chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.4.9 → 2.4.10
@modelcontextprotocol/sdk (source)	1.26.0 → 1.29.0
@storybook/addon-a11y (source)	10.3.3 → 10.3.4
@storybook/addon-links (source)	10.3.3 → 10.3.4
@storybook/addon-vitest (source)	10.3.3 → 10.3.4
@storybook/react-vite (source)	10.3.3 → 10.3.4
@storybook/svelte (source)	10.3.3 → 10.3.4
@storybook/sveltekit (source)	10.3.3 → 10.3.4
@storybook/vue3-vite (source)	10.3.3 → 10.3.4
@tanstack/svelte-form (source)	1.28.5 → 1.28.6
@types/bun (source)	1.3.9 → 1.3.11
@types/node (source)	25.3.0 → 25.5.0
@types/pg (source)	8.16.0 → 8.20.0
@vitejs/plugin-react (source)	5.1.4 → 5.2.0
@vitejs/plugin-vue (source)	6.0.4 → 6.0.5
@vitejs/plugin-vue-jsx (source)	5.1.4 → 5.1.5
@vue/compiler-sfc (source)	3.5.28 → 3.5.31
@zag-js/accordion	1.38.2 → 1.39.0
@zag-js/anatomy	1.38.2 → 1.39.0
@zag-js/anatomy-icons	1.38.2 → 1.39.0
@zag-js/angle-slider	1.38.2 → 1.39.0
@zag-js/async-list	1.38.2 → 1.39.0
@zag-js/auto-resize	1.38.2 → 1.39.0
@zag-js/avatar	1.38.2 → 1.39.0
@zag-js/carousel	1.38.2 → 1.39.0
@zag-js/cascade-select	1.38.2 → 1.39.0
@zag-js/checkbox	1.38.2 → 1.39.0
@zag-js/clipboard	1.38.2 → 1.39.0
@zag-js/collapsible	1.38.2 → 1.39.0
@zag-js/collection	1.38.2 → 1.39.0
@zag-js/color-picker	1.38.2 → 1.39.0
@zag-js/color-utils	1.38.2 → 1.39.0
@zag-js/combobox	1.38.2 → 1.39.0
@zag-js/core	1.38.2 → 1.39.0
@zag-js/date-input	1.38.2 → 1.39.0
@zag-js/date-picker	1.38.2 → 1.39.0
@zag-js/date-utils	1.38.2 → 1.39.0
@zag-js/dialog	1.38.2 → 1.39.0
@zag-js/docs	1.38.2 → 1.39.0
@zag-js/dom-query	1.38.2 → 1.39.0
@zag-js/drawer	1.38.2 → 1.39.0
@zag-js/editable	1.38.2 → 1.39.0
@zag-js/file-upload	1.38.2 → 1.39.0
@zag-js/file-utils	1.38.2 → 1.39.0
@zag-js/floating-panel	1.38.2 → 1.39.0
@zag-js/focus-trap	1.38.2 → 1.39.0
@zag-js/focus-visible	1.38.2 → 1.39.0
@zag-js/highlight-word	1.38.2 → 1.39.0
@zag-js/hover-card	1.38.2 → 1.39.0
@zag-js/i18n-utils	1.38.2 → 1.39.0
@zag-js/image-cropper	1.38.2 → 1.39.0
@zag-js/json-tree-utils	1.38.2 → 1.39.0
@zag-js/listbox	1.38.2 → 1.39.0
@zag-js/marquee	1.38.2 → 1.39.0
@zag-js/menu	1.38.2 → 1.39.0
@zag-js/navigation-menu	1.38.2 → 1.39.0
@zag-js/number-input	1.38.2 → 1.39.0
@zag-js/pagination	1.38.2 → 1.39.0
@zag-js/password-input	1.38.2 → 1.39.0
@zag-js/pin-input	1.38.2 → 1.39.0
@zag-js/popover	1.38.2 → 1.39.0
@zag-js/presence	1.38.2 → 1.39.0
@zag-js/progress	1.38.2 → 1.39.0
@zag-js/qr-code	1.38.2 → 1.39.0
@zag-js/radio-group	1.38.2 → 1.39.0
@zag-js/rating-group	1.38.2 → 1.39.0
@zag-js/react	1.38.2 → 1.39.0
@zag-js/scroll-area	1.38.2 → 1.39.0
@zag-js/select	1.38.2 → 1.39.0
@zag-js/signature-pad	1.38.2 → 1.39.0
@zag-js/slider	1.38.2 → 1.39.0
@zag-js/solid	1.38.2 → 1.39.0
@zag-js/splitter	1.38.2 → 1.39.0
@zag-js/steps	1.38.2 → 1.39.0
@zag-js/svelte	1.38.2 → 1.39.0
@zag-js/switch	1.38.2 → 1.39.0
@zag-js/tabs	1.38.2 → 1.39.0
@zag-js/tags-input	1.38.2 → 1.39.0
@zag-js/timer	1.38.2 → 1.39.0
@zag-js/toast	1.38.2 → 1.39.0
@zag-js/toggle	1.38.2 → 1.39.0
@zag-js/toggle-group	1.38.2 → 1.39.0
@zag-js/tooltip	1.38.2 → 1.39.0
@zag-js/tour	1.38.2 → 1.39.0
@zag-js/tree-view	1.38.2 → 1.39.0
@zag-js/types	1.38.2 → 1.39.0
@zag-js/utils	1.38.2 → 1.39.0
@zag-js/vue	1.38.2 → 1.39.0
axe-core (source)	4.11.1 → 4.11.2
better-auth (source)	1.4.18 → 1.5.6
effect (source)	3.19.19 → 3.21.0
fs-extra	11.3.3 → 11.3.4
globby	16.1.1 → 16.2.0
happy-dom	20.7.0 → 20.8.9
lefthook	2.1.1 → 2.1.4
next (source)	15.5.12 → 15.5.14
nuxt (source)	4.3.1 → 4.4.2
pg (source)	8.18.0 → 8.20.0
react-frame-component	5.2.7 → 5.3.2
storybook (source)	10.3.3 → 10.3.4
svelte (source)	5.55.0 → 5.55.1
svelte-check	4.4.5 → 4.4.6
turbo (source)	2.8.10 → 2.9.3
vercel (source)	50.22.1 → 50.38.3
vue (source)	3.5.28 → 3.5.31
vue-router (source)	5.0.3 → 5.0.4
vue-tsc (source)	3.2.5 → 3.2.6

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.4.10

Compare Source

Patch Changes

• #​8838 f3a6a6b Thanks @​baeseokjae! - Added new lint nursery rule noImpliedEval.

  The rule detects implied eval() usage through functions like setTimeout, setInterval, and setImmediate when called with string arguments.

  // Invalid
  setTimeout("alert('Hello');", 100);
  
  // Valid
  setTimeout(() => alert("Hello"), 100);

• #​9320 93c3b6c Thanks @​taberoajorge! - Fixed #​7664: noUnusedVariables no longer reports false positives for TypeScript namespace declarations that participate in declaration merging with an exported or used value declaration (const, function, or class) of the same name. The reverse direction is also handled: a value declaration merged with an exported namespace is no longer flagged.

• #​9630 1dd4a56 Thanks @​raashish1601! - Fixed #​9629: noNegationElse now keeps ternary branch comments attached to the correct branch when applying its fixer.

• #​9216 04243b0 Thanks @​FrederickStempfle! - Fixed #​9061: noProcessEnv now also detects process.env when process is imported from the "process" or "node:process" modules.

  Previously, only the global process object was flagged:

  import process from "node:process";
  // This was not flagged, but now it is:
  console.log(process.env.NODE_ENV);

• #​9692 61b7ec5 Thanks @​mkosei! - Fixed Svelte #each destructuring parsing and formatting for nested patterns such as [key, { a, b }].

• #​9627 06a0f35 Thanks @​ematipico! - Fixed #​191: Improved the performance of how the Biome Language Server pulls code actions and diagnostics.

  Before, code actions were pulled and computed all at once in one request. This approach couldn't work in big files, and caused Biome to stale and have CPU usage spikes up to 100%.

  Now, code actions are pulled and computed lazily, and Biome won't choke anymore in big files.

• #​9643 5bfee36 Thanks @​dyc3! - Fixed #​9347: useVueValidVBind no longer reports valid object bindings like v-bind="props".

• #​9627 06a0f35 Thanks @​ematipico! - Fixed assist diagnostics being invisible when using --diagnostic-level=error. Enforced assist violations (e.g. useSortedKeys) were filtered out before being promoted to errors, causing biome check to incorrectly return success.

• #​9695 9856a87 Thanks @​dyc3! - Added the new nursery rule noUnsafePlusOperands, which reports + and += operations that use object-like, symbol, unknown, or never operands, or that mix number with bigint.

• #​9627 06a0f35 Thanks @​ematipico! - Fixed duplicate parse errors in check and ci output. When a file had syntax errors, the same parse error was printed twice and the error count was inflated.

• #​9627 06a0f35 Thanks @​ematipico! - Improved the performance of the commands lint and check when they are called with --write.

• #​9627 06a0f35 Thanks @​ematipico! - Fixed --diagnostic-level not fully filtering diagnostics. Setting --diagnostic-level=error now correctly excludes warnings and infos from both the output and the summary counts.

• #​9623 13b3261 Thanks @​ematipico! - Fixed #​9258: --skip no longer causes suppressions/unused warnings for suppression comments targeting skipped rules or domains.

• #​9631 599dd04 Thanks @​raashish1601! - Fixed #​9625: experimentalEmbeddedSnippetsEnabled no longer crashes when a file mixes formatable CSS-in-JS templates with tagged templates that the embedded formatter can't currently delegate, such as a styled-components interpolation returning `css```.

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.29.0

Compare Source

v1.28.0

Compare Source

What's Changed

• feat: use scopes_supported from resource metadata by default (fixes #​580) by @​antogyn in #​757
• [v1.x backport] Default to client_secret_basic when server omits token_endpoint_auth_methods_supported by @​pcarleton in #​1611
• fix: reject plain JSON Schema objects passed as inputSchema by @​tiluckdave in #​1596
• fix: clear _timeoutInfo in _onclose() and scope .finally() abort controller cleanup by @​pcarleton in #​1462
• fix(server/auth): RFC 8252 loopback port relaxation by @​poteat in #​1738
• chore: bump version to 1.28.0 by @​felixweinberger in #​1746

New Contributors

• @​antogyn made their first contribution in #​757
• @​tiluckdave made their first contribution in #​1596
• @​poteat made their first contribution in #​1738

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.1...v1.28.0

v1.27.1

Compare Source

What's Changed

• feat: implement auth/pre-registration conformance scenario by @​felixweinberger in #​1545
• docs: add governance documentation for SEP-1730 by @​felixweinberger in #​1547
• docs: comprehensive feature documentation for SEP-1730 Tier 1 by @​felixweinberger in #​1548
• fix: prevent command injection in example URL opening (v1.x backport) by @​maxisbey in #​1579
• fix: call onerror for silently swallowed transport errors by @​qing-ant in #​1580
• chore: bump version to 1.27.1 by @​felixweinberger in #​1581

New Contributors

• @​qing-ant made their first contribution in #​1580

Full Changelog: modelcontextprotocol/typescript-sdk@v1.27.0...v1.27.1

v1.27.0

Compare Source

What's Changed

• feat: add conformance test infrastructure for v1.x by @​felixweinberger in #​1518
• feat: backport discoverOAuthServerInfo() and discovery caching to v1.x by @​felixweinberger in #​1533
• feat: add url property to RequestInfo interface by @​valentinbeggi in #​1353
• [v1.x] feat(tasks): add streaming methods for elicitation and sampling by @​LucaButBoring in #​1528
• chore: bump version for v1.27.0 by @​felixweinberger in #​1541

New Contributors

• @​valentinbeggi made their first contribution in #​1353

Full Changelog: modelcontextprotocol/typescript-sdk@v1.26.0...v1.27.0

storybookjs/storybook (@​storybook/addon-a11y)

v10.3.4

Compare Source

• Addon-a11y: Clear status transition timer on unmount to prevent test flake - #​34203, thanks @​mixelburg!
• Bug: Skip re-processing already transformed config files for CSF factories - #​34273, thanks @​huang-julien!
• Builder-Vite: Use djb2 hash to prevent variable name collisions in builder-vite - #​34274, thanks @​chida09!
• CLI: Prompt for init crash reports - #​34316, thanks @​JReinhold!
• CSF4: Fix duplicate preview loading issue in Vitest - #​34361, thanks @​valentinpalkovic!
• Core: Fix WebSocket connection f

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ark-docs	Error		Apr 2, 2026 10:18pm

[vercel]

Deployment failed with the following error:

Invalid request: `attribution.gitUser` should NOT have additional property `isBot`.