chore(deps): bump the linting group with 2 updates

[dependabot]

Bumps the linting group with 2 updates: @biomejs/biome and dependency-cruiser.

Updates @biomejs/biome from 2.3.11 to 2.3.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.12

2.3.12

Patch Changes

• #8653 047576d Thanks @​dyc3! - Added new nursery rule noDuplicateAttributes to forbid duplicate attributes in HTML elements.

• #8648 96d09f4 Thanks @​BaeSeokJae! - Added a new nursery rule noVueOptionsApi.

  Biome now reports Vue Options API usage, which is incompatible with Vue 3.6's Vapor Mode. This rule detects Options API patterns in <script> blocks, defineComponent(), and createApp() calls, helping prepare codebases for Vapor Mode adoption.

  For example, the following now triggers this rule:

  <script>
  export default {
    data() {
      return { count: 0 };
    },
  };
  </script>

• #8832 b08270b Thanks @​Exudev! - Fixed #8809, #7985, and #8136: the noSecrets rule no longer reports false positives on common CamelCase identifiers like paddingBottom, backgroundColor, unhandledRejection, uncaughtException, and IngestGatewayLogGroup.

  The entropy calculation algorithm now uses "average run length" to distinguish between legitimate CamelCase patterns (which have longer runs of same-case letters) and suspicious alternating case patterns (which have short runs).

• #8793 c19fb0e Thanks @​TheBaconWizard! - Properly handle parameters metavariables for arrow_function GritQL queries. The following biome search command no longer throws an error:

  biome search 'arrow_function(parameters=$parameters, body=$body)'

• #8561 981affb Thanks @​wataryooou! - Fixed noUnusedVariables to ignore type parameters declared in ambient contexts such as declare module blocks.

• #8817 652cfbb Thanks @​dyc3! - Fixed #8765: The HTML parser can now parse directive modifiers with a single colon, e.g. @keydown.:.

• #8704 a1914d4 Thanks @​Netail! - Added the nursery rule noRootType. Disallow the usage of specified root types. (e.g. mutation and/or subscription)

  Invalid:

  {
    "options": {
      "disallow": ["mutation"]
    }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.12

Patch Changes

• #8653 047576d Thanks @​dyc3! - Added new nursery rule noDuplicateAttributes to forbid duplicate attributes in HTML elements.

• #8648 96d09f4 Thanks @​BaeSeokJae! - Added a new nursery rule noVueOptionsApi.

  Biome now reports Vue Options API usage, which is incompatible with Vue 3.6's Vapor Mode. This rule detects Options API patterns in <script> blocks, defineComponent(), and createApp() calls, helping prepare codebases for Vapor Mode adoption.

  For example, the following now triggers this rule:

  <script>
  export default {
    data() {
      return { count: 0 };
    },
  };
  </script>

• #8832 b08270b Thanks @​Exudev! - Fixed #8809, #7985, and #8136: the noSecrets rule no longer reports false positives on common CamelCase identifiers like paddingBottom, backgroundColor, unhandledRejection, uncaughtException, and IngestGatewayLogGroup.

  The entropy calculation algorithm now uses "average run length" to distinguish between legitimate CamelCase patterns (which have longer runs of same-case letters) and suspicious alternating case patterns (which have short runs).

• #8793 c19fb0e Thanks @​TheBaconWizard! - Properly handle parameters metavariables for arrow_function GritQL queries. The following biome search command no longer throws an error:

  biome search 'arrow_function(parameters=$parameters, body=$body)'

• #8561 981affb Thanks @​wataryooou! - Fixed noUnusedVariables to ignore type parameters declared in ambient contexts such as declare module blocks.

• #8817 652cfbb Thanks @​dyc3! - Fixed #8765: The HTML parser can now parse directive modifiers with a single colon, e.g. @keydown.:.

• #8704 a1914d4 Thanks @​Netail! - Added the nursery rule noRootType. Disallow the usage of specified root types. (e.g. mutation and/or subscription)

  Invalid:

  {
    "options": {
      "disallow": ["mutation"]
    }
  }

... (truncated)

Commits

• fd33f86 ci: release (#8671)
• a53fc75 chore: update sponsors (#8844)
• 4ee3bda feat(graphql_analyze): implement useLoneAnonymousOperation (#8616)
• 71b5c6e feat(js_analyze): implement noExcessiveClassesPerFile (#8753)
• d6b2bda feat(js_analyze): implement noFloatingClasses (#8754)
• 17ed9d3 feat(js_analyze): implement noDivRegex (#8757)
• 291c9f2 feat(biome_js_analyze): port useInlineScriptId from Next.js (#8624)
• 96d09f4 feat(lint): add noVueOptionsApi rule (#8648)
• 39eb545 fix(biome_configuration): revert URL brackets (#8766)
• 365f7aa feat(js_analyze): implement noDuplicateEnumValues (#8711)
• Additional commits viewable in compare view

Updates dependency-cruiser from 16.10.4 to 17.3.7

Release notes

Sourced from dependency-cruiser's releases.

v17.3.7

🐛 fixes

• a0955cd3 fix(analyze): also analyzes dependents when --reaches or --focus are the only reason to do so - thanks @​drewcpage for raising the issue that led to this fix!

👷 maintenance

• 1289ed68 build(npm): updates external dependencies
• d993ebdc refactor(config-utl): de-anonymize the one remaining anonymous function export
• 817b8706 refactor: renames code in the analysis step to 'analyze'

🧹 chores

• 67d16af4 chore: adds an override to prevent a transitive dependency from emitting annoying messages while our tests are running
• 4af00554 chore(npm): updates external devDependencies
• e166a58e chore(ci): moves workflow permissions to individual jobs
• c6e7a856 chore(codeql): excludes generated validation code from scrutiny

v17.3.6

🐛 fixes

• cd6fe3af fix(report/dot): makes the dot 'flat' reporter respect collapse patterns

🧑‍🏭 refactoring

• d58c78ad/ e884b1e1/ 58c01d1d/ refactor: replace memoize with internal Maps (#1040)
• 464388c0 refactor(cache): uses more appropriate Set for remembering which cache contexts were initialized
• a4a7a807 refactor(report/teamcity): passes the flowId instead of memoizing it

📖 documentation

• 9ca0ab0b doc: various updates to type annotations
• f3648f61 doc(cli): refreshes the documentation of the configuration scaffolding template
• 1b12e61a doc(cli): documents the 'ndjson' logging/ progress format
• cd52da95 doc(cli): updates progress performance-log sample
• 54becb36 doc(report/teamcity): uses same filename pattern for typedefs as used elsewhere in the src tree

👷 maintenance

• 64d42f95 chore(npm): updates external devDependencies
• a3a41f16 chore: tweaks dependency-cruiser configuration
• f924f5c5 chore(LICENSE): 2026
• 0a82fc36 chore(main): logs the 'report from cache' step as part of the 'report' step
• 60981148 chore(ci): uses content based cache strategy as it's faster for our self-scan
• f9b8565e chore(ci): updates known violations
• 120cc755 chore(progress): adds runId and user & system totals to the ndjson listener output

v17.3.5

👷 maintenance

• 2c72a14f perf(enrich/orphan): optimizes the data structure it exercises upon (#1037)
• c80252ed perf(enrich/derive/metrics): only create indexed graph once (#1036)
• 1dab573d perf(enrich/derive): uses better datastructure for deriving dependents (#1035)

... (truncated)

Commits

• c9ed5f1 17.3.7
• 1289ed6 build(npm): updates external dependencies
• a0955cd fix(analyze): also analyzes dependents when --reaches or --focus are the only...
• d993ebd refactor(config-utl): de-anonymize the one remaining anonymous function export
• 67d16af chore: adds an override to prevent a ransitive dependency from emitting annoy...
• 4af0055 chore(npm): updates external devDependencies
• 817b870 refactor: renames code in the analysis step to 'analyze'
• e166a58 chore(ci): moves workflow permissions to individual jobs
• c6e7a85 chore(codeql): excludes generated validation code from scrutiny
• 6372494 17.3.6
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for dependency-cruiser since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.