chore(deps-dev): bump the all-npm group with 2 updates

[dependabot]

Bumps the all-npm group with 2 updates: @biomejs/biome and electron.

Updates @biomejs/biome from 2.5.11 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

  <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

  {x && <div><!-- first -->text<!-- last --></div>}
  {cond && <a></a><!-- c --><b></b>}

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

  {cond && <style>a { color: red }</style>}
  {cond && <script>let x = {a: 1};</script>}

• #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

• #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

• #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

  Math.max(Math.max(a, b), c);

  The fix flattens this expression to Math.max(a, b, c).

• #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• 1fc42ed feat(lint/js): add noThisOutsideOfClass (#11596)
• 6c7fd27 feat(lint/js/vue): add noVueDeprecatedScopedSlots (#11593)
• f4e5ebb feat(lint): add useModernMathApis (#11581)
• 54f3a2e feat(lint/js): add useFlatMathMinMax (#11508)
• 1d6210b feat(lint/js): add noUnmodifiedLoopCondition (#11491)
• 2d55931 feat(js_analyze): added a React naming convention rule (#11554)
• ee69e0e fix(schema): domains (#11565)
• f5d7896 feat(lint/js): add noInvalidFileInputAccept (#11497)
• See full diff in compare view

Updates electron from 44.0.0 to 44.2.0

Release notes

Sourced from electron's releases.

electron v44.2.0

Release Notes for v44.2.0

Fixes

• Fixed a pending read on a net.request chunked upload stream inside a protocol handler never settling when the request failed or was aborted. #53373 (Also in 43, 45)
• Fixed a potential crash when using menu.popup with a frame from an offscreen rendered window. #53362 (Also in 43)
• Fixed an intermittent crash (access violation) on Windows when an ASAR integrity violation is detected, so the process now exits with code 1 as intended. #53455 (Also in 43, 45)
• Fixed application crash after a large number of IPC messages from renderers. #53417 (Also in 42, 43, 45)
• Fixed native addons deriving from node::ObjectWrap aborting during garbage collection on Node.js 24.19.0 and later. #53392 (Also in 42, 43, 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #53479
• Improved throughput of responses that protocol.handle handlers return straight from net.fetch. #53378
• Updated Chromium to 152.0.7977.76. #53382
• Updated Node.js to v24.20.0. #53250

electron v44.1.1

Release Notes for v44.1.1

Fixes

• Fixed chrome.tabs.query() returning tab url and title to extensions without the tabs permission or host access, aligning with tabs.get. #53354 (Also in 42, 43, 45)
• Fixed a renderer crash when an array with a throwing property getter is passed across contextBridge, and several main/utility-process crashes when option objects passed to Electron APIs contain throwing accessors or Proxy traps. #53331 (Also in 42, 43)
• Fixed an intermittent crash at startup on Linux caused by a race between Pango and the main thread initializing fontconfig. #53340 (Also in 43, 45)
• Fixed an issue where an exception thrown by a property getter on an object passed through contextBridge was swallowed instead of being thrown back to the caller. #53335 (Also in 43, 45)
• Fixed main process crashes when navigating to http://accessibility/ or http://devtools/, when an extension background page used navigator.mediaDevices, and when calling SerialPort.forget() for a disconnected device. #53333 (Also in 43, 45)
• Fixed the PDF viewer failing to save an edited PDF with NotAllowedError: Third party iframes are not allowed to show a file picker. #53328 (Also in 43, 45)

electron v44.1.0

Release Notes for v44.1.0

Fixes

• Fixed fs.constants.O_DIRECTORY, O_NOFOLLOW and O_DIRECT holding x86 values on Linux arm64 and armv7l, which made opening a directory fail with EINVAL, and made require('trace_events') behave the same on cross-compiled builds as on native ones. #53320 (Also in 42, 43, 45)
• Fixed webContents.executeJavaScriptInIsolatedWorld resolving with undefined when worldId was not an integer. #53238 (Also in 43)
• Fixed webContents.print() honoring printBackground, duplexMode, and printer default duplex settings. #53159 (Also in 42, 43)
• Fixed a crash on Windows when V8 posted a delayed worker task during shutdown. #53201 (Also in 42, 43)
• Fixed a crash on macOS when a WebAuthn Touch ID prompt was requested while no locale resources were loaded. #53194 (Also in 43)
• Fixed a crash on macOS when a notification's icon could not be attached; the notification is now shown without the icon. #53146 (Also in 42, 43)
• Fixed a crash when calling node:wasi functions in optimized code. #53268 (Also in 42, 43, 45)
• Fixed a crash when calling utilityProcess.postMessage() after the utility process had exited. #53300 (Also in 43, 45)
• Fixed a regression where a window created with a custom title can show an empty title after using back/forward navigation. #53218 (Also in 42, 43)
• Fixed an issue where pages loaded in a detached WebContentsView wouldn't see the correct window size. #53153 (Also in 42, 43)
• Fixed crashes in sharedTexture, service-worker ipcRenderer and utilityProcess.fork() caused by object lifetime bugs. #53279 (Also in 43, 45)
• Fixed crashes in the main process when a webRequest.onBeforeRequest listener redirected a CORS preflight request, and when calling net.fetch() with a webRequest-permission extension loaded. #53303 (Also in 43, 45)
• Fixed crashes when a webContents or parent window is destroyed while other APIs still reference it. #53287 (Also in 43, 45)
• Fixed crashes when certain app event handlers call back into Electron synchronously. #53275 (Also in 43, 45)
• Fixed region-qualified --lang values such as de-DE loading no locale resources on macOS, which left localized strings empty and could crash WebAuthn Touch ID prompts. #53188 (Also in 42, 43)
• Fixed the GPU process being terminated in AppX/MSIX packaged apps on Windows when WebGPU fell back to SwiftShader. #53198 (Also in 42, 43)

... (truncated)

Commits

• aa650d7 ci: bump build-tools to pick up the .patches merge driver (#53483)
• aad3008 chore: cherry-pick 10 changes from angle, chromium, skia and v8 (#53479)
• 17a16f1 build: pin the siso revision in build/siso_revision instead of fetching Chrom...
• fef76a6 ci: retry the depot_tools clones and the angle fetch on transient network err...
• e255208 ci: use a download-artifact fork that doesn't parse the event file at import ...
• 81fe24e perf: relay untouched net.fetch responses from protocol.handle without pumpin...
• 5a7a11d fix: backport Node.js cleanup hook fixes for node::ObjectWrap addons (44-x-y)...
• 3e1fc8b fix: terminate immediately on asar integrity violation (#53455)
• 5abd26a test: run the Squirrel.Mac updater specs concurrently off a signed template (...
• 0faf4b9 ci: don't fail the macOS build when Homebrew can't reach its API during clean...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions