fix(deps): update all non-major dependencies by renovate[bot] · Pull Request #49 · vikejs/vike-photon

renovate · 2026-01-05T02:14:51Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@biomejs/biome (source)	`^2.3.10` → `^2.3.11`
@brillout/vite-plugin-server-entry	`^0.7.15` → `^0.7.17`
elysia	`^1.4.19` → `^1.4.21`
standaloner	`^0.1.11` → `^0.2.2`
zod (source)	`^4.2.1` → `^4.3.5`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.3.11`

Compare Source

Patch Changes

#8583 83be210 Thanks @dyc3! - Added the new nursery rule useVueValidTemplateRoot.

This rule validates only root-level <template> elements in Vue single-file components. If the <template> has a src attribute, it must be empty. Otherwise, it must contain content.

Invalid examples:
```
<template src="./foo.html">content</template>
```
```
<template></template>
```
Valid examples:
```
<template>content</template>
```
```
<template src="./foo.html"></template>
```
#8586 df8fe06 Thanks @dyc3! - Added a new nursery rule useVueConsistentVBindStyle. Enforces consistent v-bind style (:prop shorthand vs v-bind:prop longhand). Default prefers shorthand; configurable via rule options.
#8587 9a8c98d Thanks @dyc3! - Added the rule useVueVForKey, which enforces that any element using v-for also specifies a key.

Invalid
```
<li v-for="item in items">{{ item }}</li>
```
Valid
```
<li v-for="item in items" :key="item.id">{{ item }}</li>
```
#8586 df8fe06 Thanks @dyc3! - Added a new nursery rule useVueConsistentVOnStyle. Enforces consistent v-on style (@event shorthand vs v-on:event longhand). Default prefers shorthand; configurable via rule options.
#8583 83be210 Thanks @dyc3! - Added the new nursery rule useVueValidVOnce. Enforces that usages of the v-once directive in Vue.js SFC are valid.
```

<div v-once />


<div v-once:aaa />
<div v-once.bbb />
<div v-once="ccc" />
```
#8498 d80fa41 Thanks @tt-a1i! - Fixed #8494. Extended noUndeclaredEnvVars to support bracket notation (process.env["VAR"], import.meta.env["VAR"]), Bun runtime (Bun.env.VAR, Bun.env["VAR"]), and Deno runtime (Deno.env.get("VAR")).
#8509 574a909 Thanks @ematipico! - Added support for parsing and formatting the Svelte {#await} syntax, when html.experimentalFullSupportEnabled is set to true.
```
-{#await promise  then name }
+{#await promise then name}

-{:catch    name}
+{:catch name}

{/await}
```
#8316 d64e92d Thanks @washbin! - Added the new nursery rule noMultiAssign. This rule helps to prevent multiple chained assignments.

For example, the following code triggers because there are two assignment expressions in the same statement.
```
const a = (b = 0);
```
#8592 a5f59cd Thanks @Netail! - Added the nursery rule useUniqueInputFieldNames. Require fields within an input object to be unique.

Invalid:
```
query A($x: Int, $x: Int) {
  field
}
```
#8524 17a6156 Thanks @JacquesLeupin! - Fixed #8488: Relative plugin paths are now resolved from the configuration file directory, including when configurations are merged (e.g. extends: "//").
#8655 3260ec9 Thanks @JacquesLeupin! - Fixed #8636: Biome's CSS formatter now breaks comma-separated declaration values at top-level commas when wrapping.

#8537 cc3e851 Thanks @dibashthapa! - Fixed #8491: Resolved false positive errors for safe boolean expressions. There are still pending fixes. Head to #8491 (comment) for more details

This new change will check for safe boolean expressions in variable declarations.

For example,

Valid:

let isOne = 1;
let isPositiveNumber = number > 0;

return (
  <div>
    {" "}
    {isOne && "One"} {isPositiveNumber && "Is positive"}
  </div>
);

Invalid:

let emptyStr = "";
let isZero = 0;

return (
  <div>
    {emptyStr && "Empty String"} {isZero && "Number is zero"}{" "}
  </div>
);

#8511 16a9036 Thanks @ematipico! - Improved the diagnostics of the rules useSortedClasses and noUnnecessaryConditions. The diagnostics now state that these rules are a work in progress and link to the relevant GitHub issue.
#8521 a704be9 Thanks @ToBinio! - Added the nursery rule useVueConsistentDefinePropsDeclaration, which enforces consistent defineProps declaration style.

Invalid

<script setup lang="ts">
const props = defineProps({
  kind: { type: String },
});
</script>

Valid

<script setup lang="ts">
const props = defineProps<{
  kind: string;
}>();
</script>

#8595 7c85bf0 Thanks @dyc3! - Fixed #8584: The HTML formatter will preserve whitespace after some elements and embedded expressions, which more closely aligns with Prettier's behavior.
```
- <h1>Hello, {framework}and Svelte!</h1>
+ <h1>Hello, {framework} and Svelte!</h1>
```
#8598 5e85d43 Thanks @Netail! - Added the nursery rule useUniqueFieldDefinitionNames. Require all fields of a type to be unique.

Invalid:
```
type SomeObject {
  foo: String
  foo: String
}
```
#8495 b573d14 Thanks @taga3s! - Fixed #8405: noMisusedPromises now emits warnings/errors when a function returns union types such as T | Promise<T> which is used in conditionals.
```
const a = (): boolean | Promise<boolean> => Promise.resolve(true);
if (a()) {
} // Now correctly flagged
```
#8632 0be7d12 Thanks @Bertie690! - The documentation & rule sources for lint/complexity/noBannedTypes have been updated to fix a few oversights.

In addition to some general typo fixes:
- The rule now recommends Record<keyof any, never> instead of Record<string, never> (the latter of which incorrectly allows symbol-keyed properties).
- The rule mentions an alternate method to enforce object emptiness involving unique symbol-based guards used by type-fest and many other packages:
```
declare const mySym: unique symbol;

// Since this type's only property is an unexported `unique symbol`, nothing that imports it can specify any properties directly
// (as far as excess property checks go)
export type EmptyObject = { [mySym]?: never };
export type IsEmptyObject<T> = T extends EmptyObject ? true : false;
```
The rule's listed sources have been updated as well to reflect the original source rule (ban-types) having been split into 3 separate rules circa April 2024.
#8580 a3a1ad2 Thanks @taga3s! - Added the nursery rule noBeforeInteractiveScriptOutsideDocument to the Next.js domain.
This rule prevents usage of next/script's beforeInteractive strategy outside of pages/_document.js.
#8493 5fc24f4 Thanks @ematipico! - Added support for parsing and formatting the Svelte {#each} syntax, when html.experimentalFullSupportEnabled is set to true.
```
- {#each items   as item  }
+ {#each items as item}

{/each}
```
#8546 0196c0e Thanks @Zaczero! - Hardened union static-member type flattening in edge cases (e.g. unions containing unknown or inferred expression types). This keeps inference conservative and avoids unstable type growth in node = node.parent-style loops.
#8569 1022c76 Thanks @ematipico! - Fixed an issue where the Biome HTML parser would emit a parse error when certain keywords are inside the text of HTML tags.
#8606 f50723b Thanks @dyc3! - Fixed #8563: fixed a bounds check on bogus regex literals that caused panics when doing type inference
#7410 ab9af9a Thanks @sgarcialaguna! - Added the new nursery rule noJsxPropsBind. This rule disallows .bind(), arrow functions, or function expressions in JSX props.

Invalid:
```
<Foo onClick={() => console.log("Hello!")}></Foo>
```
#8523 5f22f1c Thanks @ematipico! - Improved the diagnostics of nursery rules. Added a message to diagnostics emitted by nursery rules, so that users are aware of nature of nursery rules.
#8571 03666fd Thanks @dyc3! - Improved the performance of noRedeclare by eliminating string allocations
#8591 9dd9ca7 Thanks @Netail! - Added the nursery rule useUniqueArgumentNames. Enforce unique arguments for GraphQL fields & directives.

Invalid:
```
query {
  field(arg1: "value", arg1: "value")
}
```
#8521 a704be9 Thanks @ToBinio! - Update useVueDefineMacrosOrder to only run on <script setup> blocks.
#8344 7b982ba Thanks @ematipico! - Reduced the system calls when running the CLI. The performances might be noticeable in big projects that have multiple libraries and enable project rules.
#8588 958e24b Thanks @Netail! - Added the nursery rule useUniqueVariableNames. Enforce unique variable names for GraphQL operations.

Invalid:
```
query ($x: Int, $x: Int) {
  field
}
```
#8529 8794883 Thanks @mdevils! - Fixed #8499: useExhaustiveDependencies properly handles aliased destructured object keys when using stableResult configuration.
#8557 4df2f4d Thanks @dyc3! - Fixed an issue with the HTML formatter where it wouldn't add a space before the /> in self closing elements. This brings the HTML formatter more in line with Prettier.
```
-<Component/>
+<Component />
```
#8509 574a909 Thanks @ematipico! - Added support for parsing and formatting the Svelte {#snippet} syntax, when html.experimentalFullSupportEnabled is set to true.
```
-{#snippet    foo() }
+{#snippet foo()}

{/snippe}
```
#8248 1231a5c Thanks @emilyinure! - Added new nursery rule noReturnAssign, which disallows assignments inside return statements.

Invalid:
```
function f(a) {
  return (a = 1);
}
```
#8531 6b09620 Thanks @taga3s! - Fixed #8472: The CSS parser can now accept multiple comma separated parameters in :active-view-transition-type.
#8615 b9da66d Thanks @taga3s! - Remove next/script component name check from noBeforeInteractiveScriptOutsideDocument since it is a default export.
#8536 efbfbe2 Thanks @dyc3! - Fixed #8527: Improved type inference where analyzing code with repeated object property access and assignments (e.g. node = node.parent, a pattern common when traversing trees in a while loop) could hit an internal type limit. Biome now handles these cases without exceeding the type limit.
#8583 83be210 Thanks @dyc3! - Added the new nursery rule useVueValidVCloak. Enforces that usages of the v-cloak directive in Vue.js SFC are valid.
```

<div v-cloak />


<div v-cloak:aaa />
<div v-cloak.bbb />
<div v-cloak="ccc" />
```
#8583 83be210 Thanks @dyc3! - Added the new nursery rule useVueValidVPre. Enforces that usages of the v-pre directive in Vue.js SFC are valid.
```

<div v-pre />


<div v-pre:aaa />
<div v-pre.bbb />
<div v-pre="ccc" />
```
#8644 a3a27a7 Thanks @JacquesLeupin! - Added the nursery rule useVueVapor to enforce <script setup vapor> in Vue SFCs. For example <script setup> is invalid.
#8508 b86842c Thanks @tt-a1i! - Fixed #6783: now, when a path is provided via --stdin-file-path, Biome checks whether the file exists on disk. If the path doesn't exist (virtual path), ignore checks (files.includes and VCS ignore rules) are skipped.

brillout/vite-plugin-server-entry (@brillout/vite-plugin-server-entry)

`v0.7.17`

Compare Source

Bug Fixes

automatically skip auto import if no filesystem access (b42d618)
disableAutoImport => don't touch filesystem (9f6b416)
remove CJS build (e17b168)

`v0.7.16`

Compare Source

Bug Fixes

write to filesystem only if required (70a0422)

elysiajs/elysia (elysia)

`v1.4.21`

Compare Source

Improvement:

#1654 encode t.Date() to iso string
#1624 apply macros before merging hooks in group method

Bug fix:

call Sucrose GC unref when possible (browser fallback)
add allowUnsafeValidationDetails to Standard Validator

`v1.4.20`

Compare Source

Improvement:

add ModelValidator.schema for accessing raw schema
#1636 add subscriptions to Elysia.ws context
#1638 unref Sucrose gc

Bug fix:

#1649 add null check for object properties (t.Record)
#1646 use constant-time comparison for signed cookie verification
#1639 compose: ReferenceError: "_r_r is not defined" when onError returns plain object & mapResponse exists
#1631 update Exact Mirror to 0.2.6
#1630 enforce fetch to return MaybePromise

Bug fix:

Elysia.models broke when referencing non typebox model

colinhacks/zod (zod)

`v4.3.5`

Compare Source

Commits:

21afffd [Docs] Update migration guide docs for deprecation of message (#5595)
e36743e Improve mini treeshaking
0cdc0b8 4.3.5

`v4.3.4`

Compare Source

Commits:

1a8bea3 Add integration tests
e01cd02 Support patternProperties for looserecord (#5592)
089e5fb Improve looseRecord docs
decef9c Fix lint
9443aab Drop iso time in fromJSONSchema
66bda74 Remove .refine() from ZodMiniType
b4ab94c 4.3.4

Commits:

0fe8840 allow non-overwriting extends with refinements. 4.3.1

`v4.3.0`

Compare Source

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

`z.fromJSONSchema()`

Convert JSON Schema to Zod (#5534, #5586)

You can now convert JSON Schema definitions directly into Zod schemas. This function supports JSON Schema "draft-2020-12", "draft-7", "draft-4", and OpenAPI 3.0.

import * as z from "zod";

const schema = z.fromJSONSchema({
  type: "object",
  properties: {
    name: { type: "string", minLength: 1 },
    age: { type: "integer", minimum: 0 },
  },
  required: ["name"],
});

schema.parse({ name: "Alice", age: 30 }); // ✅

The API should be considered experimental. There are no guarantees of 1:1 "round-trip soundness": MySchema > z.toJSONSchema() > z.fromJSONSchema(). There are several features of Zod that don't exist in JSON Schema and vice versa, which makes this virtually impossible.

Features supported:

All primitive types (string, number, integer, boolean, null, object, array)
String formats (email, uri, uuid, date-time, date, time, ipv4, ipv6, and more)
Composition (anyOf, oneOf, allOf)
Object constraints (additionalProperties, patternProperties, propertyNames)
Array constraints (prefixItems, items, minItems, maxItems)
$ref for local references and circular schemas
Custom metadata is preserved

`z.xor()` — exclusive union (#5534)

A new exclusive union type that requires exactly one option to match. Unlike z.union() which passes if any option matches, z.xor() fails if zero or more than one option matches.

const schema = z.xor([z.string(), z.number()]);

schema.parse("hello"); // ✅
schema.parse(42);      // ✅
schema.parse(true);    // ❌ zero matches

When converted to JSON Schema, z.xor() produces oneOf instead of anyOf.

`z.looseRecord()` — partial record validation (#5534)

A new record variant that only validates keys matching the key schema, passing through non-matching keys unchanged. This is used to represent patternProperties in JSON Schema.

const schema = z.looseRecord(z.string().regex(/^S_/), z.string());

schema.parse({ S_name: "John", other: 123 });
// ✅ { S_name: "John", other: 123 }
// only S_name is validated, "other" passes through

`.exactOptional()` — strict optional properties (#5589)

A new wrapper that makes a property key-optional (can be omitted) but does not accept undefined as an explicit value.

const schema = z.object({
  a: z.string().optional(),      // accepts `undefined`
  b: z.string().exactOptional(), // does not accept `undefined`
});

schema.parse({});                  // ✅
schema.parse({ a: undefined });    // ✅
schema.parse({ b: undefined });    // ❌

This makes it possible to accurately represent the full spectrum of optionality expressible using exactOptionalPropertyTypes.

`.apply()`

A utility method for applying arbitrary transformations to a schema, enabling cleaner schema composition. (#5463)

const setCommonChecks = <T extends z.ZodNumber>(schema: T) => {
  return schema.min(0).max(100);
};

const schema = z.number().apply(setCommonChecks).nullable();

`.brand()` cardinality

The .brand() method now accepts a second argument to control whether the brand applies to input, output, or both. Closes #4764, #4836.

// output only (default)
z.string().brand<"UserId">();           // output is branded (default)
z.string().brand<"UserId", "out">();    // output is branded
z.string().brand<"UserId", "in">();     // input is branded
z.string().brand<"UserId", "inout">();  // both are branded

Type predicates on `.refine()` (#5575)

The .refine() method now supports type predicates to narrow the output type:

const schema = z.string().refine((s): s is "a" => s === "a");

type Input = z.input<typeof schema>;   // string
type Output = z.output<typeof schema>; // "a"

`ZodMap` methods: `min`, `max`, `nonempty`, `size` (#5316)

ZodMap now has parity with ZodSet and ZodArray:

const schema = z.map(z.string(), z.number())
  .min(1)
  .max(10)
  .nonempty();

schema.size; // access the size constraint

`.with()` alias for `.check()` (359c0db)

A new .with() method has been added as a more readable alias for .check(). Over time, more APIs have been added that don't qualify as "checks". The new method provides a readable alternative that doesn't muddy semantics.

z.string().with(
  z.minLength(5),
  z.toLowerCase()
);

// equivalent to:
z.string().check(
  z.minLength(5),
  z.trim(),
  z.toLowerCase()
);

`z.slugify()` transform

Transform strings into URL-friendly slugs. Works great with .with():

// Zod
z.string().slugify().parse("Hello World");           // "hello-world"

// Zod Mini
// using .with() for explicit check composition
z.string().with(z.slugify()).parse("Hello World");   // "hello-world"

`z.meta()` and `z.describe()` in Zod Mini (947b4eb)

Zod Mini now exports z.meta() and z.describe() as top-level functions for adding metadata to schemas:

import * as z from "zod/mini";

// add description
const schema = z.string().with(
  z.describe("A user's name"),
);

// add arbitrary metadata
const schema2 = z.number().with(
  z.meta({ deprecated: true })
);

New locales

Armenian (am) (#5531)
Uzbek (uz) (#5519)

import * as z from "zod";
import { uz } from "zod/locales";

z.config(uz());

Bug fixes

All of these changes fix soundness issues in Zod. As with any bug fix there's some chance of breakage if you were intentionally or unintentionally relying on this unsound behavior.

⚠️ `.pick()` and `.omit()` disallowed on object schemas containing refinements (#5317)

Using .pick() or .omit() on object schemas with refinements now throws an error. Previously, this would silently drop the refinements, leading to unexpected behavior.

const schema = z.object({
  password: z.string(),
  confirmPassword: z.string(),
}).refine(data => data.password === data.confirmPassword);

schema.pick({ password: true });
// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ❌

Migration: The easiest way to migrate is to create a new schema using the shape of the old one.

const newSchema = z.object(schema.shape).pick({ ... })

⚠️ `.extend()` disallowed on refined schemas (#5317)

Similarly, .extend() now throws on schemas with refinements. Use .safeExtend() if you need to extend refined schemas.

const schema = z.object({ a: z.string() }).refine(/* ... */);

// 4.2: refinement silently dropped ⚠️
// 4.3: throws error ✅
schema.extend({ b: z.number() });
// error: object schemas containing refinements cannot be extended. use `.safeExtend()` instead.

⚠️ Stricter object masking methods (#5581)

Object masking methods (.pick(), .omit()) now validate that the keys provided actually exist in the schema:

const schema = z.object({ a: z.string() });

// 4.3: throws error for unrecognized keys
schema.pick({ nonexistent: true });
// error: unrecognized key: "nonexistent"

Additional changes

Fixed JSON Schema generation for z.iso.time with minute precision (#5557)
Fixed error details for tuples with extraneous elements (#5555)
Fixed includes method params typing to accept string | $ZodCheckIncludesParams (#5556)
Fixed numeric formats error messages to be inclusive (#5485)
Fixed implementAsync inferred type to always be a promise (#5476)
Tightened E.164 regex to require a non-zero leading digit and 7–15 digits total (#5524)
Fixed Dutch (nl) error strings (#5529)
Convert Date instances to numbers in minimum/maximum checks (#5351)
Improved numeric keys handling in z.record() (#5585)
Lazy initialization of ~standard schema property (#5363)
Functions marked as @__NO_SIDE_EFFECTS__ for better tree-shaking (#5475)
Improved metadata tracking across child-parent relationships (#5578)
Improved locale translation approach (#5584)
Dropped id uniqueness enforcement at registry level (#5574)

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-01-05T02:14:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
vike-photon-demo	Ready	Preview, Comment	Jan 5, 2026 2:15am

fix(deps): update all non-major dependencies

8947586

renovate Bot added the dependencies label Jan 5, 2026

renovate Bot assigned magne4000 Jan 5, 2026

renovate Bot added the dependencies label Jan 5, 2026

vercel Bot deployed to Preview January 5, 2026 02:15 View deployment

magne4000 merged commit ca6092a into main Jan 5, 2026
7 checks passed

magne4000 deleted the renovate/all-minor-patch branch January 5, 2026 14:37

Navigation Menu

Uh oh!

fix(deps): update all non-major dependencies - #49

fix(deps): update all non-major dependencies#49
magne4000 merged 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jan 5, 2026

Uh oh!

vercel Bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jan 5, 2026

Release Notes

Patch Changes

Invalid

Valid

Bug Fixes

Bug Fixes

Commits:

Commits:

Commits:

z.fromJSONSchema()

z.xor() — exclusive union (#​5534)

z.looseRecord() — partial record validation (#​5534)

.exactOptional() — strict optional properties (#​5589)

.apply()

.brand() cardinality

Type predicates on .refine() (#​5575)

ZodMap methods: min, max, nonempty, size (#​5316)

.with() alias for .check() (359c0db)

z.slugify() transform

z.meta() and z.describe() in Zod Mini (947b4eb)

New locales

Bug fixes

⚠️ .pick() and .omit() disallowed on object schemas containing refinements (#​5317)

⚠️ .extend() disallowed on refined schemas (#​5317)

⚠️ Stricter object masking methods (#​5581)

Additional changes

Configuration

Uh oh!

vercel Bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`z.fromJSONSchema()`

`z.xor()` — exclusive union (#5534)

`z.looseRecord()` — partial record validation (#5534)

`.exactOptional()` — strict optional properties (#5589)

`.apply()`

`.brand()` cardinality

Type predicates on `.refine()` (#5575)

`ZodMap` methods: `min`, `max`, `nonempty`, `size` (#5316)

`.with()` alias for `.check()` (359c0db)

`z.slugify()` transform

`z.meta()` and `z.describe()` in Zod Mini (947b4eb)

⚠️ `.pick()` and `.omit()` disallowed on object schemas containing refinements (#5317)

⚠️ `.extend()` disallowed on refined schemas (#5317)

⚠️ Stricter object masking methods (#5581)

vercel Bot commented Jan 5, 2026 •

edited

Loading