Update dependencies: Bump the all-dependencies group with 7 updates

[dependabot]

Bumps the all-dependencies group with 7 updates:

Package	From	To
@types/lodash	4.17.20	4.17.21
@biomejs/biome	2.3.4	2.3.8
@types/node	24.10.0	24.10.1
@vitest/coverage-v8	4.0.8	4.0.14
mongoose	8.19.3	9.0.0
pkgroll	2.20.1	2.21.4
vitest	4.0.8	4.0.14

Updates @types/lodash from 4.17.20 to 4.17.21

Commits

• See full diff in compare view

Updates @biomejs/biome from 2.3.4 to 2.3.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.8

2.3.8

Patch Changes

• #8188 4ca088c Thanks @​ematipico! - Fixed #7390, where Biome couldn't apply the correct configuration passed via --config-path.

  If you have multiple root configuration files, running any command with --config-path will now apply the chosen configuration file.

• #8171 79adaea Thanks @​dibashthapa! - Added the new rule noLeakedRender. This rule helps prevent potential leaks when rendering components that use binary expressions or ternaries.

  For example, the following code triggers the rule because the component would render 0:

  const Component = () => {
    const count = 0;
    return <div>{count && <span>Count: {count}</span>}</div>;
  };

• #8116 b537918 Thanks @​Netail! - Added the nursery rule noDuplicatedSpreadProps. Disallow JSX prop spreading the same identifier multiple times.

  Invalid:

  <div {...props} something="else" {...props} />

• #8256 f1e4696 Thanks @​cormacrelf! - Fixed a bug where logs were discarded (the kind from --log-level=info etc.). This is a regression introduced after an internal refactor that wasn't adequately tested.

• #8226 3f19b52 Thanks @​dyc3! - Fixed #8222: The HTML parser, with Vue directives enabled, can now parse v-slot shorthand syntax, e.g. \<template #foo>.

• #8007 182ecdc Thanks @​brandonmcconnell! - Added support for dollar-sign-prefixed filenames in the useFilenamingConvention rule.

  Biome now allows filenames starting with the dollar-sign (e.g. $postId.tsx) by default to support naming conventions used by frameworks such as TanStack Start for file-based-routing.

• #8218 91484d1 Thanks @​hirokiokada77! - Added the noMultiStr rule, which disallows creating multiline strings by escaping newlines.

  Invalid:

  const foo =
    "Line 1\n\
  Line 2";

  Valid:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.8

Patch Changes

• #8188 4ca088c Thanks @​ematipico! - Fixed #7390, where Biome couldn't apply the correct configuration passed via --config-path.

  If you have multiple root configuration files, running any command with --config-path will now apply the chosen configuration file.

• #8171 79adaea Thanks @​dibashthapa! - Added the new rule noLeakedRender. This rule helps prevent potential leaks when rendering components that use binary expressions or ternaries.

  For example, the following code triggers the rule because the component would render 0:

  const Component = () => {
    const count = 0;
    return <div>{count && <span>Count: {count}</span>}</div>;
  };

• #8116 b537918 Thanks @​Netail! - Added the nursery rule noDuplicatedSpreadProps. Disallow JSX prop spreading the same identifier multiple times.

  Invalid:

  <div {...props} something="else" {...props} />

• #8256 f1e4696 Thanks @​cormacrelf! - Fixed a bug where logs were discarded (the kind from --log-level=info etc.). This is a regression introduced after an internal refactor that wasn't adequately tested.

• #8226 3f19b52 Thanks @​dyc3! - Fixed #8222: The HTML parser, with Vue directives enabled, can now parse v-slot shorthand syntax, e.g. \<template #foo>.

• #8007 182ecdc Thanks @​brandonmcconnell! - Added support for dollar-sign-prefixed filenames in the useFilenamingConvention rule.

  Biome now allows filenames starting with the dollar-sign (e.g. $postId.tsx) by default to support naming conventions used by frameworks such as TanStack Start for file-based-routing.

• #8218 91484d1 Thanks @​hirokiokada77! - Added the noMultiStr rule, which disallows creating multiline strings by escaping newlines.

  Invalid:

  const foo =
    "Line 1\n\
  Line 2";

  Valid:

  const foo = "Line 1\nLine 2";
  const bar = `Line 1

... (truncated)

Commits

• 0a6b6fb chore: restore version and yaml how they were
• 5d15cd5 chore: revert version
• 59fa146 ci: release (#8263)
• f7e836f feat(biome_js_analyze): implement noProto rule (#8276)
• b537918 feat(js_biome_analyze): implement noDuplicatedSpreadProps (#8116)
• 91484d1 feat(biome_js_analyze): implement noMultiStr rule (#8218)
• 68c052e feat(biome_js_analyze): implement noEqualsToNull rule (#8214)
• 79adaea feat(lint): added new rule no-leaked-render from eslint-react (#8171)
• cd2edd7 feat(js_analyze): implement noTernary (#8201)
• 8e97b89 ci: release (#8161)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​biomejs/biome since your current version.

Updates @types/node from 24.10.0 to 24.10.1

Commits

• See full diff in compare view

Updates @vitest/coverage-v8 from 4.0.8 to 4.0.14

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.0.14

   🚀 Experimental Features

• browser: Expose utils.configurePrettyDOM  -  by @​sheremet-va in vitest-dev/vitest#9103 (2cc34)
• runner: Add full names to tasks  -  by @​macarie in vitest-dev/vitest#9087 (821aa)
• ui: Add tabbed failure view for toMatchScreenshot with comparison slider  -  by @​macarie in vitest-dev/vitest#8813 (c37c2)

   🐞 Bug Fixes

• Externalize before caching  -  by @​sheremet-va in vitest-dev/vitest#9077 (e1b2e)
• Collect the duration of external imports  -  by @​sheremet-va in vitest-dev/vitest#9097 (3326c)
• Rename collect to import, remove prepare  -  by @​sheremet-va in vitest-dev/vitest#9091 (1256b)
• browser:
  • Unsubscribe onCancel on rpc destroy  -  by @​AriPerkkio in vitest-dev/vitest#9088 (f5b72)
  • Revert the viewport scaling in non-ui mode #9018  -  by @​sheremet-va in vitest-dev/vitest#9072 and vitest-dev/vitest#9018 (64502)
• coverage:
  • Invalidate circular modules correctly on rerun with coverage  -  by @​aicest in vitest-dev/vitest#9096 (6f22c)
• expect:
  • Allow function as standard schema  -  by @​hi-ogawa in vitest-dev/vitest#9099 (ed8a2)
• jsdom:
  • Reuse abort signals if possible  -  by @​sheremet-va in vitest-dev/vitest#9090 (2c468)
• pool:
  • Init VITEST_POOL_ID + VITEST_WORKER_ID before environment setup  -  by @​AriPerkkio in vitest-dev/vitest#9085 (37918)
• web-worker:
  • postMessage to send ports to workers  -  by @​whitphx and @​AriPerkkio in vitest-dev/vitest#9078 (9d176)

   🏎 Performance

• Replace debug with obug  -  by @​sxzz and @​AriPerkkio in vitest-dev/vitest#9057 (acc51)

    View changes on GitHub

v4.0.13

   🐞 Bug Fixes

• types:
  • Don't use type from Vite 7.1  -  by @​sheremet-va in vitest-dev/vitest#9071 (6356b)
  • Don't import node.js dependent types in vitest/browser  -  by @​sheremet-va in vitest-dev/vitest#9068 (332af)

   🏎 Performance

• Avoid fetchModule roundtrip if the module is cached  -  by @​sheremet-va in vitest-dev/vitest#9075 (b27e0)
• experimental: If fsCacheModule is enabled, read from the memory when possible  -  by @​sheremet-va in vitest-dev/vitest#9076 (6b9a1)

    View changes on GitHub

v4.0.12

   🐞 Bug Fixes

• Inherit fsModuleCachePath by default  -  by @​sheremet-va in vitest-dev/vitest#9063 (9a8bc)

... (truncated)

Commits

• 9ca74cf chore: release v4.0.14
• acc5152 perf: replace debug with obug (#9057)
• 73b54ce chore: release v4.0.13
• 5aa84d5 chore: release v4.0.12
• c3befb0 chore: release v4.0.11
• 259a3d1 chore: release v4.0.10
• 62fab24 chore: release v4.0.9
• See full diff in compare view

Updates mongoose from 8.19.3 to 9.0.0

Release notes

Sourced from mongoose's releases.

9.0.0 / 2025-11-21

• BREAKING CHANGE: drop support for callback-based pre middleware, e.g. next() in pre() hooks
• BREAKING CHANGE: update to MongoDB Node driver v7
• BREAKING CHANGE: make UUID schema type return bson UUIDs #15378
• BREAKING CHANGE: make findOne(null), find(null), etc. throw an error instead of returning first doc #15019 #14948
• BREAKING CHANGE: disallow update pipelines by default, require updatePipeline option #15586 #14424
• BREAKING CHANGE: call virtual ref function with subdoc, not top-level doc #14652 #12440 #12363
• BREAKING CHANGE(types): make create() and insertOne() params more strict, remove generics to prevent type inference #15587 #15355
• BREAKING CHANGE(types): make FilterQuery properties no longer resolve to any in TypeScript #15422
• BREAKING CHANGE(types): change this to HydratedDocument for default() and required(), HydratedDocument | Query for validate() #15020 #14696
• BREAKING CHANGE(types): make id a virtual in TypeScript rather than a property on Document base class #15572 #13079
• BREAKING CHANGE(types): consolidate RootQuerySelector, Condition, etc. types with MongoDB driver's #15593
• BREAKING CHANGE: asyncify update validators, SchemaType.prototype.doValidate(), save hooks for improved stack traces #15312
• BREAKING CHANGE: remove bson as direct dependency, use mongodb/lib/bson instead #15576 #15154
• BREAKING CHANGE: remove _executionStack, make validate() async function and call Kareem hooks directly vs through wrappers #15298 #14906
• BREAKING CHANGE: remove browser build, move to @​mongoosejs/browser instead #15385 #15296
• BREAKING CHANGE: remove schematype caster and casterConstructor properties in favor of embeddedSchemaType and Constructor #15513 #15179
• BREAKING CHANGE: adding missing pluralizations, fixing pluralization: virus -> viruses #14247 ItsBradyDavis
• BREAKING CHANGE: remove connection noListener option #15641 #15640
• feat(types): add Schema.create() for TypeScript type inference #15482 #14954
• chore: remove examples directory #15597

9.0.0-rc1 / 2025-11-19

• fix(populate): correctly populate embedded discriminators on subdocuments #15774

9.0.0-rc0 / 2025-11-19

• BREAKING CHANGE: drop support for callback-based pre middleware, e.g. next() in pre() hooks
• BREAKING CHANGE: update to MongoDB Node driver v7
• BREAKING CHANGE: make UUID schema type return bson UUIDs #15378
• BREAKING CHANGE: make findOne(null), find(null), etc. throw an error instead of returning first doc #15019 #14948
• BREAKING CHANGE: disallow update pipelines by default, require updatePipeline option #15586 #14424
• BREAKING CHANGE: call virtual ref function with subdoc, not top-level doc #14652 #12440 #12363
• BREAKING CHANGE(types): make create() and insertOne() params more strict, remove generics to prevent type inference #15587 #15355
• BREAKING CHANGE(types): make FilterQuery properties no longer resolve to any in TypeScript #15422
• BREAKING CHANGE(types): change this to HydratedDocument for default() and required(), HydratedDocument | Query for validate() #15020 #14696
• BREAKING CHANGE(types): make id a virtual in TypeScript rather than a property on Document base class #15572 #13079
• BREAKING CHANGE(types): consolidate RootQuerySelector, Condition, etc. types with MongoDB driver's #15593
• BREAKING CHANGE: asyncify update validators, SchemaType.prototype.doValidate(), save hooks for improved stack traces #15312
• BREAKING CHANGE: remove bson as direct dependency, use mongodb/lib/bson instead #15576 #15154
• BREAKING CHANGE: remove _executionStack, make validate() async function and call Kareem hooks directly vs through wrappers #15298 #14906
• BREAKING CHANGE: remove browser build, move to @​mongoosejs/browser instead #15385 #15296
• BREAKING CHANGE: remove schematype caster and casterConstructor properties in favor of embeddedSchemaType and Constructor #15513 #15179
• BREAKING CHANGE: adding missing pluralizations, fixing pluralization: virus -> viruses #14247 ItsBradyDavis
• BREAKING CHANGE: remove connection noListener option #15641 #15640
• feat(types): add Schema.create() for TypeScript type inference #15482 #14954
• chore: remove examples directory #15597

... (truncated)

Changelog

Sourced from mongoose's changelog.

9.0.0 / 2025-11-21

• BREAKING CHANGE: drop support for callback-based pre middleware, e.g. next() in pre() hooks
• BREAKING CHANGE: update to MongoDB Node driver v7
• BREAKING CHANGE: make UUID schema type return bson UUIDs #15378
• BREAKING CHANGE: make findOne(null), find(null), etc. throw an error instead of returning first doc #15019 #14948
• BREAKING CHANGE: disallow update pipelines by default, require updatePipeline option #15586 #14424
• BREAKING CHANGE: call virtual ref function with subdoc, not top-level doc #14652 #12440 #12363
• BREAKING CHANGE(types): make create() and insertOne() params more strict, remove generics to prevent type inference #15587 #15355
• BREAKING CHANGE(types): make FilterQuery properties no longer resolve to any in TypeScript #15422
• BREAKING CHANGE(types): change this to HydratedDocument for default() and required(), HydratedDocument | Query for validate() #15020 #14696
• BREAKING CHANGE(types): make id a virtual in TypeScript rather than a property on Document base class #15572 #13079
• BREAKING CHANGE(types): consolidate RootQuerySelector, Condition, etc. types with MongoDB driver's #15593
• BREAKING CHANGE: asyncify update validators, SchemaType.prototype.doValidate(), save hooks for improved stack traces #15312
• BREAKING CHANGE: remove bson as direct dependency, use mongodb/lib/bson instead #15576 #15154
• BREAKING CHANGE: remove _executionStack, make validate() async function and call Kareem hooks directly vs through wrappers #15298 #14906
• BREAKING CHANGE: remove browser build, move to @​mongoosejs/browser instead #15385 #15296
• BREAKING CHANGE: remove schematype caster and casterConstructor properties in favor of embeddedSchemaType and Constructor #15513 #15179
• BREAKING CHANGE: adding missing pluralizations, fixing pluralization: virus -> viruses #14247 ItsBradyDavis
• BREAKING CHANGE: remove connection noListener option #15641 #15640
• feat(types): add Schema.create() for TypeScript type inference #15482 #14954
• chore: remove examples directory #15597

8.20.1 / 2025-11-20

• types: correct Model.schema type and fix unknown check for this param type in schema.methods #15750 #15693
• docs: add detailed loadClass() TypeScript usage guide #15731 #12813 Necro-Rohan
• docs: update version support documentation for Mongoose #15761 ManmathX
• docs: add copy-to-clipboard feature for code blocks in docs #15759 vedansha07

9.0.0-rc1 / 2025-11-19

• fix(populate): correctly populate embedded discriminators on subdocuments #15774

9.0.0-rc0 / 2025-11-19

• BREAKING CHANGE: drop support for callback-based pre middleware, e.g. next() in pre() hooks
• BREAKING CHANGE: update to MongoDB Node driver v7
• BREAKING CHANGE: make UUID schema type return bson UUIDs #15378
• BREAKING CHANGE: make findOne(null), find(null), etc. throw an error instead of returning first doc #15019 #14948
• BREAKING CHANGE: disallow update pipelines by default, require updatePipeline option #15586 #14424
• BREAKING CHANGE: call virtual ref function with subdoc, not top-level doc #14652 #12440 #12363
• BREAKING CHANGE(types): make create() and insertOne() params more strict, remove generics to prevent type inference #15587 #15355
• BREAKING CHANGE(types): make FilterQuery properties no longer resolve to any in TypeScript #15422
• BREAKING CHANGE(types): change this to HydratedDocument for default() and required(), HydratedDocument | Query for validate() #15020 #14696
• BREAKING CHANGE(types): make id a virtual in TypeScript rather than a property on Document base class #15572 #13079
• BREAKING CHANGE(types): consolidate RootQuerySelector, Condition, etc. types with MongoDB driver's #15593
• BREAKING CHANGE: asyncify update validators, SchemaType.prototype.doValidate(), save hooks for improved stack traces #15312
• BREAKING CHANGE: remove bson as direct dependency, use mongodb/lib/bson instead #15576 #15154
• BREAKING CHANGE: remove _executionStack, make validate() async function and call Kareem hooks directly vs through wrappers #15298 #14906

... (truncated)

Commits

• 93c780b chore: release 9.0.0
• 830bf73 Merge branch '8.x'
• 46996b6 chore: add script to publish 8x docs
• bcdcd32 chore: release 8.20.1
• e646c58 Merge branch '8.x' of github.com:Automattic/mongoose into 8.x
• 598b1fa chore: use marked 15
• f631093 Merge pull request #15750 from Automattic/vkarpov15/gh-15693
• 96b74d5 Merge pull request #15761 from ManmathX/master
• cb7a90d Merge pull request #15759 from vedansha07/add-copy-button
• 113e801 chore: release 9.0.0-rc1
• Additional commits viewable in compare view

Updates pkgroll from 2.20.1 to 2.21.4

Release notes

Sourced from pkgroll's releases.

v2.21.4

2.21.4 (2025-11-28)

Bug Fixes

• dont resolve .js to .ts in external dependency (03c7283), closes #141

v2.21.3

2.21.3 (2025-11-22)

Bug Fixes

• resolve implicit external path (d972431)

v2.21.2

2.21.2 (2025-11-22)

Bug Fixes

• deps: update dependency @​rollup/plugin-alias to v6 (1267295)
• deps: update dependency @​rollup/plugin-commonjs to v29 (07548e4)

v2.21.1

2.21.1 (2025-11-20)

Bug Fixes

• resolver: prefer .js over .ts in node_modules (46d4202)

v2.21.0

2.21.0 (2025-11-20)

Bug Fixes

• deps: update all non-major dependencies (#25) (f18fe0f)

Features

• enhance dependency externalization with improved warnings (f7b3876), closes #32 #49

Commits

• 03c7283 fix: dont resolve .js to .ts in external dependency
• d972431 fix: resolve implicit external path
• 07548e4 fix(deps): update dependency @​rollup/plugin-commonjs to v29
• 91e3813 ci(github-actions): update github-actions to v6 (major)
• 1267295 fix(deps): update dependency @​rollup/plugin-alias to v6
• 46d4202 fix(resolver): prefer .js over .ts in node_modules
• a26950c chore(deps): lock file maintenance (#26)
• d6eba4e test: upgrade manten
• d4ef552 test: fix correct node version usage
• 15b0981 chore(deps): update node.js to v24
• Additional commits viewable in compare view

Updates vitest from 4.0.8 to 4.0.14

Release notes

Sourced from vitest's releases.

v4.0.14

   🚀 Experimental Features

• browser: Expose utils.configurePrettyDOM  -  by @​sheremet-va in vitest-dev/vitest#9103 (2cc34)
• runner: Add full names to tasks  -  by @​macarie in vitest-dev/vitest#9087 (821aa)
• ui: Add tabbed failure view for toMatchScreenshot with comparison slider  -  by @​macarie in vitest-dev/vitest#8813 (c37c2)

   🐞 Bug Fixes

• Externalize before caching  -  by @​sheremet-va in vitest-dev/vitest#9077 (e1b2e)
• Collect the duration of external imports  -  by @​sheremet-va in vitest-dev/vitest#9097 (3326c)
• Rename collect to import, remove prepare  -  by @​sheremet-va in vitest-dev/vitest#9091 (1256b)
• browser:
  • Unsubscribe onCancel on rpc destroy  -  by @​AriPerkkio in vitest-dev/vitest#9088 (f5b72)
  • Revert the viewport scaling in non-ui mode #9018  -  by @​sheremet-va in vitest-dev/vitest#9072 and vitest-dev/vitest#9018 (64502)
• coverage:
  • Invalidate circular modules correctly on rerun with coverage  -  by @​aicest in vitest-dev/vitest#9096 (6f22c)
• expect:
  • Allow function as standard schema  -  by @​hi-ogawa in vitest-dev/vitest#9099 (ed8a2)
• jsdom:
  • Reuse abort signals if possible  -  by @​sheremet-va in vitest-dev/vitest#9090 (2c468)
• pool:
  • Init VITEST_POOL_ID + VITEST_WORKER_ID before environment setup  -  by @​AriPerkkio in vitest-dev/vitest#9085 (37918)
• web-worker:
  • postMessage to send ports to workers  -  by @​whitphx and @​AriPerkkio in vitest-dev/vitest#9078 (9d176)

   🏎 Performance

• Replace debug with obug  -  by @​sxzz and @​AriPerkkio in vitest-dev/vitest#9057 (acc51)

    View changes on GitHub

v4.0.13

   🐞 Bug Fixes

• types:
  • Don't use type from Vite 7.1  -  by @​sheremet-va in vitest-dev/vitest#9071 (6356b)
  • Don't import node.js dependent types in vitest/browser  -  by @​sheremet-va in vitest-dev/vitest#9068 (332af)

   🏎 Performance

• Avoid fetchModule roundtrip if the module is cached  -  by @​sheremet-va in vitest-dev/vitest#9075 (b27e0)
• experimental: If fsCacheModule is enabled, read from the memory when possible  -  by @​sheremet-va in vitest-dev/vitest#9076 (6b9a1)

    View changes on GitHub

v4.0.12

   🐞 Bug Fixes

• Inherit fsModuleCachePath by default  -  by @​sheremet-va in vitest-dev/vitest#9063 (9a8bc)

... (truncated)

Commits

• 9ca74cf chore: release v4.0.14
• 821aa20 feat(runner): Add full names to tasks (#9087)
• 1256b5c fix: rename collect to import, remove prepare (#9091)
• 3326cc9 fix: collect the duration of external imports (#9097)
• 379185b fix(pool): init VITEST_POOL_ID + VITEST_WORKER_ID before environment setu...
• 2c468ee fix(jsdom): reuse abort signals if possible (#9090)
• e1b2e08 fix: externalize before caching (#9077)
• acc5152 perf: replace debug with obug (#9057)
• 73b54ce chore: release v4.0.13
• b27e002 perf: avoid fetchModule roundtrip if the module is cached (#9075)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud