fix(deps): update npm non-major dependencies by renovate[bot] · Pull Request #5103 · digdir/designsystemet

renovate · 2026-07-16T01:34:21Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	`2.5.2` → `2.5.5`
@changesets/cli (source)	`2.31.0` → `2.31.1`
@figma/plugin-typings	`^1.130.0` → `^1.131.0`
@floating-ui/dom (source)	`^1.7.6` → `^1.8.0`
@navikt/aksel-icons (source)	`^8.14.0` → `^8.15.0`
@navikt/aksel-icons (source)	`8.14.0` → `8.15.0`
@radix-ui/react-slot (source)	`^1.3.0` → `^1.3.1`
@radix-ui/react-slot (source)	`1.3.0` → `1.3.1`
@react-router/dev (source)	`8.1.0` → `8.3.0`
@react-router/express (source)	`8.1.0` → `8.3.0`
@react-router/node (source)	`8.1.0` → `8.3.0`
@storybook/addon-a11y (source)	`10.5.0` → `10.5.3`
@storybook/addon-docs (source)	`10.5.0` → `10.5.3`
@storybook/addon-themes (source)	`10.5.0` → `10.5.3`
@storybook/addon-vitest (source)	`10.5.0` → `10.5.3`
@storybook/react-vite (source)	`10.5.0` → `10.5.3`
@tanstack/react-virtual (source)	`^3.14.5` → `^3.14.8`
@tanstack/react-virtual (source)	`3.14.5` → `3.14.8`
@types/express-serve-static-core (source)	`5.1.1` → `5.1.2`
@types/hast (source)	`3.0.4` → `3.0.5`
@types/node (source)	`24.13.2` → `24.13.3`
@vitejs/plugin-react (source)	`^6.0.3` → `^6.0.4`
@vitejs/plugin-react (source)	`6.0.3` → `6.0.4`
autoprefixer	`10.5.2` → `10.5.4`
express-rate-limit	`8.5.2` → `8.6.0`
i18next (source)	`26.3.4` → `26.3.6`
isbot (source)	`5.1.44` → `5.2.1`
pnpm (source)	`10.34.4+sha512.8768be55200ae3f2226b6527fcca2687e14bc4e5f12d7721a0f25da3df47915177058648db4177baf348120fa0ba2752d8d8d93f6beaf1fe64ae18da8de961af` → `10.34.5`
postcss-nesting (source)	`14.0.0` → `14.0.1`
prettier (source)	`3.9.4` → `3.9.6`
react (source)	`19.2.7` → `19.2.8`
react (source)	`^19.2.7` → `^19.2.8`
react-dom (source)	`19.2.7` → `19.2.8`
react-dom (source)	`^19.2.7` → `^19.2.8`
react-i18next	`17.0.8` → `17.0.11`
rolldown (source)	`1.1.4` → `1.2.0`
storybook (source)	`10.5.0` → `10.5.3`
storybook-addon-pseudo-states (source)	`10.5.0` → `10.5.3`
vite (source)	`8.1.0` → `8.1.5`
vite (source)	`8.1.3` → `8.1.5`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

biomejs/biome (@biomejs/biome)

`v2.5.5`

Compare Source

Patch Changes

#10972 ab8c21b Thanks @ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:
```
declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}
```
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:
```
type Recursive = Recursive;
declare const value: Recursive;

String(value);
value || "fallback";
```
#10977 0bf7486 Thanks @ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.
#10957 cf263c4 Thanks @dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.
#10983 edc0ed7 Thanks @ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

#10889 89526e3 Thanks @denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

- A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @&#8203;KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @&#8203;keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @&#8203;CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @&#8203;container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

#10964 794ccd0 Thanks @denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.
```
-a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }
```
#10993 b7a9694 Thanks @denbezrukov! - Fixed the CSS formatter to preserve comments on the correct side of selector combinators and before declaration blocks.
```
-.before > /* comment */ .after {}
+.before /* comment */ > .after {}
```
It now also keeps selectors with escaped newlines in attribute values inline when they fit.
```
-div
-  span[foo="bar\
+div span[foo="bar\
 value"] {}
```
#10978 8ebafe1 Thanks @ematipico! - Fixed #10870: noUnresolvedImports no longer reports false positives such as import type { NextRequest } from "next/server".
#10901 68c10e6 Thanks @Socialpranker! - Fixed #10622: the HTML/Vue parser no longer panics on the argument-less v-bind shorthand (:="props").

This syntax is valid Vue and equivalent to v-bind="props", so the parser now accepts it (along with the longhand v-bind:="props") instead of crashing while building a diagnostic for a missing argument.
#10936 7df46f5 Thanks @ematipico! - Improved generic tuple inference for useIncludes. The rule now recognizes specialised tuple element types returned through generic aliases.
#10941 f787725 Thanks @siketyan! - Fixed #10855: Biome now supports parsing and formatting CSS custom media queries declared with @custom-media.
#10969 72d309b Thanks @ematipico! - Fixed an issue where Biome logs became too verbose, dumping information not relevant to user's operations.
e62f6b6 Thanks @ematipico! - Fixed #10963: Biome no longer panics when a type-aware rule such as noFloatingPromises checks a call to a function with multiple call signatures imported from another module.
#10931 899c60d Thanks @ematipico! - Fixed check --write command. Now the command reports code frame of the formatted code, if the formatter is enabled.
#10904 ceee4f4 Thanks @qzwxsaedc! - Fixed #10892: noUnnecessaryConditions no longer reports a false positive when checking a member of a discriminated union that is accessed through a default type-only namespace import. The following code is no longer flagged:
```
import type Types from "./types";

declare function parse(): Types.Result<string>;
const result = parse();
if (!result.success) {
}
```
#10962 f0a67f2 Thanks @ematipico! - Biome no longer removes embedded styles and scripts in HTML files.
#11000 5039a1e Thanks @ematipico! - Fixed a bug where closing one editor stopped a shared Biome daemon used by other editors. LSP proxy processes now exit when either the editor or daemon disconnects.
#10957 cf263c4 Thanks @dyc3! - Improved the performance of the noThenProperty lint rule by about 50%.
#10992 4bf9b21 Thanks @ematipico! - Fixed noMisusedPromises: The rule now reports Promise-returning callbacks where a synchronous callback is expected when calls use tuple spreads or tuple rest parameters, including generic and deeply nested tuples, and when constructor signatures come from interface or object types. Recursive or excessively nested tuple spreads use a conservative fallback so analysis terminates.

For example, the following callback is now reported.
```
declare function consume(...args: [number, () => void]): void;
const prefix: [number] = [1];

consume(...prefix, async () => {});
```
#10915 b3b12b3 Thanks @Functionhx! - Added the rule noNegationInEqualityCheck. The rule flags negated expressions on the left side of strict equality checks like !foo === bar — due to operator precedence this evaluates as (!foo) === bar which is almost always a mistake for foo !== bar.

The rule provides an unsafe fix that flips the operator.
```
// Invalid
!foo === bar;
!foo !== bar;

// Valid
foo !== bar;
foo === bar;
```
#10970 bd1038b Thanks @ematipico! - Improved overload selection for noMisusedPromises. Biome now handles overloaded calls, overloaded constructors, rest parameters, union arguments, and generic constraints without selecting an incompatible signature. For example, noMisusedPromises now reports the async callback passed to the synchronous overload:
```
declare function consume(kind: "async", callback: () => Promise<void>): void;
declare function consume(kind: "sync", callback: () => void): void;
consume("sync", async () => {});
```
#10933 48a4abb Thanks @ematipico! - Fixed useArrayFind to recognize bigint zero indexes.
#10931 899c60d Thanks @ematipico! - Fixed an orchestration issue that could lead to deadlocks when type-aware rules are enabled.
#10969 72d309b Thanks @ematipico! - Hardened the Biome Language Server by improving its synchronisation logic.
#10972 ab8c21b Thanks @ematipico! - Fixed false positives in noMisusedPromises and useAwaitThenable when Promise or thenable inference cannot complete. These rules now suppress diagnostics instead of treating incomplete type information as a definite result. For example, useAwaitThenable no longer reports await value when the value's thenability is unknown:
```
declare const value: unknown;

async function consume() {
  await value;
}
```

`v2.5.4`

Compare Source

Patch Changes

#10665 55ff995 Thanks @dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.
#10894 f4fb10e Thanks @ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.
#10939 f2799db Thanks @Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.
#10945 ae15d98 Thanks @Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.
#10842 5e1abfe Thanks @JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.
#10891 ecca79e Thanks @ematipico! - Fixed #10885: prevented a module-inference regression introduced by a housekeeping change.

#10886 60c8043 Thanks @dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

- test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
-   expect(a).toBe(b);
- });
+ test.each([[1, 2]])(
+   "a description that is long enough to push the hugged opening line beyond the print width",
+   (a, b) => {
+     expect(a).toBe(b);
+   },
+ );

#10895 01a85f0 Thanks @ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

`v2.5.3`

Compare Source

Patch Changes

#10815 86613d5 Thanks @WaterWhisperer! - Fixed a parser panic reported in #10708: Biome now recovers when unsupported CSS Modules @value rules or scoped @keyframes names end at EOF.
#10534 da9b403 Thanks @Mokto! - Fixed noUnusedVariables false positives in Svelte files: Svelte store subscriptions ($store references in templates now keep the underlying store binding from being flagged), and $bindable() props that are only written to in the script block (write-only is intentional for bindable props) are no longer reported as unused.
#10827 098ba41 Thanks @Aqu1bp! - Fixed #10698: The noUnsafeOptionalChaining rule now reports unsafe optional chains wrapped in TypeScript as, satisfies, type assertion, and instantiation expressions, such as new (value?.constructor as Constructor)().
#10773 3c6513d Thanks @otkrickey! - Fixed #10772: useVueValidVOn no longer reports a missing handler for v-on directives using a verb modifier (.stop / .prevent) without an expression, e.g. <div @click.stop></div>. The rule also accepts the arg-less object syntax <div v-on="$listeners"></div> instead of reporting a missing event name.
#10721 d83c66b Thanks @minseong0324! - Improved type-aware lint rule inference for built-in globals and indexed function calls. Biome now resolves Error(...), new Error(...), optional Error#stack, and calls through indexed function values such as handlers[0]() more accurately.
#10865 6450276 Thanks @ematipico! - Fixed #10845. Biome Language Server no longer goes in deadlock when the scanner is enabled.
#10853 93d8e53 Thanks @Netail! - Fixed #10840: Astro shorthand attribute syntax is now correctly being parsed from embedded nodes.
#10820 bba3092 Thanks @JamBalaya56562! - Fixed #10619: noProcessEnv now also reports computed (bracket) member access. Previously only dot access was checked, so process["env"] and env["NODE_ENV"] (where env is imported from node:process) were missed. Both static and computed accesses are now reported.
#10835 3447b2f Thanks @dyc3! - Fixed #10824: useDomQuerySelector now supports an ignore option for receiver identifiers that should not be reported.
#10875 b12e486 Thanks @dyc3! - Fixed #10795: --profile-rules now reports timings for each plugin separately as plugin/<pluginName>, matching the naming used by plugin suppressions, instead of aggregating all plugins under a single plugin/plugin entry.
#10877 d6bc447 Thanks @ematipico! - Fixed biome-zed#164: Biome no longer inserts stray whitespace when format-on-type runs after closing delimiters such as ), ], and }.
#10867 a21463e Thanks @dyc3! - Fixed #10864: Biome no longer crashes when checking or linting HTML files with unquoted attribute values such as <textarea rows=4></textarea>.

changesets/changesets (@changesets/cli)

`v2.31.1`

Compare Source

Patch Changes

#2159 15cf592 Thanks @ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

figma/plugin-typings (@figma/plugin-typings)

`v1.131.0`

Compare Source

floating-ui/floating-ui (@floating-ui/dom)

`v1.8.0`

Compare Source

Minor Changes

feat: add 'layoutViewport' string option to rootBoundary. Unlike the visual 'viewport' boundary, it remains stable while pinch-zooming or when a mobile software keyboard is open, and unlike a manually passed Rect of the documentElement's client size, it accounts for space reserved by scrollbar-gutter: stable.

Patch Changes

fix: remove redundant passive options from scroll listeners
fix: support explicit undefined for optional properties with exactOptionalPropertyTypes
fix(autoUpdate): update immediately instead of waiting for the 1s layoutShift refresh throttle when the reference moved during an observer refresh
fix(getClippingRect): correct clipping-ancestor filtering for fixed-position elements
perf(dom): reduce bundle size and skip redundant per-call work in positioning utilities
fix(getViewportRect): account for scrollbar-gutter: stable both-edges reserved space
fix(getViewportRect): don't overflow past a left-side document scrollbar
fix(platform): don't throw in getClientRects when a virtual element without a getClientRects method is used with the inline() middleware
fix(autoUpdate): refresh layout shift observer on root resize
Update dependencies: @floating-ui/core@1.8.0, @floating-ui/utils@0.2.12

navikt/aksel (@navikt/aksel-icons)

`v8.15.0`

Compare Source

Minor Changes

New icons: Timeline and TimelineFill (#5050)

radix-ui/primitives (@radix-ui/react-slot)

`v1.3.1`

Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

remix-run/react-router (@react-router/dev)

`v8.3.0`

Compare Source

Minor Changes

Restart react-router dev with --conditions=development when not already configured (#15291)

Patch Changes

Allow typescript@7 to be used (#15317)

Unstable Changes

⚠️ Unstable features are not recommended for production use

Add unstable_rsc/client-version client build version virtual module (#15318)
Support the subResourceIntegrity config option in RSC Framework Mode (#15321)

Migration guide

No changes are required when using the default RSC SSR entry. If you maintain a custom app/entry.ssr.tsx, import the new virtual module and pass its hashes to React's importMap render option:

+import subResourceIntegrity from "virtual:react-router/unstable_rsc/subresource-integrity";

return renderToReadableStream(<RSCStaticRouter getPayload={getPayload} />, {
  ...options,
  bootstrapScriptContent,
  formState,
+ importMap: subResourceIntegrity
+   ? { integrity: subResourceIntegrity }
+   : undefined,
  signal: request.signal,
});

Updated dependencies:

`v8.2.0`

Compare Source

Minor Changes

Add a Web Streams default server entry for non-Node Framework mode apps (#15290)
- Apps using @react-router/node, @react-router/express, or @react-router/serve continue to use the renderToPipeableStream default server entry
- Apps without those Node server adapter dependencies use a renderToReadableStream default server entry
- Non-Node apps with their own entry.server.tsx may be able to remove it in favor of the default if it is not doing anything custom
Detect nub as a supported package manager when installing framework dependencies (#15276)

Patch Changes

Detect user rolldownOptions config in Vite 8+ (#15278)

Unstable Changes

⚠️ Unstable features are not recommended for production use

Add the future.unstable_enableNodeReadableStream flag to opt Node Framework mode apps into using renderToReadableStream instead of renderToPipeableStream (#15290)
- This flag has no effect if you have your own entry.server.tsx
Updated dependencies:

remix-run/react-router (@react-router/express)

`v8.3.0`

Compare Source

Patch Changes

Allow typescript@7 to be used (#15317)
Updated dependencies:
- react-router@8.3.0
- @react-router/node@8.3.0

`v8.2.0`

Compare Source

Patch Changes

Updated dependencies:
- react-router@8.2.0
- @react-router/node@8.2.0

remix-run/react-router (@react-router/node)

`v8.3.0`

Compare Source

Patch Changes

Allow typescript@7 to be used (#15317)
Updated dependencies:
- react-router@8.3.0

`v8.2.0`

Compare Source

Patch Changes

Updated dependencies:
- react-router@8.2.0

storybookjs/storybook (@storybook/addon-a11y)

`v10.5.3`

Compare Source

Dependencies: Upgrade TypeScript to 6.0.3 - #34971, thanks @valentinpalkovic!

`v10.5.2`

Compare Source

Angular-Vite: Drop @angular/platform-browser-dynamic peer dependency - #35457, thanks @valentinpalkovic!
Angular-Vite: Widen TypeScript peer dependency range to support TypeScript 6 - #35455, thanks @valentinpalkovic!
Core: Include chromatic packages in ecosystem identifier - #35170, thanks @yannbf!
TanStack: Fix createServerFn validator mock - #35185, thanks @sjh9714!
TanStack: Support pathless layout routes (id-only) in story routing - #35465, thanks @unpunnyfuns!
Tanstack-react: Add missing Hydrate export - #35111, thanks @arun-357!
Tanstack-react: Keep JSX-only component references during dead-code elimination - #35206, thanks @yatishgoel!
Vitest: Fix coverage toggle crash on Vite 6 by clearing closed Vitest instance on restart - #35461, thanks @yannbf!

`v10.5.1`

Compare Source

Angular-Vite: Drop @angular/platform-browser-dynamic peer dependency - #35457, thanks @valentinpalkovic!
Angular-Vite: Widen TypeScript peer dependency range to support TypeScript 6 - [#35455](https:/

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (in timezone Europe/Oslo)

Branch creation
- "before 07:00 on Thursday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-07-16T01:34:25Z

🦋 Changeset detected

Latest commit: 27b1ef0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@digdir/designsystemet	Patch
@digdir/designsystemet-css	Patch
@digdir/designsystemet-react	Patch
@digdir/designsystemet-web	Patch
@digdir/designsystemet-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-07-16T01:37:00Z

Preview deployments for this pull request:

storybook - 27. Jul 2026 - 09:24

themebuilder - 27. Jul 2026 - 09:24

www - 27. Jul 2026 - 09:26

renovate Bot requested review from Barsnes, eirikbacker and mimarz as code owners July 16, 2026 01:34

renovate Bot force-pushed the renovate/npm-minor-patch branch 14 times, most recently from 6bfb3e8 to c8c8e8a Compare July 22, 2026 11:47

renovate Bot force-pushed the renovate/npm-minor-patch branch 11 times, most recently from 5861d0d to 190b37d Compare July 26, 2026 16:35

fix(deps): update npm non-major dependencies

41641b4

renovate Bot force-pushed the renovate/npm-minor-patch branch from 190b37d to 41641b4 Compare July 27, 2026 07:11

Barsnes added 4 commits July 27, 2026 09:16

biome schema

9c32d0e

fix dialog types

a2d28ac

Create tough-ghosts-act.md

0452484

biome check

27b1ef0

Barsnes approved these changes Jul 27, 2026

View reviewed changes

Barsnes merged commit a685ffd into main Jul 27, 2026
24 of 26 checks passed

Barsnes deleted the renovate/npm-minor-patch branch July 27, 2026 07:28

github-actions Bot mentioned this pull request Jul 27, 2026

chore: new release #5060

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps): update npm non-major dependencies#5103

fix(deps): update npm non-major dependencies#5103
Barsnes merged 5 commits into
mainfrom
renovate/npm-minor-patch

renovate Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Minor Changes

Patch Changes

Unstable Changes

Migration guide

Minor Changes

Patch Changes

Unstable Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Configuration

Uh oh!

changeset-bot Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Jul 16, 2026 •

edited

Loading

changeset-bot Bot commented Jul 16, 2026 •

edited

Loading

github-actions Bot commented Jul 16, 2026 •

edited

Loading