Skip to content

fix(deps): update the pnpm group #708

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
yamcodes merged 5 commits into from
Jan 9, 2026
Merged

fix(deps): update the pnpm group #708

yamcodes merged 5 commits into from
Jan 9, 2026

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jan 8, 2026

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@biomejs/biome (source) 2.3.10 → 2.3.11 age confidence
fumadocs-core (source) 16.4.2 → 16.4.4 age confidence
fumadocs-twoslash (source) 3.1.11 → 3.1.12 age confidence
fumadocs-ui (source) 16.4.2 → 16.4.4 age confidence
npm (source) 11.6.4 → 11.7.0 age confidence
posthog-js (source) 1.310.2 → 1.313.0 age confidence
turbo (source) 2.7.2 → 2.7.3 age confidence
zod (source) 4.2.1 → 4.3.4 age confidence

Release Notes

biomejs/biome (@​biomejs/biome)

v2.3.11

Compare Source

Patch Changes

  • #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidTemplateRoot.

    This rule validates only root-level <template> elements in Vue single-file components. If the <template> has a src attribute, it must be empty. Otherwise, it must contain content.

    Invalid examples:

    <template src="./foo.html">content</template>
    <template></template>

    Valid examples:

    <template>content</template>
    <template src="./foo.html"></template>

  • #​8586 df8fe06 Thanks @​dyc3! - Added a new nursery rule useVueConsistentVBindStyle. Enforces consistent v-bind style (:prop shorthand vs v-bind:prop longhand). Default prefers shorthand; configurable via rule options.

  • #​8587 9a8c98d Thanks @​dyc3! - Added the rule useVueVForKey, which enforces that any element using v-for also specifies a key.

    Invalid

    <li v-for="item in items">{{ item }}</li>

    Valid

    <li v-for="item in items" :key="item.id">{{ item }}</li>

  • #​8586 df8fe06 Thanks @​dyc3! - Added a new nursery rule useVueConsistentVOnStyle. Enforces consistent v-on style (@event shorthand vs v-on:event longhand). Default prefers shorthand; configurable via rule options.

  • #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVOnce. Enforces that usages of the v-once directive in Vue.js SFC are valid.

    <!-- Valid -->
<div v-once />

<!-- Invalid -->
<div v-once:aaa />
<div v-once.bbb />
<div v-once="ccc" />

  • #​8498 d80fa41 Thanks @​tt-a1i! - Fixed #​8494. Extended noUndeclaredEnvVars to support bracket notation (process.env["VAR"], import.meta.env["VAR"]), Bun runtime (Bun.env.VAR, Bun.env["VAR"]), and Deno runtime (Deno.env.get("VAR")).

  • #​8509 574a909 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#await} syntax, when html.experimentalFullSupportEnabled is set to true.

    -{#await promise  then name }
+{#await promise then name}

-{:catch    name}
+{:catch name}

{/await}

  • #​8316 d64e92d Thanks @​washbin! - Added the new nursery rule noMultiAssign. This rule helps to prevent multiple chained assignments.

    For example, the following code triggers because there are two assignment expressions in the same statement.

    const a = (b = 0);

  • #​8592 a5f59cd Thanks @​Netail! - Added the nursery rule useUniqueInputFieldNames. Require fields within an input object to be unique.

    Invalid:

    query A($x: Int, $x: Int) {
  field
}

  • #​8524 17a6156 Thanks @​JacquesLeupin! - Fixed #​8488: Relative plugin paths are now resolved from the configuration file directory, including when configurations are merged (e.g. extends: "//").

  • #​8655 3260ec9 Thanks @​JacquesLeupin! - Fixed #​8636: Biome's CSS formatter now breaks comma-separated declaration values at top-level commas when wrapping.

  • #​8537 cc3e851 Thanks @​dibashthapa! - Fixed #​8491: Resolved false positive errors for safe boolean expressions. There are still pending fixes. Head to #​8491 (comment) for more details

    This new change will check for safe boolean expressions in variable declarations.

    For example,

    Valid:

    let isOne = 1;
let isPositiveNumber = number > 0;

return (
  <div>
    {" "}
    {isOne && "One"} {isPositiveNumber && "Is positive"}
  </div>
);

    Invalid:

    let emptyStr = "";
let isZero = 0;

return (
  <div>
    {emptyStr && "Empty String"} {isZero && "Number is zero"}{" "}
  </div>
);

  • #​8511 16a9036 Thanks @​ematipico! - Improved the diagnostics of the rules useSortedClasses and noUnnecessaryConditions. The diagnostics now state that these rules are a work in progress and link to the relevant GitHub issue.

  • #​8521 a704be9 Thanks @​ToBinio! - Added the nursery rule useVueConsistentDefinePropsDeclaration, which enforces consistent defineProps declaration style.

Invalid
<script setup lang="ts">
const props = defineProps({
  kind: { type: String },
});
</script>
Valid
<script setup lang="ts">
const props = defineProps<{
  kind: string;
}>();
</script>

  • #​8595 7c85bf0 Thanks @​dyc3! - Fixed #​8584: The HTML formatter will preserve whitespace after some elements and embedded expressions, which more closely aligns with Prettier's behavior.

    - <h1>Hello, {framework}and Svelte!</h1>
+ <h1>Hello, {framework} and Svelte!</h1>

  • #​8598 5e85d43 Thanks @​Netail! - Added the nursery rule useUniqueFieldDefinitionNames. Require all fields of a type to be unique.

    Invalid:

    type SomeObject {
  foo: String
  foo: String
}

  • #​8495 b573d14 Thanks @​taga3s! - Fixed #​8405: noMisusedPromises now emits warnings/errors when a function returns union types such as T | Promise<T> which is used in conditionals.

    const a = (): boolean | Promise<boolean> => Promise.resolve(true);
if (a()) {
} // Now correctly flagged

  • #​8632 0be7d12 Thanks @​Bertie690! - The documentation & rule sources for lint/complexity/noBannedTypes have been updated to fix a few oversights.

    In addition to some general typo fixes:

    • The rule now recommends Record<keyof any, never> instead of Record<string, never> (the latter of which incorrectly allows symbol-keyed properties).

    • The rule mentions an alternate method to enforce object emptiness involving unique symbol-based guards used by type-fest and many other packages:

      declare const mySym: unique symbol;

// Since this type's only property is an unexported `unique symbol`, nothing that imports it can specify any properties directly
// (as far as excess property checks go)
export type EmptyObject = { [mySym]?: never };
export type IsEmptyObject<T> = T extends EmptyObject ? true : false;

    The rule's listed sources have been updated as well to reflect the original source rule (ban-types) having been split into 3 separate rules circa April 2024.

  • #​8580 a3a1ad2 Thanks @​taga3s! - Added the nursery rule noBeforeInteractiveScriptOutsideDocument to the Next.js domain.
    This rule prevents usage of next/script's beforeInteractive strategy outside of pages/_document.js.

  • #​8493 5fc24f4 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#each} syntax, when html.experimentalFullSupportEnabled is set to true.

    - {#each items   as item  }
+ {#each items as item}

{/each}

  • #​8546 0196c0e Thanks @​Zaczero! - Hardened union static-member type flattening in edge cases (e.g. unions containing unknown or inferred expression types). This keeps inference conservative and avoids unstable type growth in node = node.parent-style loops.

  • #​8569 1022c76 Thanks @​ematipico! - Fixed an issue where the Biome HTML parser would emit a parse error when certain keywords are inside the text of HTML tags.

  • #​8606 f50723b Thanks @​dyc3! - Fixed #​8563: fixed a bounds check on bogus regex literals that caused panics when doing type inference

  • #​7410 ab9af9a Thanks @​sgarcialaguna! - Added the new nursery rule noJsxPropsBind. This rule disallows .bind(), arrow functions, or function expressions in JSX props.

    Invalid:

    <Foo onClick={() => console.log("Hello!")}></Foo>

  • #​8523 5f22f1c Thanks @​ematipico! - Improved the diagnostics of nursery rules. Added a message to diagnostics emitted by nursery rules, so that users are aware of nature of nursery rules.

  • #​8571 03666fd Thanks @​dyc3! - Improved the performance of noRedeclare by eliminating string allocations

  • #​8591 9dd9ca7 Thanks @​Netail! - Added the nursery rule useUniqueArgumentNames. Enforce unique arguments for GraphQL fields & directives.

    Invalid:

    query {
  field(arg1: "value", arg1: "value")
}

  • #​8521 a704be9 Thanks @​ToBinio! - Update useVueDefineMacrosOrder to only run on <script setup> blocks.

  • #​8344 7b982ba Thanks @​ematipico! - Reduced the system calls when running the CLI. The performances might be noticeable in big projects that have multiple libraries and enable project rules.

  • #​8588 958e24b Thanks @​Netail! - Added the nursery rule useUniqueVariableNames. Enforce unique variable names for GraphQL operations.

    Invalid:

    query ($x: Int, $x: Int) {
  field
}

  • #​8529 8794883 Thanks @​mdevils! - Fixed #​8499: useExhaustiveDependencies properly handles aliased destructured object keys when using stableResult configuration.

  • #​8557 4df2f4d Thanks @​dyc3! - Fixed an issue with the HTML formatter where it wouldn't add a space before the /> in self closing elements. This brings the HTML formatter more in line with Prettier.

    -<Component/>
+<Component />

  • #​8509 574a909 Thanks @​ematipico! - Added support for parsing and formatting the Svelte {#snippet} syntax, when html.experimentalFullSupportEnabled is set to true.

    -{#snippet    foo() }
+{#snippet foo()}

{/snippe}

  • #​8248 1231a5c Thanks @​emilyinure! - Added new nursery rule noReturnAssign, which disallows assignments inside return statements.

    Invalid:

    function f(a) {
  return (a = 1);
}

  • #​8531 6b09620 Thanks @​taga3s! - Fixed #​8472: The CSS parser can now accept multiple comma separated parameters in :active-view-transition-type.

  • #​8615 b9da66d Thanks @​taga3s! - Remove next/script component name check from noBeforeInteractiveScriptOutsideDocument since it is a default export.

  • #​8536 efbfbe2 Thanks @​dyc3! - Fixed #​8527: Improved type inference where analyzing code with repeated object property access and assignments (e.g. node = node.parent, a pattern common when traversing trees in a while loop) could hit an internal type limit. Biome now handles these cases without exceeding the type limit.

  • #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVCloak. Enforces that usages of the v-cloak directive in Vue.js SFC are valid.

    <!-- Valid -->
<div v-cloak />

<!-- Invalid -->
<div v-cloak:aaa />
<div v-cloak.bbb />
<div v-cloak="ccc" />

  • #​8583 83be210 Thanks @​dyc3! - Added the new nursery rule useVueValidVPre. Enforces that usages of the v-pre directive in Vue.js SFC are valid.

    <!-- Valid -->
<div v-pre />

<!-- Invalid -->
<div v-pre:aaa />
<div v-pre.bbb />
<div v-pre="ccc" />

  • #​8644 a3a27a7 Thanks @​JacquesLeupin! - Added the nursery rule useVueVapor to enforce <script setup vapor> in Vue SFCs. For example <script setup> is invalid.

  • #​8508 b86842c Thanks @​tt-a1i! - Fixed #​6783: now, when a path is provided via --stdin-file-path, Biome checks whether the file exists on disk. If the path doesn't exist (virtual path), ignore checks (files.includes and VCS ignore rules) are skipped.

fuma-nama/fumadocs (fumadocs-core)

v16.4.4

Compare Source

Patch Changes

v16.4.3

Compare Source

Patch Changes
npm/cli (npm)

v11.7.0

Compare Source

Features
Bug Fixes
Documentation
Chores
Dependencies
PostHog/posthog-js (posthog-js)

v1.313.0

Compare Source

1.313.0

Minor Changes
  • #​2832 f050f6c Thanks @​rafaeelaudibert! - Introduce custom cookie properties for localStorage+cookie persistence using the new cookie_persisted_properties property. This allows people to opt-in to store properties in cookies even in localstorage+cookies mode
    (2026-01-01)

v1.312.0

Compare Source

1.312.0

Minor Changes

  • #​2834 548b466 Thanks @​ordehi! - fix: Clear PageViewManager state on session rotation to prevent cross-session duration pollution

    When a browser tab is backgrounded and the session rotates (30 min idle or 24 hour max), PageViewManager now clears its state. This prevents $prev_pageview_duration from spanning session boundaries, which was causing impossibly large values (94+ hours observed) in web analytics "Average Time on Page" metrics.

    Users who implemented workarounds for inflated $prev_pageview_duration values (e.g., capping at 30 minutes) may want to review those after upgrading, as the root cause is now fixed. (2025-12-31)

v1.311.0

Compare Source

1.311.0

Minor Changes

  • #​2813 4b7443c Thanks @​ordehi! - feat(flags): add updateFlags() method for injecting flags without network request

    Adds posthog.updateFlags(flags, payloads?, options?) to inject feature flag values from an external source (e.g., server-side evaluation, edge middleware) without making a network request. Supports { merge: true } option to merge with existing flags instead of replacing. (2025-12-29)

vercel/turborepo (turbo)

v2.7.3: Turborepo v2.7.3

Compare Source

What's Changed

Examples
  • examples: Remove skipLibCheck from nestjs.json in nestJS example by @​leos in #​11323
Changelog

New Contributors

Full Changelog: vercel/turborepo@v2.7.2...v2.7.3

colinhacks/zod (zod)

v4.3.4

Compare Source

Commits:

v4.3.3

Compare Source

v4.3.2

Compare Source

v4.3.1

Compare Source

Commits:

  • 0fe8840 allow non-overwriting extends with refinements. 4.3.1

v4.3.0

Compare Source

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

z.fromJSONSchema()

Convert JSON Schema to Zod (#​5534, #​5586)

You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema "draft-2020-12", "draft-7", "draft-4", and OpenAPI 3.0.

import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅

The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness": MySchema > z.toJSONSchema() > z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

  • All primitive types (string, number, integer, boolean, null, object, array)
  • String formats (email, uri, uuid, date-time, date, time, ipv4, ipv6, and more)
  • Composition (anyOf, oneOf, allOf)
  • Object constraints (additionalProperties, patternProperties, propertyNames)
  • Array constraints (prefixItems, items, minItems, maxItems)
  • $ref for local references and circular schemas
  • Custom metadata is preserved

z.xor() — exclusive union (#​5534)

A new exclusive union type that requires exactly one option to match. Unlike z.union() which passes if any option matches, z.xor() fails if zero or more than one option matches.

const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches

When converted to JSON Schema, z.xor() produces oneOf instead of anyOf.

z.looseRecord() — partial record validation (#​5534)

A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent patternProperties in JSON Schema.

const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through

.exactOptional() — strict optional properties (#​5589)

A new wrapper that makes a property key-optional (can be omitted) but does not accept undefined as an explicit value.

const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌

This makes it possible to accurately represent the full spectrum of optionality expressible using exactOptionalPropertyTypes.

.apply()

A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#​5463)

const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();

.brand() cardinality

The .brand() method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #​4764, #​4836.

// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded

Type predicates on .refine() (#​5575)

The .refine() method now supports type predicates to narrow the output type:

const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"

ZodMap methods: min, max, nonempty, size (#​5316)

ZodMap now has parity with ZodSet and ZodArray:

const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint

.with() alias for .check() (359c0db)

A new .with() method has been added as a more readable alias for .check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.

z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);
z.slugify() transform

Transform strings into URL-friendly slugs. Works great with .with():

// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"

z.meta() and z.describe() in Zod Mini (947b4eb)

Zod Mini now exports z.meta() and z.describe() as top-level functions for adding metadata to schemas:

import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);

New locales

import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());





Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.

⚠️ .pick() and .omit() disallowed on object schemas containing refinements (#​5317)

Using .pick() or .omit() on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.

const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌

Migration: The easiest way to migrate is to create a new schema using the shape of the old one.

const newSchema = z.object(schema.shape).pick({ ... })
⚠️ .extend() disallowed on refined schemas (#​5317)

Similarly, .extend() now throws on schemas with refinements. Use .safeExtend() if you need to extend refined schemas.

const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b:

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on friday" in timezone Asia/Almaty, Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yamcodes/arkenv).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi43NC41IiwidXBkYXRlZEluVmVyIjoiNDIuNzQuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

@changeset-bot
Copy link

changeset-bot bot commented Jan 8, 2026 •
edited
Loading

⚠️ No Changeset found

Latest commit: 21565ae

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Jan 8, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions github-actions bot added example Issues or Pull Requests concerning at least one ArkEnv example. (Found in the `examples/` directory) www Improvements or additions to arkenv.js.org labels Jan 8, 2026
@arkenv-bot
Copy link
Contributor

arkenv-bot bot commented Jan 8, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Review Updated (Asia/Almaty)
arkenv Ready Ready Preview, Comment Jan 9 2026, 1:29 AM (Asia/Almaty)

@renovate
Copy link
Contributor Author

renovate bot commented Jan 8, 2026

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@yamcodes yamcodes merged commit 209d4f2 into main Jan 9, 2026
17 checks passed
@yamcodes yamcodes deleted the renovate/the-pnpm-group branch January 9, 2026 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

example Issues or Pull Requests concerning at least one ArkEnv example. (Found in the `examples/` directory) www Improvements or additions to arkenv.js.org

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@yamcodes