RENOVATE: Update all non-major dependencies by renovate[bot] · Pull Request #136 · adobe/commerce-integration-starter-kit

renovate · 2026-05-18T13:38:16Z

This PR contains the following updates:

Package	Change	Type	Update
@biomejs/biome (source)	`2.4.14` → `2.4.15`	devDependencies	patch
@biomejs/biome (source)	`2.4.14` → `2.4.15`		patch
jest (source)	`30.4.1` → `30.4.2`	devDependencies	patch
node (source)	`22.22.2` → `22.22.3`		patch
ultracite (source)	`7.6.5` → `7.7.0`	devDependencies	minor

Release Notes

biomejs/biome (@biomejs/biome)

`v2.4.15`

Compare Source

Patch Changes

#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
```
import { nextTick } from "vue";

nextTick(() => {
  updateDom();
});
```
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
```
<input @&#8203;keyup.13="submit" />
```
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.
#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.
#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.
#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
```
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}
```
#10052 b565bed Thanks @minseong0324! - Improved noMisleadingReturnType: it now flags union annotations whose extra variants are never returned, and suggests the narrower type (e.g. string | null → string).

These functions are now reported because null and number are included in the return annotations but never returned:
```
function getUser(): string | null {
  return "hello";
} // null is never returned
function getCode(): string | number {
  return "hello";
} // number is never returned
```
#10213 ac30057 Thanks @dyc3! - Fixed #9450: HTML and Vue element formatting now preserves child line breaks when an element contains another element child on its own line, instead of collapsing the child element onto the same line.
#10275 9ee6c03 Thanks @solithcy! - Fixed #10274: Svelte templates with missing expressions no longer parsed as HtmlBogusElement
#10143 56798a7 Thanks @minseong0324! - noMisleadingReturnType now detects misleading return type annotations when object literal properties are initialized with as const.

This function is now reported because the return annotation widens a property initialized with as const:
```
function f(): { value: string } {
  return { value: "text" as const };
}
```
#10143 56798a7 Thanks @minseong0324! - noUselessTypeConversion now detects redundant conversions on object literal properties initialized with as const.

This conversion is now reported because message.value is inferred as a string literal:
```
const message = { value: "text" as const };
String(message.value);
```
#9807 0ae5840 Thanks @dyc3! - Added the new nursery rule useThisInClassMethods, based on ESLint's class-methods-use-this.

The rule now reports instance methods, getters, setters, and function-valued instance fields that do not use this, and biome migrate eslint preserves the supported ignoreMethods, ignoreOverrideMethods, and ignoreClassesWithImplements options.

Invalid:
```
class Foo {
  bar() {
    // does not use `this`, invalid
    console.log("Hello Biome");
  }
}
```
#10258 e7b18f7 Thanks @ematipico! - Improved linter performance by narrowing the query nodes for several lint rules, reducing how often they are evaluated.
#10273 04e22a1 Thanks @dyc3! - Fixed #10271: The HTML parser now correctly parses of as text content when in text contexts.
#9838 83f7385 Thanks @dyc3! - Added the nursery rule noBaseToString, which reports stringification sites that fall back to Object's default "[object Object]" formatting. The rule also supports the ignoredTypeNames option.
#10143 56798a7 Thanks @minseong0324! - useExhaustiveSwitchCases now checks switch statements over object literal properties initialized with as const.

This switch is now reported because status.kind is inferred as the string literal "ready" but no case handles it:
```
const status = { kind: "ready" as const };
switch (status.kind) {
}
```
#10143 56798a7 Thanks @minseong0324! - useStringStartsEndsWith now detects string index comparisons on object literal properties initialized with as const.

This comparison is now reported because message.value is inferred as a string literal:
```
const message = { value: "hello" as const };
message.value[0] === "h";
```

jestjs/jest (jest)

`v30.4.2`

Compare Source

Fixes

[jest-runtime] Fix named imports from CJS modules whose module.exports is a function with own-property exports (#16150)

nodejs/node (node)

`v22.22.3`: 2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolito

Compare Source

Commits

[4f780905c5] - crypto: fix potential null pointer dereference when BIO_meth_new() fails (Nora Dossche) #61788
[4a09efb947] - crypto: update root certificates to NSS 3.121 (Node.js GitHub Bot) #62485
[e4c0d99839] - deps: update timezone to 2026a (Node.js GitHub Bot) #62164
[0226c8dd7a] - deps: update simdjson to 4.5.0 (Node.js GitHub Bot) #62382
[e742ab748c] - deps: update sqlite to 3.51.3 (Node.js GitHub Bot) #62256
[73cac0571a] - deps: update amaro to 1.1.8 (Node.js GitHub Bot) #62151
[ae5c162b93] - deps: update amaro to 1.1.7 (Node.js GitHub Bot) #61730
[b819cb9977] - deps: update amaro to 1.1.6 (Node.js GitHub Bot) #61603
[bbcce09dc7] - deps: update sqlite to 3.52.0 (Node.js GitHub Bot) #62150
[22ff2d81ce] - deps: update simdjson to 4.3.1 (Node.js GitHub Bot) #61930
[f49b51d75c] - deps: update acorn-walk to 8.3.5 (Node.js GitHub Bot) #61928
[1a5cec0d49] - deps: update acorn to 8.16.0 (Node.js GitHub Bot) #61925
[d339497688] - deps: update nbytes to 0.1.3 (Node.js GitHub Bot) #61879
[3ff8ffd459] - deps: remove stale OpenSSL arch configs (René) #61834
[b8ddbc1e9a] - deps: update llhttp to 9.3.1 (Node.js GitHub Bot) #61827
[ffda97afd4] - deps: update googletest to 2461743 (Node.js GitHub Bot) #62484
[79aa32cf4f] - deps: update googletest to 73a63ea (Node.js GitHub Bot) #61927
[b6957e13b6] - deps: update archs files for openssl-3.5.6 (Node.js GitHub Bot) #62629
[3a27669063] - deps: upgrade openssl sources to openssl-3.5.6 (Node.js GitHub Bot) #62629
[d568a1bb53] - deps: upgrade npm to 10.9.8 (npm team) #62463
[ec11f3c1d5] - deps: V8: backport 85b3900 (Thibaud Michaud) #62783
[08609712ed] - deps: V8: backport 1b27e46 (Thibaud Michaud) #62783
[dcc60d5ab2] - deps: V8: backport 9997fc0 (Thibaud Michaud) #62783
[1d1f4451fb] - deps: V8: cherry-pick b96e40d (Clemens Backes) #62783
[2268567237] - deps: V8: cherry-pick 7cb6188 (Thibaud Michaud) #62783
[92804cdbea] - deps: V8: cherry-pick e7ccf0a (Thibaud Michaud) #62783
[eae2c27a40] - deps: V8: cherry-pick 8e214ec (Thibaud Michaud) #62783
[a1799a49bb] - deps: V8: backport 63b8849 (Thibaud Michaud) #62783
[a2df2d8731] - deps: V8: backport 3239427 (Thibaud Michaud) #62783
[e3d65c7dca] - deps: V8: backport 89dc6ea (Thibaud Michaud) #62783
[5e7db133de] - deps: V8: backport 910cb91 (Jakob Kummerow) #62783
[d0c24a28af] - deps: V8: cherry-pick b8f91e5 (Thibaud Michaud) #62783
[d358687824] - deps: V8: cherry-pick cf03d55 (Thibaud Michaud) #62783
[67c8b2c349] - deps: V8: cherry-pick 692f3d5 (Sébastien Doeraene) #62783
[71e5a59ffd] - deps: V8: cherry-pick c734674 (Manos Koukoutos) #62783
[f0dbe81c7b] - deps: V8: cherry-pick b2f3aea (Thibaud Michaud) #62783
[d333f480c3] - deps: V8: cherry-pick 5f1342c (Matthias Liedtke) #62783
[db722725bb] - deps: use npm undici@six tag in update-undici.sh (Matteo Collina) #63012
[9b57979d9c] - doc: add Rafael to last security release steward (Rafael Gonzaga) #62423
[d8075585bf] - doc: add path to vulnerabilities.json mention (Rafael Gonzaga) #62355
[6ec9a70204] - doc: clarify fs.ReadStream and fs.WriteStream are not constructable (Kit Dallege) #62208
[1fc86fcb6e] - doc: add note (and caveat) for mock.module about customization hooks (Jacob Smith) #62075
[491be80bd9] - doc: add efekrskl as triager (Efe) #61876
[18558293a3] - doc: fix module.stripTypeScriptTypes indentation (René) #61992
[8e20976522] - doc: explicitly mention Slack handle (Rafael Gonzaga) #61986
[70b8e6b4fb] - doc: rename invalid function parameter (René) #61942
[4045c76f6c] - doc: clarify status of feature request issues (Antoine du Hamel) #61505
[c54652f2aa] - doc: remove incorrect mention of module in typescript.md (Rob Palmer) #61839
[9fad6cedf5] - doc: clarify async caveats for events.once() (René) #61572
[2f1e5733fe] - doc: update Juan's security steward info (Juan José) #61754
[a64bdb5068] - doc: fix overstated Date header requirement in response.sendDate (Kit Dallege) #62206
[02797de923] - doc: fix small environment_variables typo (chris) #62279
[f22ebdc809] - doc: fix small logic error in DETECT_MODULE_SYNTAX (René) #62025
[9f4508062a] - doc: fix methods being documented as properties in process.md (Antoine du Hamel) #61765
[3ea39ff135] - doc: fix dropdown menu being obscured at <600px due to stacking context (Jeff) #61735
[c22445079b] - doc: fix spacing in process message event (Aviv Keller) #61756
[32831b5223] - doc: fix broken links of net.md (YuSheng Chen) #61673
[005508d509] - doc: remove obsolete Boxstarter automated install (Mike McCready) #61785
[37c2fd6f7d] - esm: fix path normalization in finalizeResolution (Antoine du Hamel) #62080
[1769d74613] - esm: populate separate cache for require(esm) in imported CJS (Joyee Cheung) #59679
[ee02966ffc] - http: fix keep-alive socket reuse race in requestOnFinish (Martin Slota) #61710
[2fdb5ce6cc] - http2: fix FileHandle leak in respondWithFile (sangwook) #61707
[aa2c1eca04] - lib: fix source map url parse in dynamic imports (Chengzhong Wu) #61990
[785b00cbeb] - meta: pass release version to release worker (flakey5) #62777
[447fb9a0b5] - meta: persist sccache daemon until end of build workflows (René) #61639
[5065a0acb3] - module: do not invoke resolve hooks twice for imported cjs (Joyee Cheung) #61529
[9a2e21305d] - module: do not wrap module._load when tracing is not enabled (Joyee Cheung) #61479
[b9240bc063] - module: fix sync resolve hooks for require with node: prefixes (Joyee Cheung) #61088
[2e91b28aaf] - module: handle null source from async loader hooks in sync hooks (Joyee Cheung) #59929
[39147c154e] - module: use sync cjs when importing cts (Marco Ippolito) #60072
[12a2462b2c] - module: only put directly require-d ESM into require.cache (Joyee Cheung) #59874
[cf39566277] - src: fix flags argument offset in JSUdpWrap (Weixie Cui) #61948
[578a9a9230] - src: clamp WriteUtf8 capacity to INT_MAX in EncodeInto (semimikoh) #62621
[57c3035fec] - stream: fix decoded fromList chunk boundary check (Thomas Watson) #61884
[57fb008bb8] - test: update tls junk data error expectations (Filip Skokan) #62629
[363f9a9d18] - test: skip test-url on --shared-ada builds (Antoine du Hamel) #62019
[daaead342b] - test: simplify encodeInto large buffer regression test (semimikoh) #62621
[ecfa766b41] - tools: fix auto-start-ci (Antoine du Hamel) #61900
[17c0a610af] - tools: fix parsing of commit trailers in lint-release-proposal GHA (Antoine du Hamel) #62077
[89ad7dc63b] - tools: enforce removal of lts-watch-* labels on release proposals (Antoine du Hamel) #61672
[5f9bb8ef0c] - tools: revert tools GHA workflow to ubuntu-latest (Richard Lau) #62024
[977ef80ac1] - url: process crash via malformed UNC hostname in pathToFileURL() (Nicola Del Gobbo) #62574
[ad8f518a81] - zlib: fix use-after-free when reset() is called during write (Matteo Collina) #62325

haydenbleasel/ultracite (ultracite)

`v7.7.0`

Compare Source

Minor Changes

24b0d27: Wire up the nestjs ESLint preset to actually enforce rules. Previously the preset exported an empty const config = [], meaning users who imported ultracite/eslint/nestjs got nothing. It now layers @darraghor/eslint-plugin-nestjs-typed (22 rules covering NestJS conventions, dependency injection correctness, and class-validator/Swagger usage) using the same dynamic-enable pattern as the other framework presets.

Consumers who already had the empty preset in their config may see new violations on first run.

Patch Changes

161418a: Add missing Biome stable rules to the core config:
- suspicious/noDuplicateDependencies → "error" — flags a dependency listed multiple times in the same group, or across dependencies and devDependencies, in package.json.
- suspicious/useDeprecatedDate → "off" — GraphQL-only convention requiring a deletionDate argument on @deprecated; too opinionated for the default preset.
9a2b548: Pin @angular-eslint/eslint-plugin to ^21.3.1 in packages/cli/package.json. Previously declared as "latest", which defeats lockfile reproducibility and means each bun install could pull a newer version than what was tested at publish time. The current resolved version (21.3.1) is unchanged.
44f6d7f: Align ESLint presets with the oxlint configs (the maintained source of truth). Mostly tightens ESLint where oxlint was stricter; a few documented behavioural exceptions oxlint carries (rule conflicts, bun:test compat) are mirrored back.

core — eslint.mjs now enforces complexity, no-unused-private-class-members, sort-keys, sort-vars, and full prefer-destructuring (object + array). typescript.mjs now enforces no-confusing-void-expression, no-misused-promises, prefer-readonly, strict-boolean-expressions, and sets return-await: ["error", "always"]. import.mjs now sets consistent-type-specifier-style: ["error", "prefer-top-level"].

next — added next-env.d.ts override that disables import-x/no-unassigned-import on the generated file.

remix — added routeTree.gen.ts override that disables unicorn/filename-case and unicorn/no-abusive-eslint-disable on the generated file.

react — disabled react/jsx-boolean-value, react/no-unknown-property, and react/only-export-components to match oxlint.

jest — broadened test globs to **/*.{test,spec}.{ts,tsx,js,jsx} + **/__tests__/**/*.{ts,tsx,js,jsx} (previously missed *.spec.* and __tests__/). Disabled no-empty-function and promise/prefer-await-to-then in test scope. Disabled jest/require-hook, jest/no-conditional-in-test, jest/no-hooks, jest/prefer-expect-assertions to mirror oxlint's bun:test/mocking accommodations.

vitest — same test-glob broadening; same no-empty-function / promise/prefer-await-to-then test-scope disables. Removed the prefer-importing-vitest-globals and prefer-to-have-been-called-times disables (oxlint enforces these). Added prefer-lowercase-title: off and valid-title: off to resolve the documented conflict with prefer-describe-function-title (#665).
63f6a18: Drop the redundant react-hooks/exhaustive-deps: "error" override in config/eslint/react/rules/react-hooks.mjs. The dynamic-enable pattern already sets every non-deprecated react-hooks/* rule to "error", so the override was dead code. No behavior change.
5a0ce67: Refresh the misleading header comment in config/eslint/core/rules/eslint-typescript.mjs. The disables for the formatting rules (brace-style, comma-dangle, indent, etc.) used to defer to @typescript-eslint's typed equivalents, but those rules were removed in v8. They're now disabled because Prettier/Oxfmt owns formatting. Updated the comment to reflect the actual rationale.
d681f70: Clean up config/eslint/core/rules/typescript.mjs: remove 22 stale overrides that referenced rules no longer present in @typescript-eslint/eslint-plugin v8.

Most were formatting rules moved out to @stylistic (block-spacing, brace-style, comma-dangle, comma-spacing, func-call-spacing, indent, key-spacing, keyword-spacing, lines-around-comment, lines-between-class-members, member-delimiter-style, no-extra-parens, object-curly-spacing, padding-line-between-statements, quotes, semi, space-before-blocks, space-before-function-paren, space-infix-ops, type-annotation-spacing). The remaining two (no-type-alias, sort-type-union-intersection-members) were removed/deprecated upstream. All were dead no-ops — no behavior change.

Configuration

📅 Schedule: (UTC)

Branch creation
- "on Monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

RENOVATE: Update all non-major dependencies

db15cc7

renovate Bot requested a review from a team as a code owner May 18, 2026 13:38

renovate Bot added the dependencies Pull requests that update a dependency file label May 18, 2026

renovate-approve Bot approved these changes May 18, 2026

View reviewed changes

renovate Bot merged commit 65464b8 into main May 18, 2026
4 checks passed

renovate Bot deleted the renovate/all-non-major branch May 18, 2026 22:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RENOVATE: Update all non-major dependencies#136

RENOVATE: Update all non-major dependencies#136
renovate[bot] merged 1 commit into
mainfrom
renovate/all-non-major

renovate Bot commented May 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.4.15

Patch Changes

v30.4.2

Fixes

v22.22.3: 2026-05-13, Version 22.22.3 'Jod' (LTS), @​marco-ippolito

Commits

v7.7.0

Minor Changes

Patch Changes

Configuration

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 18, 2026 •

edited

Loading

`v2.4.15`

`v30.4.2`

`v22.22.3`: 2026-05-13, Version 22.22.3 'Jod' (LTS), @marco-ippolito

`v7.7.0`