways to control the reveal without reaching into the hook's private custom properties. <code>getContainerProps({hoverDelay})</code> gates the reveal on pointer dwell — the hover-intent idea Tooltip and HoverCard already have as <code>delay</code> — so a cursor sweeping down a list no longer lights up every row it grazes, and <code>getContainerProps({forceState})</code> pins the container's trigger state when something else owns the interaction (a scroll, a drag, an open row menu). Per element, <code>getContentRevealProps({forceVisibility})</code> pins how one child looks regardless of its container. Still CSS-only: no hover state in React, no re-render. Keyboard and touch are untouched — focus always reveals, <code>forceState: 'inactive'</code> and <code>forceVisibility: 'hidden'</code> both yield to <code>:focus-within</code>.</li>
</ul>
<h3>Fixes</h3>
<ul>
<li>
<p>Banner: a dismissed banner no longer drops focus, a custom status no longer loses its ARIA role, and the info banner paints again under the neutral theme.
Dismissing unmounted the focused dismiss button, so focus landed on <code><body></code> and a keyboard user lost their place in the page. Banner now records where focus entered from and returns it there, the same handoff <code>ToastViewport</code> makes for a dismissed toast. Measured in Chromium: <code>document.activeElement</code> was <code>BODY</code>, and is now the control the user tabbed in from.</p>
<p><code>BannerStatusMap</code> is documented as augmentable, but all four status lookups were closed <code>Record<BannerStatus, ...></code> maps. Adding the augmentation the docs show produced four TypeScript errors inside <code>Banner.tsx</code> itself, which a consumer cannot fix, and at runtime an unknown status resolved to <code>undefined</code> for its icon, its background and its ARIA role, so the banner stopped being a live region at all. The lookups are partial now: an unrecognized status renders with no status fill, no default glyph and <code>role="status"</code>.</p>
<p>A theme could not reach the banner's radius. <code>--_banner-radius</code> was declared in the doc file and in <code>derivedVarRegistry.ts</code>, but no rule read it, so a theme's <code>borderRadius</code> on the <code>banner</code> target expanded into a variable nothing consumed. The four card-silhouette radii read it now, falling back to <code>--radius-container</code>.</p>
<p>Under <code>@astryxdesign/theme-neutral</code> the info banner had no background at all, light or dark: the override set <code>background-color</code> directly and forced <code>--color-accent-muted</code> to <code>transparent</code>, and a plain CSS property written by a theme lands in <code>@layer astryx-theme</code>, which StyleX's <code>@layer priority4</code> outranks. Info now goes through <code>--color-accent-muted</code> like the other three statuses and like the stone theme already did.</p>
<p>Also in this change: <code>children={false}</code> (the ordinary <code>{cond && <ul/>}</code> idiom) no longer produces an expand toggle that opens an empty box, and <code>description=""</code> no longer leaves an empty 20px row, both via <code>isRenderable</code>; a long unbroken word in the title or description no longer forces the page into horizontal scrolling at a 320px viewport, measured at <code>document.scrollWidth</code> 529px before; and the content area's bottom border uses logical <code>border-block-end</code> alongside its inline siblings.</p>
</li>
<li>
<p>Count and cut text the way people read it: the TextArea character counter (and its over-limit state and screen-reader announcements) counts user-perceived characters — an emoji is 1, not 2; PowerSearch token truncation no longer cuts an emoji or accented letter in half; Table's auto-generated headers capitalize astral-plane letters correctly; Avatar's initials now use the shared character utilities.</p>
</li>
<li>
<p>ComplexSelector: honor the <code>sm</code>, <code>md</code>, and <code>lg</code> element-height tokens exactly.</p>
</li>
<li>
<p>TreeList's <code>variant</code> axis is themeable, and a new guard keeps every extensible axis honest. <code>TreeListVariantMap</code> invites theme packages to add variants — its own JSDoc shows the module augmentation — but <code>themeProps('tree-list', {density})</code> never passed <code>variant</code>, so a custom variant type-checked, rendered, and produced no selector to style. It is passed now, and documented in the target's <code>visualProps</code> so <code>astryx theme build</code> stops calling it an unknown prop.
<code>packages/core/src/theme/extensibleAxes.test.ts</code> is the third theming-drift guard, beside the ones covering <code>targets</code> and <code>vars</code>/<code>derived</code>. Those two check what a component renders against what it documents; neither looked at the open prop unions, which is why this went unnoticed. For every <code>*Map</code> that types a component prop, it now asserts the three places that have to agree: the interface is declared in the index a consumer augments (a re-export is invisible to both module augmentation and the CLI), the prop is reflected through <code>themeProps</code>, and it is documented as a visual prop. It reads the TypeScript AST rather than the type checker, and holds the map's OWNER accountable — a component forwarding <code>actionVariant</code> or <code>statusVariant</code> to the component that owns the map is not separately responsible for it.</p>
<p>Registry maps that widen a set of NAMES rather than a visual prop (<code>IndicatorMap</code>, <code>IndicatorFamilyMap</code>) are out of scope by construction, not by allowlist: the guard only considers maps whose alias types a prop on a <code>*Props</code> interface.</p>
</li>
<li>
<p>Security: reject <code>javascript:</code>, <code>vbscript:</code> and <code>data:text/html</code> URLs in the Markdown parser, so untrusted markdown can no longer produce an executable link href or image src; and fix <code>escapeRegExp</code> in <code>ChatTokenizedText</code>, whose character class closed early and left <code>]</code> and <code>\</code> unescaped, so token values containing them were injected raw into a <code>RegExp</code></p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.
The cause was <code>theme build</code> shadowing its own inputs. It writes <code><name>.js</code> next to <code><name>.ts</code>, and the loader resolved a plain <code>./<name></code> specifier to that generated artifact before the source — so the second build of a family read the artifact, which carries no <code>components</code> and exports <code><name>Theme</code> rather than whatever the source exports. A named import that missed became <code>extends: undefined</code>, and <code>defineTheme</code> treated an absent base as no base at all. The loader now resolves source extensions first, which is also the resolution the author's TypeScript sees, so the CSS a build emits matches the theme that type-checked.</p>
<p>Three things behind it are fixed too, so the failure cannot come back by another route. <code>defineTheme</code> <strong>throws</strong> when <code>extends</code> is present but is not a theme, naming the likely cause, instead of inheriting nothing — the one behavior change here, and it turns a silent stylesheet into a build error. A theme's <code>onDark</code>/<code>onLight</code> surfaces and its <code>__inputTokens</code> are now inherited like its tokens and components were, so a child no longer reverts its base's inverted-surface customizations to the defaults or loses its <code>[light, dark]</code> tuples. And a built theme module now carries the resolved <code>components</code> and surfaces alongside its tokens, so extending one — the <code>./built</code> subpath every shipped theme exposes — is no longer lossy. <code>theme build</code> also stopped hand-picking fields when it re-resolves a plain object theme file, which dropped <code>extends</code>, <code>color</c
ode> and <code>syntax</code> on the way in.</p>
<p>An extended theme is flat: everything it inherits is resolved into its own output, and its stylesheet stands alone. Measured on a 14-theme family (one base, 13 palettes extending it): each palette went from 25 custom properties and no component rules to the base's full 175 and 70, with its own colours still winning.</p>
</li>
</ul>
<h2><code>@astryxdesign/cli</code></h2>
<h3>Fixes</h3>
<ul>
<li>
<p>The unloaded-font advisory is a notice, not a warning. A theme file cannot load a font — Astryx sets <code>--font-family-*</code> and loading is the app's job — so <a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5045">#5045</a>'s advisory fires on any theme naming a webfont, including a perfectly correct one. As a warning that made a clean build read as defective, and it put the shipped template permanently in violation of its own "compiles with no warnings" guard (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5079">#5079</a> had to allowlist the template's two font names in that assertion).
The <code>theme.build</code> receipt now separates the two: <code>warnings</code> are defects the author should fix, <code>notices</code> are advisories about a correct theme. The font advisory moves to <code>notices</code> and to stdout with the rest of the build's progress; stderr stays for defects. The template guard is back to <code>warnings</code> being empty, and no longer needs to know which fonts the template names.</p>
<p>Programmatic callers reading <code>data.warnings</code> for font advisories should read <code>data.notices</code>; the message text is unchanged.</p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/facebook/astryx/blob/main/packages/core/CHANGELOG.md">@astryxdesign/core's changelog</a>.</em></p>
<blockquote>
<h1>0.4.3</h1>
<h4>New Features</h4>
<ul>
<li>New string utilities: <code>characterCount</code>, <code>firstCharacter</code>, and <code>truncateCharacters</code> — replacements for <code>.length</code>, <code>.charAt(0)</code>, and slice-based truncation that measure and cut user-visible strings by whole characters, so an emoji, flag, or accented letter counts as one and never gets split. Built on <code>Intl.Segmenter</code> with a code-point fallback.</li>
<li>ComplexSelector: support ghost toolbar triggers, leading icons, popup alignment, and an imperative <code>handleRef</code> (open/close/toggle/isOpen) for programmatic control.</li>
<li><code>useContainerReveal</code>: two ways to control the reveal without reaching into the hook's private custom properties. <code>getContainerProps({hoverDelay})</code> gates the reveal on pointer dwell — the hover-intent idea Tooltip and HoverCard already have as <code>delay</code> — so a cursor sweeping down a list no longer lights up every row it grazes, and <code>getContainerProps({forceState})</code> pins the container's trigger state when something else owns the interaction (a scroll, a drag, an open row menu). Per element, <code>getContentRevealProps({forceVisibility})</code> pins how one child looks regardless of its container. Still CSS-only: no hover state in React, no re-render. Keyboard and touch are untouched — focus always reveals, <code>forceState: 'inactive'</code> and <code>forceVisibility: 'hidden'</code> both yield to <code>:focus-within</code>.</li>
</ul>
<h4>Fixes</h4>
<ul>
<li>
<p>Banner: a dismissed banner no longer drops focus, a custom status no longer loses its ARIA role, and the info banner paints again under the neutral theme.
Dismissing unmounted the focused dismiss button, so focus landed on <code><body></code> and a keyboard user lost their place in the page. Banner now records where focus entered from and returns it there, the same handoff <code>ToastViewport</code> makes for a dismissed toast. Measured in Chromium: <code>document.activeElement</code> was <code>BODY</code>, and is now the control the user tabbed in from.</p>
<p><code>BannerStatusMap</code> is documented as augmentable, but all four status lookups were closed <code>Record<BannerStatus, ...></code> maps. Adding the augmentation the docs show produced four TypeScript errors inside <code>Banner.tsx</code> itself, which a consumer cannot fix, and at runtime an unknown status resolved to <code>undefined</code> for its icon, its background and its ARIA role, so the banner stopped being a live region at all. The lookups are partial now: an unrecognized status renders with no status fill, no default glyph and <code>role="status"</code>.</p>
<p>A theme could not reach the banner's radius. <code>--_banner-radius</code> was declared in the doc file and in <code>derivedVarRegistry.ts</code>, but no rule read it, so a theme's <code>borderRadius</code> on the <code>banner</code> target expanded into a variable nothing consumed. The four card-silhouette radii read it now, falling back to <code>--radius-container</code>.</p>
<p>Under <code>@astryxdesign/theme-neutral</code> the info banner had no background at all, light or dark: the override set <code>background-color</code> directly and forced <code>--color-accent-muted</code> to <code>transparent</code>, and a plain CSS property written by a theme lands in <code>@layer astryx-theme</code>, which StyleX's <code>@layer priority4</code> outranks. Info now goes through <code>--color-accent-muted</code> like the other three statuses and like the stone theme already did.</p>
<p>Also in this change: <code>children={false}</code> (the ordinary <code>{cond && <ul/>}</code> idiom) no longer produces an expand toggle that opens an empty box, and <code>description=""</code> no longer leaves an empty 20px row, both via <code>isRenderable</code>; a long unbroken word in the title or description no longer forces the page into horizontal scrolling at a 320px viewport, measured at <code>document.scrollWidth</code> 529px before; and the content area's bottom border uses logical <code>border-block-end</code> alongside its inline siblings.</p>
</li>
<li>
<p>Count and cut text the way people read it: the TextArea character counter (and its over-limit state and screen-reader announcements) counts user-perceived characters — an emoji is 1, not 2; PowerSearch token truncation no longer cuts an emoji or accented letter in half; Table's auto-generated headers capitalize astral-plane letters correctly; Avatar's initials now use the shared character utilities.</p>
</li>
<li>
<p>ComplexSelector: honor the <code>sm</code>, <code>md</code>, and <code>lg</code> element-height tokens exactly.</p>
</li>
<li>
<p>TreeList's <code>variant</code> axis is themeable, and a new guard keeps every extensible axis honest. <code>TreeListVariantMap</code> invites theme packages to add variants — its own JSDoc shows the module augmentation — but <code>themeProps('tree-list', {density})</code> never passed <code>variant</code>, so a custom variant type-checked, rendered, and produced no selector to style. It is passed now, and documented in the target's <code>visualProps</code> so <code>astryx theme build</code> stops calling it an unknown prop.
<code>packages/core/src/theme/extensibleAxes.test.ts</code> is the third theming-drift guard, beside the ones covering <code>targets</code> and <code>vars</code>/<code>derived</code>. Those two check what a component renders against what it documents; neither looked at the open prop unions, which is why this went unnoticed. For every <code>*Map</code> that types a component prop, it now asserts the three places that have to agree: the interface is declared in the index a consumer augments (a re-export is invisible to both module augmentation and the CLI), the prop is reflected through <code>themeProps</code>, and it is documented as a visual prop. It reads the TypeScript AST rather than the type checker, and holds the map's OWNER accountable — a component forwarding <code>actionVariant</code> or <code>statusVariant</code> to the component that owns the map is not separately responsible for it.</p>
<p>Registry maps that widen a set of NAMES rather than a visual prop (<code>IndicatorMap</code>, <code>IndicatorFamilyMap</code>) are out of scope by construction, not by allowlist: the guard only considers maps whose alias types a prop on a <code>*Props</code> interface.</p>
</li>
<li>
<p>Security: reject <code>javascript:</code>, <code>vbscript:</code> and <code>data:text/html</code> URLs in the Markdown parser, so untrusted markdown can no longer produce an executable link href or image src; and fix <code>escapeRegExp</code> in <code>ChatTokenizedText</code>, whose character class closed early and left <code>]</code> and <code>\</code> unescaped, so token values containing them were injected raw into a <code>RegExp</code></p>
</li>
<li>
<p><code>extends</code> now reaches the CSS. A theme that extended another built a stylesheet holding only the declarations it stated itself: the base's tokens, component overrides and surface rules were all absent, and because each theme is <code>@scope</code>d to its own <code>data-astryx-theme</code> value, loading the base's stylesheet alongside could not fill the gap either. Every consumer of an inheritance chain silently got stock geometry, elevation and type with a new palette painted over it (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5067">#5067</a>). Nothing warned; the loss only showed up by diffing two generated stylesheets token by token.
The cause was <code>theme build</code> shadowing its own inputs. It writes <code><name>.js</code> next to <code><name>.ts</code>, and the loader resolved a plain <code>./<name></code> specifier to that generated artifact before the source — so the second build of a family read the artifact, which carries no <code>components</code> and exports <code><name>Theme</code> rather than whatever the source exports. A named import that missed became <code>extends: undefined</code>, and <code>defineTheme</code> treated an absent base as no base at all. The loader now resolves source extensions first, which is also the resolution the author's TypeScript sees, so the CSS a build emits matches the theme that type-checked.</p>
<p>Three things behind it are fixed too, so the failure cannot come back by another route. <code>defineTheme</code> <strong>throws</strong> when <code>extends</code> is present but is not a theme, naming the likely cause, instead of inheriting nothing — the one behavior change here, and it turns a silent stylesheet into a build error. A theme's <code>onDark</code>/<code>onLight</code> surfaces and its <code>__inputTokens</code> are now inherited like its tokens and components were, so a child no longer reverts its base's inverted-surface customizations to the defaults or loses its <code>[light, dark]</code> tuples. And a built theme module now carries the resolved <code>components</code> and surfaces alongside its tokens, so extending one — the <code>./built</code> subpath every shipped theme exposes — is no longer lossy. <code>theme build</code> also stopped hand-picking fields when it re-resolves a plain object theme file, which dropped <code>extends</code>, <code>color</c
ode> and <code>syntax</code> on the way in.</p>
<p>An extended theme is flat: everything it inherits is resolved into its own output, and its stylesheet stands alone. Measured on a 14-theme family (one base, 13 palettes extending it): each palette went from 25 custom properties and no component rules to the base's full 175 and 70, with its own colours still winning.</p>
</li>
</ul>
<h4>Contributors</h4>
<p>Thanks to everyone who contributed to this release:</p>
<ul>
<li><a href="https://github.com/AKnassa"><code>@AKnassa</code></a></li>
<li><a href="https://github.com/cixzhang"><code>@cixzhang</code></a></li>
<li><a href="https://github.com/ernestt"><code>@ernestt</code></a></li>
<li><a href="https://github.com/Sunil56224972"><code>@Sunil56224972</code></a></li>
</ul>
<hr />
<h1>0.4.2</h1>
<h4>New Features</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/facebook/astryx/commit/d9189c9e50fb4095269c29b6c9dae0613627570d"><code>d9189c9</code></a> chore: version packages for v0.4.3</li>
<li><a href="https://github.com/facebook/astryx/commit/4d004cdb4c3da349dfbe13fa4f72abeb33618a5b"><code>4d004cd</code></a> Banner audit: dismiss focus handoff, status fall-through, empty slots and 320...</li>
<li><a href="https://github.com/facebook/astryx/commit/255e810cf9a8db0ecc9f98103d8288a4a1dcdcdb"><code>255e810</code></a> fix(TreeList): make the variant axis themeable, and guard every axis like it ...</li>
<li><a href="https://github.com/facebook/astryx/commit/86a7f17527079327de37d11476b5ed9358896907"><code>86a7f17</code></a> Grapheme-safe text: count characters the way people do (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/4776">#4776</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/01592f7b73613b8432d5e6c551358d9d4eedc8db"><code>01592f7</code></a> feat(core): expand ComplexSelector composition API (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/4769">#4769</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/bb0706256176ded036faa5914ce01757e1dbb850"><code>bb07062</code></a> fix: security — XSS in Markdown parser, ReDoS in ChatTokenizedText, dotfile c...</li>
<li><a href="https://github.com/facebook/astryx/commit/356d2f935c32dacd9fbff8c5895b32a667d5a907"><code>356d2f9</code></a> fix(theme): make <code>extends</code> reach the CSS (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5067">#5067</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/b2057d16682110b6c590a811c51f23817152b0d2"><code>b2057d1</code></a> feat(useContainerReveal): hover-intent delay and forced reveal state (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5084">#5084</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/791f3950496384f90bc058a54603fa1cb39cb87f"><code>791f395</code></a> chore: version packages for v0.4.2 (<a href="https://github.com/facebook/astryx/tree/HEAD/packages/core/issues/5083">#5083</a>)</li>
<li><a href="https://github.com/facebook/astryx/commit/15a65d556c7e0f6641b7493c5d49bf86eb43bad7"><code>15a65d5</code></a> feat(AvatarGroup): expose size on the avatar-group-overflow theming target (#...</li>
<li>Additional commits viewable in <a href="https://github.com/facebook/astryx/commits/v0.4.3/packages/core">compare view</a></li>
</ul>
</details>
<br />
Updates `@biomejs/biome` from 2.5.6 to 2.5.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/biomejs/biome/releases">@biomejs/biome's releases</a>.</em></p>
<blockquote>
<h2>Biome CLI v2.5.8</h2>
<h2>2.5.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/10710">#10710</a> <a href="https://github.com/biomejs/biome/commit/0a0fbc15d67c410c80dfae398903f845544fcd65"><code>0a0fbc1</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added a new nursery rule <a href="https://biomejs.dev/linter/rules/use-react-compiler/"><code>useReactCompiler</code></a>, which reports diagnostics from React Compiler lint mode.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11251">#11251</a> <a href="https://github.com/biomejs/biome/commit/ea9dd8a93e65f849840415e8e26cd668aa1af913"><code>ea9dd8a</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Improved performance of <a href="https://biomejs.dev/linter/rules/no-import-cycles/"><code>noImportCycles</code></a>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11247">#11247</a> <a href="https://github.com/biomejs/biome/commit/52b44d6795741d051bf703bd69c6cb447af8fd1d"><code>52b44d6</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added the nursery rule <a href="https://biomejs.dev/linter/rules/no-svelte-legacy-const/"><code>noSvelteLegacyConst</code></a>, which disallows legacy Svelte <code>{@const}</code> tags and recommends declaration tags with <code>$derived()</code>.</p>
<p>Invalid:</p>
<pre lang="svelte"><code>{#each boxes as box}
{@const area = box.width * box.height}
<p>{area}</p>
{/each}
</code></pre>
<p>Valid:</p>
<pre lang="svelte"><code>{#each boxes as box}
{const area = $derived(box.width * box.height)}
<p>{area}</p>
{/each}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11252">#11252</a> <a href="https://github.com/biomejs/biome/commit/d5f570414fdcdddf62372e35c05f6dababad9287"><code>d5f5704</code></a> Thanks <a href="https://github.com/Turtle-Hwan"><code>@Turtle-Hwan</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11250">#11250</a>: <a href="https://biomejs.dev/linter/rules/use-await/"><code>useAwait</code></a> no longer reports async functions that contain an <code>await using</code> declaration.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11143">#11143</a> <a href="https://github.com/biomejs/biome/commit/6be7be1b147d7b4352ff5625a78bd54a48958950"><code>6be7be1</code></a> Thanks <a href="https://github.com/vznh"><code>@vznh</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11017">#11017</a>: <a href="https://biomejs.dev/linter/rules/no-useless-undefined/"><code>noUselessUndefined</code></a> no longer reports <code>return undefined</code> when the enclosing function has a return type annotation other than <code>undefined</code> or <code>void</code>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11234">#11234</a> <a href="https://github.com/biomejs/biome/commit/caefe393c66340914c481f7ccfc82979cf76b61b"><code>caefe39</code></a> Thanks <a href="https://github.com/subotac"><code>@subotac</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11228">#11228</a>: CSS block comments between a declaration colon and value now preserve their source indentation.</p>
<pre lang="diff"><code> :root {
--font-stack:
-/* comment */
+ /* comment */
system-ui;
}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11285">#11285</a> <a href="https://github.com/biomejs/biome/commit/bca1f73d939423056337bfd0a42cbdcb66bb1e3f"><code>bca1f73</code></a> Thanks <a href="https://github.com/denbezrukov"><code>@denbezrukov</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11280">#11280</a>: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.</p>
<pre lang="diff"><code>-:/* comment */ where(div) {}
+:where(/* comment */ div) {}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md">@biomejs/biome's changelog</a>.</em></p>
<blockquote>
<h2>2.5.8</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/10710">#10710</a> <a href="https://github.com/biomejs/biome/commit/0a0fbc15d67c410c80dfae398903f845544fcd65"><code>0a0fbc1</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added a new nursery rule <a href="https://biomejs.dev/linter/rules/use-react-compiler/"><code>useReactCompiler</code></a>, which reports diagnostics from React Compiler lint mode.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11251">#11251</a> <a href="https://github.com/biomejs/biome/commit/ea9dd8a93e65f849840415e8e26cd668aa1af913"><code>ea9dd8a</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Improved performance of <a href="https://biomejs.dev/linter/rules/no-import-cycles/"><code>noImportCycles</code></a>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11247">#11247</a> <a href="https://github.com/biomejs/biome/commit/52b44d6795741d051bf703bd69c6cb447af8fd1d"><code>52b44d6</code></a> Thanks <a href="https://github.com/dyc3"><code>@dyc3</code></a>! - Added the nursery rule <a href="https://biomejs.dev/linter/rules/no-svelte-legacy-const/"><code>noSvelteLegacyConst</code></a>, which disallows legacy Svelte <code>{@const}</code> tags and recommends declaration tags with <code>$derived()</code>.</p>
<p>Invalid:</p>
<pre lang="svelte"><code>{#each boxes as box}
{@const area = box.width * box.height}
<p>{area}</p>
{/each}
</code></pre>
<p>Valid:</p>
<pre lang="svelte"><code>{#each boxes as box}
{const area = $derived(box.width * box.height)}
<p>{area}</p>
{/each}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11252">#11252</a> <a href="https://github.com/biomejs/biome/commit/d5f570414fdcdddf62372e35c05f6dababad9287"><code>d5f5704</code></a> Thanks <a href="https://github.com/Turtle-Hwan"><code>@Turtle-Hwan</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11250">#11250</a>: <a href="https://biomejs.dev/linter/rules/use-await/"><code>useAwait</code></a> no longer reports async functions that contain an <code>await using</code> declaration.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11143">#11143</a> <a href="https://github.com/biomejs/biome/commit/6be7be1b147d7b4352ff5625a78bd54a48958950"><code>6be7be1</code></a> Thanks <a href="https://github.com/vznh"><code>@vznh</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11017">#11017</a>: <a href="https://biomejs.dev/linter/rules/no-useless-undefined/"><code>noUselessUndefined</code></a> no longer reports <code>return undefined</code> when the enclosing function has a return type annotation other than <code>undefined</code> or <code>void</code>.</p>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11234">#11234</a> <a href="https://github.com/biomejs/biome/commit/caefe393c66340914c481f7ccfc82979cf76b61b"><code>caefe39</code></a> Thanks <a href="https://github.com/subotac"><code>@subotac</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11228">#11228</a>: CSS block comments between a declaration colon and value now preserve their source indentation.</p>
<pre lang="diff"><code> :root {
--font-stack:
-/* comment */
+ /* comment */
system-ui;
}
</code></pre>
</li>
<li>
<p><a href="https://redirect.github.com/biomejs/biome/pull/11285">#11285</a> <a href="https://github.com/biomejs/biome/commit/bca1f73d939423056337bfd0a42cbdcb66bb1e3f"><code>bca1f73</code></a> Thanks <a href="https://github.com/denbezrukov"><code>@denbezrukov</code></a>! - Fixed <a href="https://redirect.github.com/biomejs/biome/issues/11280">#11280</a>: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.</p>
<pre lang="diff"><code>-:/* comment */ where(div) {}
+:where(/* comment */ div) {}
</code></pre>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/biomejs/biome/commit/6b8f09c04394f2a9f72b89f9381724681169641a"><code>6b8f09c</code></a> ci: release (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11236">#11236</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/23c0369c43b59284ca68c65883d6ede4228b6fb8"><code>23c0369</code></a> feat(lint): nursery noInvalidPropertyInitValue (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11187">#11187</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/52b44d6795741d051bf703bd69c6cb447af8fd1d"><code>52b44d6</code></a> feat(lint/html): add <code>noSvelteLegacyConst</code> (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11247">#11247</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/0a0fbc15d67c410c80dfae398903f845544fcd65"><code>0a0fbc1</code></a> feat(lint/js): add <code>useReactCompiler</code> (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10710">#10710</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/191d051335821e804e7ffe484240ca326af86f7c"><code>191d051</code></a> ci: release (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11119">#11119</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/9847e680ff8bb891a6c910e881af98a4fffa33c2"><code>9847e68</code></a> feat(lint): add noNonScalableViewport rule (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11168">#11168</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/e63354cf280783fa6380951342bdacc3fd55e681"><code>e63354c</code></a> feat(lint): add noExtendNative nursery rule (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11136">#11136</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/2fa0a62224af7a13869a28ef80aefa5ea75ebfd2"><code>2fa0a62</code></a> docs: rework CLI (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/11134">#11134</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/e00714360807115210e549caca0f235431ca9a8a"><code>e007143</code></a> feat(lint): add nursery rule noTailwindArbitraryValue (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10094">#10094</a>)</li>
<li><a href="https://github.com/biomejs/biome/commit/c171b3bd513d49c35b66cdc74a5de0ca0766b6ef"><code>c171b3b</code></a> feat(lint): add ignoreIfStatements option to useNullishCoalescing (<a href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10822">#10822</a>)</li>
<li>See full diff in <a href="https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.8/packages/@biomejs/biome">compare view</a></li>
</ul>
</details>
<br />
Updates `@types/node` from 26.1.2 to 26.2.0
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li>
</ul>
</details>
<br />
Updates `dugite` from 3.2.2 to 3.2.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/desktop/dugite/releases">dugite's releases</a>.</em></p>
<blockquote>
<h2>v3.2.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Update documentation for v3.0.0 API by <a href="https://github.com/niik"><code>@niik</code></a> in <a href="https://redirect.github.com/desktop/dugite/pull/624">desktop/dugite#624</a></li>
<li>Update actions by <a href="https://github.com/niik"><code>@niik</code></a> in <a href="https://redirect.github.com/desktop/dugite/pull/628">desktop/dugite#628</a></li>
<li>Update dugite-native to v2.53.0-4 by <a href="https://github.com/dugite-releases"><code>@dugite-releases</code></a>[bot] in <a href="https://redirect.github.com/desktop/dugite/pull/629">desktop/dugite#629</a></li>
<li>Pin publish workflow to npm 11 by <a href="https://github.com/tidy-dev"><code>@tidy-dev</code></a> in <a href="https://redirect.github.com/desktop/dugite/pull/630">desktop/dugite#630</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/desktop/dugite/compare/v3.2.2...v3.2.3">https://github.com/desktop/dugite/compare/v3.2.2...v3.2.3</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/desktop/dugite/commit/84cd716e0bf0f177dfc984a3ce05dec639bf79b9"><code>84cd716</...
_Description has been truncated_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] chore(deps): bump the minor-and-patch group across 1 directory with 18 updates [maka]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] commented on PR #3360:
URL: https://github.com/apache/maka/pull/3360#issuecomment-5380756121
Looks like these dependencies are updatable in another way, so this is no longer needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [PR] chore(deps): bump the minor-and-patch group across 1 directory with 18 updates [maka]
Posted by "dependabot[bot] (via GitHub)" <gi...@apache.org>.
dependabot[bot] closed pull request #3360: chore(deps): bump the minor-and-patch group across 1 directory with 18 updates
URL: https://github.com/apache/maka/pull/3360
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org