chore(deps): bump the bun-development-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the bun-development-minor-patch group with 6 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.14	2.5.15
@oxlint/plugins	1.85.0	1.86.0
@tauri-apps/cli	2.11.5	2.12.1
bits-ui	2.19.3	2.19.4
oxlint	1.85.0	1.86.0
vite	8.3.1	8.3.2

Updates @biomejs/biome from 2.5.14 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

• #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

  For example, the following snippet triggers the rule.

  function Component({ items = [] }) {
    return items;
  }

• #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

  <script>
    export let name;
  </script>

• #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

  {
    "linter": {
      "rules": {
        "nursery": {
          "useLogicalProperties": {
            "level": "warn",
            "options": {
              "direction": "rtl"
            }
          }
        }
      }
    }
  }

• #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

  import { page } from "$app/stores";

• #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

• 0b4c11f ci: release (#11815)
• ad5b362 feat: adds noAstroConflictingSetDirectives rule for .astro (#11494)
• 034366d chore: update codspeed logo in readme (#12019)
• 717db8c feat(lint): add noMisplacedListElements (#11917)
• 089bde0 feat(lint/js): add useStrictBooleanExpressions (#11750)
• 1fdb5c2 feat(lint/js/svelte): add useSvelteKitRuneImports lint rule (#11960)
• faa8b37 feat(lint/js/svelte): add noSvelteExportLet (#11956)
• b2b4400 chore: update sponsors (#11973)
• ff4c4dd feat(lint/js): add noMeaninglessVoidOperator (#11732)
• 1b9479e feat(lint): add useLogicalProperties rule (#10816)
• Additional commits viewable in compare view

Updates @oxlint/plugins from 1.85.0 to 1.86.0

Release notes

Sourced from @​oxlint/plugins's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• See full diff in compare view

Updates @tauri-apps/cli from 2.11.5 to 2.12.1

Release notes

Sourced from @​tauri-apps/cli's releases.

@​tauri-apps/cli v2.12.1

[2.12.1]

Enhancements

• 64bfdd909 (#16165 by @​Legend-Master) Ignore src-tauri in tauri plugin init example template

Dependencies

• Upgraded to tauri-cli@2.12.1

@​tauri-apps/cli v2.12.0

[2.12.0]

New Features

• f6c1eb253 (#15401) Added bundle.windows.bundleVCRuntime to copy the Visual C++ runtime DLLs into Windows MSI and NSIS installers. The bundler locates the runtime through VCTOOLS_REDIST_DIR or the bundled vswhere.exe.

• f76b1d3ae (#15644) The bundler now prints the size of each generated bundle next to its path in the Finished N bundles at: output (directories such as macOS .app bundles are measured recursively).

• af465eae1 (#15619) Add a --no-binary-patching flag to tauri build and tauri bundle. When set, the bundler skips patching the main executable with bundle type information (and the subsequent re-signing), leaving an already-signed binary untouched. Patching is only required when shipping multiple bundle types per platform that should each update with their own installer format.

• 0646cc162 (#15620) Add a --fit option to tauri icon to accept non-square source images. --fit cover center-crops the source to a square (clipping the longer side) and --fit contain pads the shorter side with transparency. Non-square sources without --fit keep erroring, now with a hint pointing to the flag.

• f6c1eb253 (#15401) Added build.windows.staticVCRuntime to control MSVC static runtime linking. The STATIC_VCRUNTIME environment variable is now deprecated and emits a migration warning when used.

• f45ec0dcf Record the app version in the trusted comment of updater signatures, so a signed artifact is bound to the version it was released as.

  An update endpoint response is not signed, and the signature only covers the downloaded artifact, so the announced version on its own does not prove which release the url and signature point at. minisign covers the trusted comment with its global signature, which lets the updater plugin compare the two and reject a response that pairs a version number with a different release. Enable requireSignedVersion in the updater plugin configuration to enforce this.

  tauri build fills the version in automatically, and tauri plugin add updater now enables requireSignedVersion for the project it is adding the plugin to. tauri signer sign gains an --app-version flag for signing updater artifacts by hand, and warns when it is omitted.

Enhancements

• e19121427 (#15993) Don't always rewrite Cargo.toml file from CRLF line endings to LF

• aebf38c84 (#15694) Migrate the Android Gradle scripts from the deprecated kotlinOptions DSL to compilerOptions, which is accepted by both Kotlin Gradle Plugin 1.9.x and 2.x. This lets projects move to Kotlin 2.x without hitting the hard error that 2.3+ raises on the old DSL.

  This increased the minimum supported Gradle version to 8.13, if your gradle is on an earlier version, delete src-tauri/gen/android/gradle/wrapper/gradle-wrapper.properties and re-run tauri android init to update it.

• d89d8fa62 (#15780) Warn during Android commands (init/dev/build) when the active Java version is too new for the Gradle version the project uses (e.g. Java 27 against the Gradle 9.6.1 the template ships, or Java 25 against a project still on Gradle 8.14), instead of letting the build fail later with a cryptic error. The warning points to the Gradle/Java compatibility matrix and suggests a supported JDK.

• c3d21bd60 (#15730) Use Theme.Material3.DayNight.NoActionBar instead of Theme.MaterialComponents.DayNight.NoActionBar when running tauri android init

• f654f470c (#15862) Update template to use targetSdk = 37

• cdaf7eab6 (#15765) Clarify that the tauri init frontend commands run before tauri dev and tauri build, and can be left empty when they are not needed.

• d0f38df06 (#15997) When stdin is not a terminal, tauri init now automatically skips prompts, avoiding IO errors in CI and scripts. This eliminates the need to pass --ci explicitly in non-interactive environments.

• ca160ad48 (#15895) tauri build now warns when productName is still set to the default tauri-app, since it names the generated bundles and is written into install paths and metadata that are expected to be unique to your application. The config documentation for productName now lists what the field controls on each platform, and identifier's documentation notes that the default value is rejected.

• 010f06bae (#15737) Document the TAURI_SIGNING_PRIVATE_KEY_PATH environment variable and clarify that TAURI_SIGNING_PRIVATE_KEY accepts a string or a path for the build and bundle command but must be the literal key string for the signer sign command, both in ENVIRONMENT_VARIABLES.md and in the signer generate command output.

Bug Fixes

• 9bad06b9f (#16096) tauri capability new and tauri permission new now accept an --out path to a file that does not exist yet, trim comma-separated prompt answers (so fs:default, core:default works), report invalid permissions as errors instead of panicking, and reject identifiers that are not valid file names (such as ../../x), which previously let them write outside of the capabilities or permissions directory.
• 9642b3087 (#16117) tauri add now honors --tag, --rev and --branch for official plugins instead of silently installing the registry version, and rejects passing more than one of them. With npm, the JS package requirement is now ~<version> like the other package managers, instead of >=<version> which allowed a later major version.
• cada1cd4f (#16105) Fix Android dev server port forwarding: adb reverse --list is now matched on the exact port (so tcp:80 no longer matches tcp:8080), stale forwards on other connected devices are actually removed, and the forward verification gives up with a warning after a few attempts instead of retrying forever.
• d5bd04658 (#16111) Fix bundle > android > debugApplicationIdSuffix being written to the signingConfigs debug block instead of the buildTypes one, and keep the existing content of single-line debug blocks such as getByName("debug") { isDebuggable = true } instead of dropping it.
• ba17da2e5 (#16101) tauri icon now generates 72x72 Android hdpi launcher icons (previously 49x49) and writes the Android launcher background color in #RRGGBB/#AARRGGBB notation instead of the raw CSS color string, which Android rejected or misread. Invalid SVG sources and --png 0 now return an error instead of panicking.
• 272842a57 (#16128) Fix error messages that printed placeholders such as {t} literally instead of the value, e.g. "Could not find an Android device matching {t}".
• 10ad4e54e (#16127) The Bash completions generated by tauri completions no longer replace the completions of cargo, npm, pnpm, yarn, bun and deno. They now define a _tauri_cli function registered only for the tauri and cargo-tauri commands. Generating completions when running the cargo-tauri binary directly no longer panics.

... (truncated)

Commits

• 30da1fd feat(ci): run audit before publishing
• 1aefcf6 fix: pnpm audit
• 026f260 apply version updates (#16150)
• a4dcca8 fix(plugin): skip build script writes on docs.rs builds (#16186)
• f040897 docs: link WRY and TAO to their repositories (#16163)
• c9a3cb8 fix: enable macos private apis regardless of feature flags (#16166)
• 64bfdd9 fix: ignore src-tauri in vite configs (#16165)
• 793f0c4 fix(window): copy WebView2Loader.dll for nightly (#16164)
• d15cf9b fix(bundler): make glob error variants available on all platforms (#16149)
• 447fa9f fix(core): tauri-utils publish
• Additional commits viewable in compare view

Updates bits-ui from 2.19.3 to 2.19.4

Release notes

Sourced from bits-ui's releases.

bits-ui@2.19.4

Patch Changes

• fix(PopperLayer): destructure the internal forceMount prop out of restProps so it stops leaking onto the rendered content element as an invalid forcemount attribute (Popover, Select, Combobox, DropdownMenu, ContextMenu, Menubar, Tooltip, LinkPreview) (#2176)

• fix(DismissibleLayer): dismiss on a touch tap even when the tapped element stops click propagation. Touch outside-dismissal waits for the tap's click on the document, and a bubbling listener never hears a click whose target handler calls stopPropagation(), so the layer stayed open behind elements that own their clicks. (#2155)

Commits

• cdf337d Version Packages (#2177)
• 9576fb2 fix(DismissibleLayer): dismiss on a touch tap whose target stops click propag...
• c9201cf fix(PopperLayer): don't render the internal forceMount prop as a DOM attrib...
• See full diff in compare view

Updates oxlint from 1.85.0 to 1.86.0

Release notes

Sourced from oxlint's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

Changelog

Sourced from oxlint's changelog.

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

... (truncated)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
• e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
• 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
• See full diff in compare view

Updates vite from 8.3.1 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

Commits

• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• 1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
• 6894f5c fix(server): handle file watcher errors without crashing (#23503)
• cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
• bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
• 5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f5cdde22-37c6-43e3-8bd2-97dd2e2d772c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed]

Merging this PR will not alter performance

✅ 30 untouched benchmarks
⏩ 15 skipped benchmarks¹

---

_{Comparing dependabot/bun/bun-development-minor-patch-9821f08068 (610be9e) with main (05975d2)}

Footnotes

1. 15 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩