chore(deps): bump the dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates in the / directory:

Package	From	To
commander	14.0.2	14.0.3
log-update	7.0.2	7.1.0
ora	9.0.0	9.3.0
zod	4.1.13	4.3.6
@biomejs/biome	2.3.8	2.3.14
@types/node	24.10.1	25.2.2
knip	5.72.0	5.83.1

Updates commander from 14.0.2 to 14.0.3

Release notes

Sourced from commander's releases.

v14.0.3

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)
• simple readability improvements to README (#2465)

Changelog

Sourced from commander's changelog.

[14.0.3] (2026-01-31)

Added

• Release Policy document (#2462)

Changes

• old major versions now supported for 12 months instead of just previous major version, to give predictable end-of-life date (#2462)
• clarify typing for deprecated callback parameter to .outputHelp() (#2427)
• simple readability improvements to README (#2465)

Commits

• 8247364 14.0.3
• e281fe3 Update docs for 14.0.3 (#2474)
• 7357dda Separate out a more detailed release policy document (#2462)
• b6e2e3a Bump eslint from 9.39.1 to 9.39.2 (#2470)
• d6f63a7 Bump ts-jest from 29.4.5 to 29.4.6 (#2467)
• 2a9768a Bump prettier from 3.6.2 to 3.7.4 (#2466)
• 9211918 docs(README): Tweak formatting, punctuation for clarity (#2465)
• 4208a96 Bump typescript-eslint from 8.46.2 to 8.48.0 (#2458)
• 03308ce Bump eslint-plugin-jest from 29.0.1 to 29.2.1 (#2457)
• 4d2db1f Bump globals from 16.4.0 to 16.5.0 (#2456)
• Additional commits viewable in compare view

Updates log-update from 7.0.2 to 7.1.0

Release notes

Sourced from log-update's releases.

v7.1.0

• Add synchronized output rendering 45e9b84

---

sindresorhus/log-update@v7.0.2...v7.1.0

Commits

• fcbbae6 7.1.0
• 45e9b84 Add synchronized output rendering
• See full diff in compare view

Updates ora from 9.0.0 to 9.3.0

Release notes

Sourced from ora's releases.

v9.3.0

• Reduce flicker in rendering 2ab4f76

---

sindresorhus/ora@v9.2.0...v9.3.0

v9.2.0

• Update stdin-discarder dependency (#251) 020eaba

---

sindresorhus/ora@v9.1.0...v9.2.0

v9.1.0

• Support external writes to stream (console.log) while spinning d2b543a
• Replace strip-ansi dependency with native stripVTControlCharacters (#249) 68d50e5

---

sindresorhus/ora@v9.0.0...v9.1.0

Commits

• 4496362 9.3.0
• 2ab4f76 Reduce flicker in rendering
• 8d17b13 Add FAQ item
• 4cf47fc Add more tests for discardStdin
• 9763e60 Document Ctrl+C behavior for discardStdin
• 5408a1e 9.2.0
• 020eaba Update stdin-discarder dependency (#251)
• d7e3a94 9.1.0
• d2b543a Support external writes to stream while spinning
• 68d50e5 Replace strip-ansi with native stripVTControlCharacters (#249)
• See full diff in compare view

Updates zod from 4.1.13 to 4.3.6

Release notes

Sourced from zod's releases.

v4.3.6

Commits:

• 9977fb0868432461de265a773319e80a90ba3e37 Add brand.dev to sponsors
• f4b7bae3468f6188b8f004e007d722148fc91d77 Update pullfrog.yml (#5634)
• 251d7163a0ac7740fee741428d913e3c55702ace Clean up workflow_call
• edd4132466da0f5065a8e051b599d01fdd1081d8 fix: add missing User-agent to robots.txt and allow all (#5646)
• 85db85e9091d0706910d60c7eb2e9c181edd87bd fix: typo in codec.test.ts file (#5628)
• cbf77bb12bdfda2e054818e79001f5cb3798ce76 Avoid non null assertion (#5638)
• dfbbf1c1ae0c224b8131d80ddf0a264262144086 Avoid re-exported star modules (#5656)
• 762e911e5773f949452fd6dd4e360f2362110e8e Generalize numeric key handling
• ca3c8629c0c2715571f70b44c2433cad3db7fe4e v4.3.6

v4.3.5

Commits:

• 21afffdb42ccab554036312e33fed0ea3cb8f982 [Docs] Update migration guide docs for deprecation of message (#5595)
• e36743e513aadb307b29949a80d6eb0dcc8fc278 Improve mini treeshaking
• 0cdc0b8597999fd9ca99767b912c1e82c1ff2d6c 4.3.5

v4.3.4

Commits:

• 1a8bea3b474eada6f219c163d0d3ad09fadabe72 Add integration tests
• e01cd02b2f23d7e9078d3813830b146f8a2258b4 Support patternProperties for looserecord (#5592)
• 089e5fbb0f58ce96d2c4fb34cd91724c78df4af5 Improve looseRecord docs
• decef9c418d9a598c3f1bada06891ba5d922c5cd Fix lint
• 9443aab00d44d5d5f4a7eada65fc0fc851781042 Drop iso time in fromJSONSchema
• 66bda7491a1b9eab83bdeec0c12f4efc7290bd48 Remove .refine() from ZodMiniType
• b4ab94ca608cd5b581bfc12b20dd8d95b35b3009 4.3.4

v4.3.3

Commits:

• f3b2151959d215d405f54dff3c7ab3bf1fd887ca v4.3.3

v4.3.2

Commits:

• bf96635d243118de6e4f260077aa137453790bf6 Loosen strictObjectinside intersection (#5587)
• f71dc0182ab0f0f9a6be6295b07faca269e10179 Remove Juno (#5590)
• 0f41e5a12a43e6913c9dcb501b2b5136ea86500d 4.3.2

v4.3.1

Commits:

• 0fe88407a4149c907929b757dc6618d8afe998fc allow non-overwriting extends with refinements. 4.3.1

v4.3.0

This is Zod's biggest release since 4.0. It addresses several of Zod's longest-standing feature requests.

... (truncated)

Commits

• ca3c862 v4.3.6
• 762e911 Generalize numeric key handling
• dfbbf1c Avoid re-exported star modules (#5656)
• cbf77bb Avoid non null assertion (#5638)
• 85db85e fix: typo in codec.test.ts file (#5628)
• edd4132 fix: add missing User-agent to robots.txt and allow all (#5646)
• 251d716 Clean up workflow_call
• f4b7bae Update pullfrog.yml (#5634)
• 9977fb0 Add brand.dev to sponsors
• 0cdc0b8 4.3.5
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.3.8 to 2.3.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.14

2.3.14

Patch Changes

• #8921 29e2435 Thanks @​siketyan! - Fixed #8759: The useConsistentTypeDefinitions rule no longer converts empty object type declarations into interfaces, as it will conflict with the noEmptyInterface rule and can cause an infinite loop when both rules are enabled.

• #8928 ccaeac4 Thanks @​taga3s! - Added the nursery rule useGlobalThis. This rule enforces using globalThis over window, self and global.

• #8602 9a18daa Thanks @​dyc3! - Added the new nursery rule noVueArrowFuncInWatch. This rule forbids using arrow functions in watchers in Vue components, because arrow functions do not give access to the component instance (via this), while regular functions do.

• #8905 9b1eea8 Thanks @​ryan-m-walker! - Fixed #8428: Improved parsing recovery when encountering qualified rules inside CSS @page at-rule blocks.

• #8900 f788cff Thanks @​mdevils! - Fixed #8802: useExhaustiveDependencies now correctly suggests dependencies without including callback-scoped variables or method names.

  When accessing object properties with a callback-scoped variable, only the object path is suggested:

  // Now correctly suggests `props.value` instead of `props.value[day]`
  useMemo(() => {
    return WeekdayValues.filter((day) => props.value[day]);
  }, [props.value]);

  When calling methods on objects, only the object is suggested as a dependency:

  // Now correctly suggests `props.data` instead of `props.data.forEach`
  useMemo(() => {
    props.data.forEach((item) => console.log(item));
  }, [props.data]);

• #8913 e1e20ea Thanks @​dyc3! - Fixed #8363: HTML parser no longer crashes when encountering a < character followed by a digit in text content (e.g., <12 months). The parser now correctly emits an "Unescaped < bracket character" error instead of treating <12 as a tag name and crashing.

• #8910 2fb63a4 Thanks @​dyc3! - Fixed #8774: Type aliases with generic parameters that have extends constraints now properly indent comments after the equals sign.

  Previously, comments after the = in type aliases with extends constraints were not indented:

  -type A<B, C extends D> = // Some comment
  -undefined;
  +type A<B, C extends D> =
  +    // Some comment
  +    undefined;

• #8916 ea4bd04 Thanks @​ryan-m-walker! - Fixed #4013, where comments in member chains caused unnecessary line breaks.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.14

Patch Changes

• #8921 29e2435 Thanks @​siketyan! - Fixed #8759: The useConsistentTypeDefinitions rule no longer converts empty object type declarations into interfaces, as it will conflict with the noEmptyInterface rule and can cause an infinite loop when both rules are enabled.

• #8928 ccaeac4 Thanks @​taga3s! - Added the nursery rule useGlobalThis. This rule enforces using globalThis over window, self and global.

• #8602 9a18daa Thanks @​dyc3! - Added the new nursery rule noVueArrowFuncInWatch. This rule forbids using arrow functions in watchers in Vue components, because arrow functions do not give access to the component instance (via this), while regular functions do.

• #8905 9b1eea8 Thanks @​ryan-m-walker! - Fixed #8428: Improved parsing recovery when encountering qualified rules inside CSS @page at-rule blocks.

• #8900 f788cff Thanks @​mdevils! - Fixed #8802: useExhaustiveDependencies now correctly suggests dependencies without including callback-scoped variables or method names.

  When accessing object properties with a callback-scoped variable, only the object path is suggested:

  // Now correctly suggests `props.value` instead of `props.value[day]`
  useMemo(() => {
    return WeekdayValues.filter((day) => props.value[day]);
  }, [props.value]);

  When calling methods on objects, only the object is suggested as a dependency:

  // Now correctly suggests `props.data` instead of `props.data.forEach`
  useMemo(() => {
    props.data.forEach((item) => console.log(item));
  }, [props.data]);

• #8913 e1e20ea Thanks @​dyc3! - Fixed #8363: HTML parser no longer crashes when encountering a < character followed by a digit in text content (e.g., <12 months). The parser now correctly emits an "Unescaped < bracket character" error instead of treating <12 as a tag name and crashing.

• #8910 2fb63a4 Thanks @​dyc3! - Fixed #8774: Type aliases with generic parameters that have extends constraints now properly indent comments after the equals sign.

  Previously, comments after the = in type aliases with extends constraints were not indented:

  -type A<B, C extends D> = // Some comment
  -undefined;
  +type A<B, C extends D> =
  +    // Some comment
  +    undefined;

• #8916 ea4bd04 Thanks @​ryan-m-walker! - Fixed #4013, where comments in member chains caused unnecessary line breaks.

  // Before

... (truncated)

Commits

• 3a38d5c ci: release (#8888)
• 4561751 feat(linter): add rule noRedundantDefaultExport (#8931)
• ccaeac4 feat(biome_js_analyze): implement useGlobalThis (#8928)
• d876a38 feat(lint): implement useConsistentMethodSignatures from `typescript-eslint...
• 9a18daa feat(analyze/js/vue): add noVueArrowFuncInWatch (#8602)
• 3531687 feat(lint/css): add noDeprecatedMediaType (#8861)
• 95f1eea feat(lint/css): add noHexColors (#8860)
• d78e01d feat(graphql_analyze): implement useInputName (#8619)
• 2c5e505 ci: release (#8853)
• ac3a71f feat(js_analyze): implement useConsistentEnumValueType (#8714)
• Additional commits viewable in compare view

Updates @types/node from 24.10.1 to 25.2.2

Commits

• See full diff in compare view

Updates knip from 5.72.0 to 5.83.1

Release notes

Sourced from knip's releases.

Release 5.83.1

• Fix package.json import (f8c14c873127481927306751479001d16deafa58)
• Organize imports (5d716bae3919b3cd684f0c8c9af73a960d12c5cd)
• Update a bunch of dependencies (78bf644bbfc6554109d7098f83cd30fc8e115900)
• Add minimal test suite to vscode-knip (b6395089f6b307a145d2493bca59db9d5bc3364a)
• Add support for monorepo when installing dependency (close #1501) (5782b07f79eb1a25f90c5fdd62b1217db11246b1)
• Fix unused file output in table (0f3dbb47b850e731c4405e06809aa069f68c7608)
• Restore slonik in ecosystem tests (35d9185a39cb1efba55ce8a749d3eb9a31eb82a4)
• Fix type in exported value case (resolve #1508) (d6dda74021a2bc08931691ba1d10029102b0e425)
• Organize imports (fcdd33b9e8f9169cc0bfb921b468f163ec0f980f)
• Remove unused export (c777bae22c500606857d9df820aab8af7593b24e)
• Don't flag exports (including used as type) in protected or consumed exports (a01bec149b8977e0927bd1ecd9d0197a1626e3a6)
• Add npmx.dev to ecosystem tests (8f8205261fe88144df6cf0cde6e7007952f8ba1d)
• fix: fix vitest setupFiles resolution (#1511) (273b940f7e32ff7156c3a24875f5d9265ff2559a) - thanks @​tmair!
• Improve & extend vitest args handling (6c49e5ca61866a8d3fe62aaf8f5a6764aa9c4e86)
• Detect Bun differently to avoid TS complaint (c1499d32332751fbbed4baa648f5360f1db36dbc)
• A temporary workaround until they catch up 🤫 (028b9726dfab717a41d95d7e73ad8ee2ca929d31)
• feat(vite): detect module entry from index.html (#1487) (a76ab85337c5459a0d22128d33d5fcd9e3623db6) - thanks @​WooWan!
• Auto-format (69150bfd315dff04778f067438194122e4d50761)
• Add double-dash handling and add tests (close #1404) (4c1de75890c53f35529b6ea6f24e159c9532bedf)
• Revert most of previous commit 4c1de75 (0cd91ae44ee1bddc584c2fb7494147aeb3f53feb)
• Auto-format (cf3d8ff92cb53b769814c4140b3c56023d92fd27)

Release 5.83.0

• fix: skip empty string entries in package.json exports (#1477) (6b64ac5b89916869a2361077a51dc28adb4679df) - thanks @​SBoudrias!
• add LS version to serverInfo (#1468) (2c28cb8dc8923d83800959a7a259b439d5c50a0e) - thanks @​niklas-wortmann!
• Avoid highlighting path-like specifiers (#1488) (c8fec09666ad0ce145e1d2bbf99737a6bc95fd05) - thanks @​azat-io!
• Update avatar URLs (#1489) (d612ac2dab39a560875c53b9cccb3d920caafdd1) - thanks @​azat-io!
• Copy fix-fixtures to tmp dir (bd1519c30bb0a4004cfae463f10f8b066b778d95)
• Don't add excluded issue types (resolve #1486) (4eeeec602a8275f8f8d4252157ed6fa3cdd83f24)
• Minor refactor (767b2c5927d940f8815d157c2fa50c67f0a80d63)
• Edit docs (78111c96f54da3c41cfb84bd972bb5e836e1b859)
• feat: add plugin for expressive-code (#1493) (fbf958a9bfb2d913c345c98283a793a7f10faae5) - thanks @​cylewaitforit!
• Truncate file path left-side (resolves #1494) (235949c0b68e0bf2f3eb9ef0f3f88e750984e70a)
• Revert fix-fixture format test (fails in outside cwd) (8e961259bddef4652ae3b98387d1afa8514429ec)
• Skip empty manifest entries (resolve #1497) (d314ce43e7f9fe26125db167c1a8af4728329828)
• Filter out empty issue objects in compact reporter (resolve #1482) (7df0b4d8ee888f524132cd96260e18b870e8c57c)
• Lint/group import statements (61e7a24460e11bd2e9e27e9a791953eb004947df)
• Update AGENTS.md & docs (7537f8a1c474ce931a05a06efcc238eef5806447)
• Optimize relative path helper (ac8a45454f9e8d88898141e112897803c844f803)
• Move postinstall script to non-production (360110bed44d77da4ed5e553a63986176d2ed716)
• Ignore simple-git-hooks in production (like husky etc) (bbab35b144080d061641b6b6a6545176e5286553)
• Move & add testimonials (5ab18133b0e375508b34014085e10b78dcfd88ff)
• Update sponsors page (4534a55e37f804bfdef65522354b053f28a5a8f2)
• Edit docs, add config hints page (1a73a053dad914025e330c03cabaf9ded2444e91)
• Rename reporter to match project style (58f8c4e476b8a051dd27fdf27859014c4954289b)
• Auto-format (854124f7b5436436d57c5249f9b64f53e71e1994)
• Refactor fs helper to match project style (f22e7e94a48ac0dedf41985f3928ff556d04d727)

Release 5.82.1

... (truncated)

Commits

• 801d588 Release knip@5.83.1
• cf3d8ff Auto-format
• 0cd91ae Revert most of previous commit 4c1de75
• 4c1de75 Add double-dash handling and add tests (close #1404)
• 69150bf Auto-format
• a76ab85 feat(vite): detect module entry from index.html (#1487)
• c1499d3 Detect Bun differently to avoid TS complaint
• 6c49e5c Improve & extend vitest args handling
• 273b940 fix: fix vitest setupFiles resolution (#1511)
• a01bec1 Don't flag exports (including used as type) in protected or consumed exports
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

📊 Build Report

Bundle Size: 1.19 KB
Node Versions Tested: 18, 20, 22
All Checks: ✅ Passed

Details

• Linting (BiomeJS, Knip, TypeScript): ✅
• Tests with coverage: ✅
• Build: ✅
• Integration test: ✅

Generated for commit ce2d988