chore(deps): update dependency @biomejs/biome to v2.3.6 #904

renovate · 2025-11-13T11:12:00Z

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.3.4` -> `2.3.6`

Release Notes

biomejs/biome (@biomejs/biome)

`v2.3.6`

Compare Source

Patch Changes

#8100 82b9a8e Thanks @Netail! - Added the nursery rule useFind. Enforce the use of Array.prototype.find() over Array.prototype.filter() followed by [0] when looking for a single result.

Invalid:
```
[1, 2, 3].filter((x) => x > 1)[0];

[1, 2, 3].filter((x) => x > 1).at(0);
```
#8118 dbc7021 Thanks @hirokiokada77! - Fixed #8117: useValidLang now accepts valid BCP 47 language tags with script subtags.

Valid:
```
<html lang="zh-Hans-CN"></html>
```
#7672 f1d5725 Thanks @Netail! - Added the nursery rule useConsistentGraphqlDescriptions, requiring all descriptions to follow the same style (either block or inline) inside GraphQL files.

Invalid:
```
enum EnumValue {
  "this is a description"
  DEFAULT
}
```
Valid:
```
enum EnumValue {
  """
  this is a description
  """
  DEFAULT
}
```
#8026 f102661 Thanks @matanshavit! - Fixed #8004: noParametersOnlyUsedInRecursion now correctly detects recursion by comparing function bindings instead of just names.

Previously, the rule incorrectly flagged parameters when a method had the same name as an outer function but called the outer function (not itself):
```
function notRecursive(arg) {
  return arg;
}

const obj = {
  notRecursive(arg) {
    return notRecursive(arg); // This calls the outer function, not the method itself
  },
};
```
Biome now properly distinguishes between these cases and will not report false positives.
#8097 5fc5416 Thanks @dyc3! - Added the nursery rule noVueVIfWithVFor. This rule disallows v-for and v-if on the same element.
```

<div v-for="item in items" v-if="item.isActive">
  {{ item.name }}
</div>
```
#8085 7983940 Thanks @Netail! - Added the nursery rule noForIn. Disallow iterating using a for-in loop.

Invalid:
```
for (const i in array) {
  console.log(i, array[i]);
}
```
#8086 2b41e82 Thanks @matanshavit! - Fixed #8045: The noNestedTernary rule now correctly detects nested ternary expressions even when they are wrapped in parentheses (e.g. foo ? (bar ? 1 : 2) : 3).

Previously, the rule would not flag nested ternaries like foo ? (bar ? 1 : 2) : 3 because the parentheses prevented detection. The rule now looks through parentheses to identify nested conditionals.

Previously not detected (now flagged):
```
const result = foo ? (bar ? 1 : 2) : 3;
```
Still valid (non-nested with parentheses):
```
const result = foo ? bar : baz;
```
#8075 e403868 Thanks @YTomm! - Fixed #7948: The useReadonlyClassProperties code fix when checkAllProperties is enabled will no longer insert a newline after readonly and the class property.
#8102 47d940e Thanks @lucasweng! - Fixed #8027. useReactFunctionComponents no longer reports class components that implement componentDidCatch using class expressions.

The rule now correctly recognizes error boundaries defined as class expressions:
```
const ErrorBoundary = class extends Component {
  componentDidCatch(error, info) {}

  render() {
    return this.props.children;
  }
};
```
#8097 5fc5416 Thanks @dyc3! - Added the nursery rule useVueHyphenatedAttributes, which encourages using kebab case for attribute names, per the Vue style guide's recommendations.
```

<MyComponent myProp="value" />


<MyComponent my-prop="value" />
```

#8108 0f0a658 Thanks @Netail! - Added the nursery rule noSyncScripts. Prevent the usage of synchronous scripts.

Invalid:

<script src="https://third-party-script.js" />

Valid:

<script src="https://third-party-script.js" async />
<script src="https://third-party-script.js" defer />

#8098 1fdcaf0 Thanks @Jayllyz! - Added documentation URLs to rule descriptions in the JSON schema.
#8097 5fc5416 Thanks @dyc3! - Fixed an issue with the HTML parser where it would treat Vue directives with dynamic arguments as static arguments instead.
#7684 f4433b3 Thanks @vladimir-ivanov! - Changed noUnusedPrivateClassMembers to align more fully with meaningful reads.

This rule now distinguishes more carefully between writes and reads of private class members.
- A meaningful read is any access that affects program behavior.
- For example, this.#x += 1 both reads and writes #x, so it counts as usage.
- Pure writes without a read (e.g. this.#x = 1 with no getter) are no longer treated as usage.
This change ensures that private members are only considered “used” when they are actually read in a way that influences execution.

Invalid examples (previously valid)
```
class UsedMember {
  set #x(value) {
    doSomething(value);
  }

  foo() {
    // This assignment does not actually read #x, because there is no getter.
    // Previously, this was considered a usage, but now it’s correctly flagged.
    this.#x = 1;
  }
}
```
Valid example (Previously invalid)
```
class Foo {
  #usedOnlyInWriteStatement = 5;

  method() {
    // This counts as a meaningful read because we both read and write the value.
    this.#usedOnlyInWriteStatement += 42;
  }
}
```
#7684 f4433b3 Thanks @vladimir-ivanov! - Improved detection of used private class members

The analysis for private class members has been improved: now the tool only considers a private member “used” if it is actually referenced in the code.
- Previously, some private members might have been reported as used even if they weren’t actually accessed.
- With this change, only members that are truly read or called in the code are counted as used.
- Members that are never accessed will now be correctly reported as unused.
This makes reports about unused private members more accurate and helps you clean up truly unused code.

Example (previously valid)
```
type YesNo = "yes" | "no";

export class SampleYesNo {
  private yes: () => void;
  private no: () => void;
  private dontKnow: () => void; // <- will now report as unused

  on(action: YesNo): void {
    this[action]();
  }
}
```
#7681 b406db6 Thanks @kedevked! - Added the new lint rule, useSpread, ported from the ESLint rule prefer-spread.

This rule enforces the use of the spread syntax (...) over Function.prototype.apply() when calling variadic functions, as spread syntax is generally more concise and idiomatic in modern JavaScript (ES2015+).

The rule provides a safe fix.

Invalid

Math.max.apply(Math, args);
foo.apply(undefined, args);
obj.method.apply(obj, args);

Valid

Math.max(...args);
foo(...args);
obj.method(...args);

// Allowed: cases where the `this` binding is intentionally changed
foo.apply(otherObj, args);

#7287 aa55c8d Thanks @ToBinio! - Fixed #7205: The noDuplicateTestHooks rule now treats chained describe variants (e.g., describe.each/for/todo) as proper describe scopes, eliminating false positives.

The following code will no longer be a false positive:

describe("foo", () => {
  describe.for([])("baz", () => {
    beforeEach(() => {});
  });

  describe.todo("qux", () => {
    beforeEach(() => {});
  });

  describe.todo.each([])("baz", () => {
    beforeEach(() => {});
  });
});

#8013 0c0edd4 Thanks @Jayllyz! - Added the GraphQL nursery rule useUniqueGraphqlOperationName. This rule ensures that all GraphQL operations within a document have unique names.

Invalid:

query user {
  user {
    id
  }
}

query user {
  user {
    id
    email
  }
}

Valid:

query user {
  user {
    id
  }
}

query userWithEmail {
  user {
    id
    email
  }
}

#8084 c2983f9 Thanks @dyc3! - Fixed #8080: The HTML parser, when parsing Vue, can now properly handle Vue directives with no argument, modifiers, or initializer (e.g. v-else). It will no longer treat subsequent valid attributes as bogus.
```
<p v-else class="flex">World</p>

```
#8104 041196b Thanks @Conaclos! - Fixed noInvalidUseBeforeDeclaration.
The rule no longer reports a use of an ambient variable before its declarations.
The rule also completely ignores TypeScript declaration files.
The following code is no longer reported as invalid:
```
CONSTANT;
declare const CONSTANT: number;
```
#8060 ba7b076 Thanks @dyc3! - Added the nursery rule useVueValidVBind, which enforces the validity of v-bind directives in Vue files.

Invalid v-bind usages include:
```
<Foo v-bind />

<Foo v-bind:foo />

<Foo v-bind:foo.bar="baz" />

```
#8113 fb8e3e7 Thanks @Conaclos! - Fixed noInvalidUseBeforeDeclaration.
The rule now reports invalid use of classes, enums, and TypeScript's import-equals before their declarations.

The following code is now reported as invalid:
```
new C();
class C {}
```
#8077 0170dcb Thanks @dyc3! - Added the rule useVueValidVElseIf to enforce valid v-else-if directives in Vue templates. This rule reports invalid v-else-if directives with missing conditional expressions or when not preceded by a v-if or v-else-if directive.
#8077 0170dcb Thanks @dyc3! - Added the rule useVueValidVElse to enforce valid v-else directives in Vue templates. This rule reports v-else directives that are not preceded by a v-if or v-else-if directive.
#8077 0170dcb Thanks @dyc3! - Added the rule useVueValidVHtml to enforce valid usage of the v-html directive in Vue templates. This rule reports v-html directives with missing expressions, unexpected arguments, or unexpected modifiers.
#8077 0170dcb Thanks @dyc3! - Added the rule useVueValidVIf to enforce valid v-if directives in Vue templates. It disallows arguments and modifiers, and ensures a value is provided.
#8077 0170dcb Thanks @dyc3! - Added the rule useVueValidVOn to enforce valid v-on directives in Vue templates. This rule reports invalid v-on / shorthand @ directives with missing event names, invalid modifiers, or missing handler expressions.

`v2.3.5`

Compare Source

Patch Changes

#8023 96f3e77 Thanks @ematipico! - Added support Svelte syntax {@html}. Biome now is able to parse and format the Svelte syntax {@html}:
```
-{@&#8203;html   'div'}
+{@&#8203;html 'div'}
```
The contents of the expressions inside the {@html <expression>} aren't formatted yet.
#8058 5f68bcc Thanks @ematipico! - Fixed a bug where the Biome Language Server would enable its project file watcher even when no project rules were enabled.

Now the watching of nested configuration files and nested ignore files is delegated to the editor, if their LSP spec supports it.
#8023 96f3e77 Thanks @ematipico! - Added support Svelte syntax {@render}. Biome now is able to parse and format the Svelte syntax {@render}:
```
-{@&#8203;render   sum(1, 2)   }
+{@&#8203;render sum(1, 2)}
```
The contents of the expressions inside the {@render <expression>} aren't formatted yet.
#8006 f0612a5 Thanks @Bertie690! - Updated documentation and diagnostic for lint/complexity/noBannedTypes. The rule should have a more detailed description and diagnostic error message.
#8039 da70d8b Thanks @PFiS1737! - Biome now keeps a blank line after the frontmatter section in Astro files.
#8042 b7efa6f Thanks @dyc3! - The CSS Parser, with tailwindDirectives enabled, will now accept at rules like @media and @supports in @custom-variant shorthand syntax.
#8064 3ff9d45 Thanks @dibashthapa! - Fixed #7967: Fixed the issue with support for advanced SVG props
#8023 96f3e77 Thanks @ematipico! - Added support Svelte syntax {@attach}. Biome now is able to parse and format the Svelte syntax {@attach}:
```
-<div {@&#8203;attach    myAttachment   }>...</div>
+<div {@&#8203;attach myAttachment}>...</div>
```
The contents of the expressions inside the {@attach <expression>} aren't formatted yet.
#8001 6e8a50e Thanks @ematipico! - Added support Svelte syntax {#key}. Biome now is able to parse and format the Svelte syntax {#key}:
```
-{#key   expression} <div></div> {/key}
+{#key expression}
+  <div></div>
+{/key}
```
The contents of the expressions inside the {#key <expression>} aren't formatted yet.
#8023 96f3e77 Thanks @ematipico! - Added support Svelte syntax {@const}. Biome now is able to parse and format the Svelte syntax {@const}:
```
-{@&#8203;const   name = value}
+{@&#8203;const name = value}
```
The contents of the expressions inside the {@const <expression>} aren't formatted yet.
#8044 8f77d4a Thanks @Netail! - Corrected rule source references. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#8065 1a2d1af Thanks @Netail! - Added the nursery rule useArraySortCompare. Require Array#sort and Array#toSorted calls to always provide a compareFunction.

Invalid:
```
const array = [];
array.sort();
```
Valid:
```
const array = [];
array.sort((a, b) => a - b);
```
#7673 a3a713d Thanks @dyc3! - The HTML parser is now able to parse vue directives. This enables us to write/port Vue lint rules that require inspecting the <template> section. However, this more complex parsing may result in parsing errors where there was none before. For those of you that have opted in to the experimental support (aka experimentalFullSupportEnabled), we greatly appreciate your help testing this out, and your bug reports.

#8031 fa6798a Thanks @ematipico! - Added support for the Svelte syntax {#if}{/if}. The Biome HTML parser is now able to parse and format the {#if}{/if} blocks:

<!-- if / else-if / else -->
{#if porridge.temperature > 100}
-<p>too hot!</p>
+  <p>too hot!</p>
{:else if 80 > porridge.temperature}
-<p>too cold!</p>
+  <p>too cold!</p>
{:else if 100 > porridge.temperature}
-<p>too too cold!</p>
+  <p>too too cold!</p>
{:else}
-<p>just right!</p>
+  <p>just right!</p>
{/if}

#8041 beeb7bb Thanks @dyc3! - The CSS parser, with tailwindDirectives enabled, will now accept lists of selectors in @custom-variant shorthand syntax.
```
@&#8203;custom-variant cell (th:has(&), td:has(&));
```
#8028 c09e45c Thanks @fmajestic! - The GitLab reporter now outputs format errors.
#8037 78011b1 Thanks @PFiS1737! - indentScriptAndStyle no longer indents the frontmatter in Astro files.
#8009 6374b1f Thanks @tmcw! - Fixed an edge case in the useArrowFunction rule.

The rule no longer emits diagnostics for or offers to fix functions that reference
the arguments object,
because that object is undefined for arrow functions.

Valid example:
```
// Valid: this function cannot be transformed into an arrow function because
// arguments is not defined for arrow functions.
const getFirstArg = function () {
  return arguments[0];
};
```

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2025-11-13T11:12:04Z

⚠️ No Changeset found

Latest commit: ff4f1f6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-11-13T11:12:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
vercel-storage-next-integration-test-suite	Ready	Preview	Nov 17, 2025 4:11pm

socket-security · 2025-11-13T11:16:00Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@biomejs/biome@2.3.4 ⏵ 2.3.6				⁺¹

View full report

renovate bot enabled auto-merge (squash) November 13, 2025 11:12

vercel bot deployed to Preview November 13, 2025 11:13 View deployment

chore(deps): update dependency @biomejs/biome to v2.3.6

ff4f1f6

renovate bot changed the title ~~chore(deps): update dependency @biomejs/biome to v2.3.5~~ chore(deps): update dependency @biomejs/biome to v2.3.6 Nov 17, 2025

renovate bot force-pushed the renovate/biomejs-biome-2.x branch from 16b5aec to ff4f1f6 Compare November 17, 2025 16:10

vercel bot deployed to Preview November 17, 2025 16:11 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update dependency @biomejs/biome to v2.3.6 #904

chore(deps): update dependency @biomejs/biome to v2.3.6 #904

Uh oh!

renovate bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

vercel bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 13, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

chore(deps): update dependency @biomejs/biome to v2.3.6 #904

Are you sure you want to change the base?

chore(deps): update dependency @biomejs/biome to v2.3.6 #904

Uh oh!

Conversation

renovate bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v2.3.6

Patch Changes

Invalid

Valid

v2.3.5

Patch Changes

Configuration

Uh oh!

changeset-bot bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Nov 13, 2025 •

edited

Loading

`v2.3.6`

`v2.3.5`

changeset-bot bot commented Nov 13, 2025 •

edited

Loading

vercel bot commented Nov 13, 2025 •

edited

Loading

socket-security bot commented Nov 13, 2025 •

edited

Loading