[dependabot]

Bumps the npm-minor-patch group with 3 updates: @biomejs/biome, @types/node and electron.

Updates @biomejs/biome from 2.5.14 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @types/node from 24.19.0 to 24.19.1

Commits

• See full diff in compare view

Updates electron from 43.7.5 to 43.7.7

Release notes

Sourced from electron's releases.

electron v43.7.7

Release Notes for v43.7.7

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn and V8. #54569

electron v43.7.6

Release Notes for v43.7.6

Fixes

• Fixed --xdg-portal-required-version having no effect and a spurious portal warning being logged for file dialogs on Linux. #54304 (Also in 44, 45)
• Fixed a child WebContentsView losing focus when its window is reactivated. #54456 (Also in 44, 45)
• Fixed a crash when a WebAuthn request used a security key that required its PIN. #54404 (Also in 45)
• Fixed a crash when sending a DevTools protocol command with a non-string value for an optional string parameter via webContents.debugger. #54443 (Also in 44, 45)
• Fixed a grey border around frameless windows on Linux WMs without compositing. #54390 (Also in 44, 45)
• Fixed a main process crash when a native API method was called with a this value of a different native type; it now throws a TypeError. #54316 (Also in 44)
• Fixed a possible crash during process exit when vm.Script or vm contexts created in the main process had been garbage collected shortly before quitting. #54268 (Also in 44, 45)
• Fixed a possible renderer crash in 32-bit Windows and Linux ARM builds caused by under-aligned Blink heap vector allocations. #54259
• Fixed a renderer crash calling image.toPNG() from a sandboxed preload script. #54503 (Also in 44, 45)
• Fixed clipboard.read(), readText() and has() resolving seconds late on Linux while the app was idle. #54309 (Also in 42, 44, 45)
• Fixed desktopCapturer.getSources() leaving non-resizable windows resizable on macOS. #54396 (Also in 44, 45)
• Fixed fs.rmSync failing to remove read-only files on Windows. #54256 (Also in 42, 44, 45)
• Fixed GDK_BACKEND leaking into processes spawned by Electron apps on Linux. #54426 (Also in 44, 45)
• Fixed pointerLock permission requests from some iframes reporting the parent frame. #54465 (Also in 42, 44, 45)
• Fixed setIgnoreMouseEvents() taking effect late on X11. #54498 (Also in 44, 45)
• Fixed setIgnoreMouseEvents(true) being undone by the next resize on X11. #54423 (Also in 44, 45)
  • Added setIgnoreMouseEvents support on Wayland.
• Fixed the default action label on Linux notifications not being localized. #54400 (Also in 44, 45)
• Fixed the GPU process crash-looping on Windows when the sandbox cannot read the install folder; the folder is now reported instead. #54485 (Also in 44, 45)
• Fixed the zoom level resetting on file: and other host-less pages after a location.hash change. #54440 (Also in 44, 45)
• Fixed typing not working after closing an alert() or confirm() on Windows. #54462 (Also in 44, 45)
• Fixed utilityProcess dropping stdout/stderr output that the child wrote immediately before exiting. #54279 (Also in 42, 44, 45)
• Fixed visual zoom limits resetting on navigation and not applying to webviews. #54450 (Also in 44, 45)
• Fixed WebAssembly exception handlers failing to catch, or crashing during tier-up, in modules using wasm exceptions. #54235
• Fixed WebAssembly modules loaded from the code cache crashing or throwing RuntimeError: unreachable after updating between certain patch releases. #54238 (Also in 42, 44, 45)
• Fixed win.setEnabled(false) and modal child windows not blocking input on Wayland. #54446 (Also in 44, 45)
• Fixed zoom in/out getting stuck after zooming past the 25%-500% range. #54422 (Also in 44, 45)
  • Fixed setVisualZoomLevelLimits() shrinking pages when the minimum is under 1.

Commits

• ddb762f chore: cherry-pick 26 changes from angle, chromium, dawn and v8 (#54569)
• 661853d refactor: remove electron::ScopedHString in favor of base::win::ScopedHString...
• bd9e012 test: run pointer lock permission spec serially (#54581)
• 8cf09e9 test: wait for PageState sync before navigating in restore spec (#54575)
• b18bcf4 test: run fullscreen specs serially (#54577)
• 37e9cfa test: parse all custom page size PDFs in one pdf.js process (#54542)
• fb950f4 test: wait for child output before asserting on it (#54543)
• c2831ed test: wait for focus before requesting pointer lock in spec (#54534)
• babbd10 test: wait for earlier Electron workers to exit before serial specs (#54510)
• e1777de fix: apply the X11 input shape before setIgnoreMouseEvents() returns (#54498)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[qawatake]

Biome 2.5.15でmigrateを実行し、$schema以外の変更が不要なことを確認したため、schema URLのみ追随しました（2.3/2.4、事前合意済み定型修正）。
新しいheadで全CIを再実行し、後続の未実行チェックも確認してから最終判定します。

[qawatake]

アップデートレビュー: Biome 2.5.14 → 2.5.15 / Node型 24.19.0 → 24.19.1 / Electron 43.7.5 → 43.7.7

最終判定: 実施
リスク評価: 中 — ネイティブのテスト用ランタイムを更新するが、配布物にはElectronを含めず、実Obsidianで検証済み。
レビュー種別: Comment（所有者本人のためApprove相当の判定を記録）

確認した変更点 (2.1)

• 一次情報: Biome 2.5.15、Electron 43.7.6、43.7.7、公式npm tarball・metadata、@types/node。
• Biome: nurseryルール追加、Svelte/HTML/Astro等のparser・formatter・lintの誤検出修正、設定エラー保持、型推論・性能修正。新ルールの自動有効化はなし。対象versionのmigrationでschema以外の変更なしを確認済み。
• Node型: 24.19.0と24.19.1の公式tarball比較ではzlib ZstdOptions.pledgedSrcSizeの追加とpackage/README metadataのみ。ランタイム変更なし。
• Electron: 43.7.6のLinux/Wayland/X11・focus・dialogs・native API・終了・clipboard・zoom・WebAssembly等の修正と、43.7.7のANGLE/Chromium/Dawn/V8 backportを確認。テスト用ElectronのAPI削除や要求major変更なし。
• 推移的依存: undici 7.29.1のTLS/WebSocket/cache/decompression/retryのsecurity修正と7.30.0のbackpressure/HTTP2/diagnostics修正を公式リリースまで確認。Sass使用repoは1.105.0→1.105.1のmedia-query間@extendのエラー表示修正も確認。

影響範囲と対応の妥当性 (2.2, 2.3)

変更点	影響箇所 / 影響なし	根拠	PRの対応は妥当か
Biome設定とlint修正	biome.jsoncと既存lint対象	schemaだけ追随しmigration無差分・lint無修正	妥当
Node型	既存TypeScriptの型検査	新headのtsc --noEmit成功。zlib変更の利用なし	妥当
Electron	tests/support・tests/e2e(-setup)の起動・UI・終了	esbuildでelectronはexternal。変更固有のfocus/dialog/終了経路を実Obsidian/macOS E2Eで確認	妥当
Sass（該当repoのみ）	開発ビルドのCSS	正常ビルドとCSS namespace検査、preview幅/scroll E2E成功。エラー表示改善のため正常CSS変更は不要	妥当
undici	Electron取得用のHTTP処理	実binary取得とObsidianセットアップ成功。主要アプリの独自TLS/HTTP2/cache interceptor利用なし	妥当

検証 (2.4)

• 新headの全CI成功: frozen install、toolchain/action pin/schema、既存audit gate、lint、型検査、build、配布物の依存確認、該当するCSS scope検査。
• macOS上で実ObsidianとElectron 43.7.7の一致をログで確認しE2E成功。sampleはvault setup/cleanupも成功、core/cardは各6 tests（hotkey、preview scroll/幅、cardはIMEを含む）成功。
• previewに限定される追加事象なし。配布物でElectronを差し替えず、実アプリE2Eが今回の起動・focus・終了・描画経路を確認する。

切り戻し・供給元・ライセンス (2.5, 2.6, 2.7)

• PRのsquash commitをrevertし旧package/lock/schemaへ戻す。データ形式・DB migrationなし。main CI/E2Eを監視し回帰があればrelease前に止めて戻す。
• 正規npm名・公式repo・公開者の継続を確認、npm integrityとlock一致。Biome 9/30、Node型10/1、Electron 9/30、Sass9/29の公開で既存7日制限を満たす。新たなinstall lifecycle script追加なし。Electron binary取得経路は既存の公式release。
• Biome MIT OR Apache-2.0、Node型/Electron/Sass MIT、undici MITを維持。

ブロック条件

• 該当なし。

依頼事項

• なし。

未確認・レビュアーへの申し送り (2.9)

• 既知の制約: auditにmoderate 1件。Obsidian型定義がmoment 2.29.4をexact pinするため、GHSA-4p3w-j4w9-5jqwの更新jobは解決不能。公式advisoryはserver npmのmoment.locale()へ攻撃者由来の非stringを渡す場合のpath traversal。対象の全src/tests/main検索でmoment利用は0件、npm型定義側の依存であり、このPRで危険な実行経路を追加しない。型定義供給元のpin解消は別途通知・提案し、minor overrideは自動追加していない。