chore(deps): bump the all-npm group with 3 updates

[dependabot]

Bumps the all-npm group with 3 updates: js-yaml, @biomejs/biome and electron.

Updates js-yaml from 5.3.0 to 5.4.1

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

Commits

• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• fbb3e9d Remove regex lookbehind for ES2015 compatibility
• d43c185 Fix flowSkipColonSpace by forcing quoteFlowKeys
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.10 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• See full diff in compare view

Updates electron from 43.4.1 to 44.0.0

Release notes

Sourced from electron's releases.

electron v44.0.0

Release Notes for v44.0.0

Stack Upgrades

• Chromium 152.0.7977.54
  • New in 152
  • New in 151
• Node v24.18.1
  • Node 24.18.1 blog post
  • Node 24.18.0 blog post
• V8 15.2

Breaking Changes

• Removed support for the Unity desktop environment on Linux. #51649
• Added select-client-certificate event support for net.request and net.fetch; requests to servers requesting a client certificate no longer fail with ERR_SSL_CLIENT_AUTH_CERT_NEEDED, and applications can now select a certificate to present. #52397
• macOS 12 (Monterey) is no longer supported by Chromium. Older versions of Electron will continue to run on Monterey, but macOS 13 (Ventura) or later will be required to run Electron v44.0.0 and higher. #51967
• ANGLE is now statically linked into the Electron binary on all platforms, matching upstream Chromium. The libEGL.(so|dylib|dll) and libGLESv2.(so|dylib|dll) libraries are no longer shipped in the distribution. #52288
• net.request now rejects requests where Sec-Fetch-Dest is document, frame, iframe, or fencedframe unless Sec-Fetch-Mode is also set to navigate. #52216
• Removed 32-bit builds (Windows ia32 and Linux armv7l). Electron is now published only for 64-bit (x64 and arm64) platforms. #52326
• The clipboard module is now aligned with the W3C Clipboard API and is no longer exposed to renderer processes. #52508
• Removed the openAsHidden option from app.setLoginItemSettings() and the openAsHidden, wasOpenedAsHidden and restoreState fields from the return value of app.getLoginItemSettings(). These only worked on macOS 12 and below, which are no longer supported. #52667

See the Breaking Changes doc for more details about these changes.

Features

• Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #51182 (Also in 42, 43)
• Added available to process.getSystemMemoryInfo() on Linux, exposing proc/meminfo MemAvailable. #52380 (Also in 42, 43)
• Added net.WebSocket, a WHATWG-compatible WebSocket client for the main process that routes through Chromium's network stack. #51593 (Also in 42, 43)
• Added webContents.setZoomMode(mode), webContents.getZoomMode(), and webContents.zoomMode for per-WebContents zoom control. #49962
• Added webFrameMain.printToPDF() to allow printing individual frames to PDF from the main process. #52625 (Also in 42, 43)
• Added a Save/Restore Window State API for cross-platform use. #52270
• Added a badge property to MenuItem on macOS 14+ for showing a count or custom text badge next to a menu item's label. #53046
• Added support for win.setOpacity(opacity) on Linux. #51455
• Added webContents.caretBrowsingEnabled for toggling caret browsing in a WebContents. #53035
• Frameless windows on Linux now use system-themed titlebar icons for Window Controls Overlay (WCO). #52531
• Frameless windows on Linux now have rounded corners by default, just like on macOS and Windows. Rounded corners can be disabled on all platforms by setting roundedCorners: false on the window. #51459 (Also in 43)
• Restored app.setBadgeCount and win.setProgressBar for Linux. These APIs now support any dock or taskbar which implements the LauncherEntry D-Bus API, and they no longer require libunity. #52895

Fixes

• If a nativeImage was passed an image with a color profile, its pixel values will now be normalized to SRGB. This ensures that two visually identical images after color space application will receive similar pixel values when converted to a nativeImage. #48178 (Also in 43)
• Fixed DevTools Network panel missing most requests after navigating when webContents.debugger is attached. #51959 (Also in 42, 43)
• Fixed DevTools device metrics overrides persisting indefinitely when a remote debugging client disconnected without clearing them. #52930 (Also in 42, 43)
• Fixed DevTools popup and context menus not appearing when DevTools is hosted in a custom window via webContents.setDevToolsWebContents(). #52434 (Also in 42, 43)
• Fixed Window Controls Overlay caption buttons not rendering on Linux. #52580
• Fixed Windows edge case in NativeWindowViews::MoveBehindTaskBarIfNeeded(). #52000 (Also in 41, 42, 43)
• Fixed BrowserWindow.unmaximize() and restore() having no effect on Wayland when the window was maximized immediately after creation. #53124 (Also in 42)

... (truncated)

Commits

• bf0c4e6 perf: start the first sandboxed window in a pre-warmed renderer (#53144)
• b5ada5a build: update PGO profiles (#53150)
• 1736985 build: add electron_xcache host tool for cross-target V8 code caches (#53149)
• 20f8981 chore: bump chromium to 152.0.7977.54 (44-x-y) (#53049)
• c162f60 feat: add webContents.caretBrowsingEnabled (#53035)
• 98dedd2 fix: window stuck maximized on Wayland after early maximize() (#53124)
• c6f688f perf: boot every Node.js-hosting process from the Node snapshot / code cache ...
• e2ec8ff build: update PGO profiles (#53120)
• 476f0a0 fix: avoid creating webFrameMain for transient frames (#53109)
• 2fbb58a perf: trim GTK and FontConfig work off the linux startup path (#53107)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions