deps-dev: Bump the dev-dependencies group with 2 updates

[dependabot]

Bumps the dev-dependencies group with 2 updates: @biomejs/biome and tsx.

Updates @biomejs/biome from 2.5.7 to 2.5.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.8

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Commits

• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• See full diff in compare view

Updates tsx from 4.23.6 to 4.23.12

Release notes

Sourced from tsx's releases.

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

Bug Fixes

• map Node test locations (2f55884)
• support data URLs in tsImport (b94f46f)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.8

... (truncated)

Commits

• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• b94f46f fix: support data URLs in tsImport
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tsx@​4.23.6 ⏵ 4.23.12	+12		+1	+1
	@​biomejs/​biome@​2.5.7 ⏵ 2.5.8	+1		+1	+1

View full report