fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@biomejs/biome (source)	2.5.0 → 2.5.1			devDependencies	patch
@playwright/test (source)	^1.61.0 → ^1.61.1			devDependencies	patch
@types/node (source)	^26.0.0 → ^26.0.1			devDependencies	patch
@vitejs/plugin-react (source)	^6.0.2 → ^6.0.3			devDependencies	patch
@workos-inc/authkit-nextjs	^4.1.1 → ^4.1.4			dependencies	patch
actions/cache	v5.0.5 → v6.1.0			action	major
conventional-changelog-conventionalcommits (source)	^9.3.1 → ^10.0.0			devDependencies	major
convex (source)	^1.41.0 → ^1.42.0			dependencies	minor
convex-helpers (source)	^0.1.119 → ^0.1.120			dependencies	patch
convex-test (source)	^0.0.53 → ^0.0.54			devDependencies	patch
motion	^12.40.0 → ^12.42.0			dependencies	minor

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.1

Compare Source

Patch Changes

• #​10722 f8a303d Thanks @​denbezrukov! - Fixed CSS formatter output for comments between import media queries.

  -@​import url("print.css") print,
  -/* comment */
  -screen;
  +@​import url("print.css") print, /* comment */ screen;

• #​10738 9fdc560 Thanks @​JamBalaya56562! - Fixed #​9899: the json and json-pretty reporters now escape backslashes in a diagnostic's location.path. Previously, paths containing backslashes (such as Windows-style paths) were emitted unescaped, producing invalid JSON.

  -    "path": "src\account\setup-passkey.tsx",
  +    "path": "src\\account\\setup-passkey.tsx",

• #​10626 5f837df Thanks @​tom-groves! - Fixed #​10625: biome migrate no longer emits an invalid trailing comma when a renamed rule (such as noConsoleLog → noConsole) is the last member of its rule group. Previously this produced malformed output that aborted the migration of a strict-JSON biome.json with a parsing error.

• #​10535 c245f9d Thanks @​Mokto! - Fixed a false positive in noUnusedVariables for Svelte files where variables referenced inside {@​html expr} blocks were incorrectly reported as unused.

• #​10668 a0f197e Thanks @​Netail! - The biome init command has been updated to include a more up-to-date URL to the first-party extensions page.

• #​10667 d8c3e87 Thanks @​Netail! - Fixed #​10664: useErrorCause now correctly detects a shorthand property.

• #​10696 ef2373f Thanks @​ematipico! - Fixed #​9566. Improved how the Biome Language Server loads multiple configuration files inside a workspace.

• #​10705 4ccb410 Thanks @​ematipico! - Fixed #​10652. Biome plugins are now properly filtered when using --only and --skip flags.

• #​10669 aa0a6eb Thanks @​Netail! - Fixed #​10651: useInlineScriptId now correctly trims trivia to detect if an id attribute has been set.

• #​10689 844b1be Thanks @​ematipico! - Fixed #​10658. The issue was caused by the "Go-to definition" editor feature, which was enabled by default. The feature is now disabled by default. To work, the feature triggers the scanner to build the module graph. This caused memory leak issues in cases where Biome starts in the home directory to modify files.

  If you relied on this new feature, you must now turn on using the [editor settings] of the extension e.g. Zed and VSCode.

• #​10695 043fbb5 Thanks @​ematipico! - Fixed #​10674. Biome now throws an error when the field level is missing from a rule option.

• #​10712 5941df2 Thanks @​Conaclos! - Improved the diagnostic and the documentation of useFlatMap.

• #​10615 23814f1 Thanks @​qwertycxz! - Improved the DX the JSON schema when it's used by certain code editors like VSCode.

• #​10688 ec69489 Thanks @​ematipico! - Fixed a bug where the Biome Daemon did not correctly shut down when the editor was closed during an in-progress operation, especially while scanning.

• #​10701 6c2e0d7 Thanks @​ematipico! - Fixed #​10694. The Biome Language Server no longer prints an error when the user hovers a variable imported from node_modules.

• #​10681 888515b Thanks @​Conaclos! - Fixed useExportType that reported useless details in some diagnostics.

• #​10220 3694a13 Thanks @​theBGuy! - Fixed useAnchorContent false positive for <a> elements used as render prop values (e.g. render={<a href="..." />}), a pattern where the receiving component renders its children inside the anchor element.

• #​10702 98823fb Thanks @​ematipico! - Fixed #​10612. The Biome parser now correctly parses processing instructions. The following SVG doesn't throw errors anymore:

  <?xml version="1.0" encoding="UTF-8" ?>
  
  <svg></svg>

microsoft/playwright (@​playwright/test)

v1.61.1

Compare Source

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.3

Compare Source

workos/authkit-nextjs (@​workos-inc/authkit-nextjs)

v4.1.4

Compare Source

Bug Fixes

• deps: move @​workos-inc/node to peerDependencies (#​423) (18163d7)

v4.1.3

Compare Source

Bug Fixes

• prevent cross-organization disclosure in getOrganizationAction (#​443) (6b2ea66)

v4.1.2

Compare Source

Bug Fixes

• Improve auth cookie missing error message (#​440) (39af2bb)

actions/cache (actions/cache)

v6.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v6.1.0 - handle read-only cache access by @​jasongin in #​1768

Full Changelog: actions/cache@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

• Update packages, migrate to ESM by @​Samirat in #​1760

Full Changelog: actions/cache@v5...v6.0.0

v6

Compare Source

v5.1.0

Compare Source

What's Changed

• Bump @​actions/cache to v5.1.0 - handle read-only cache access by @​jasongin in #​1775

Full Changelog: actions/cache@v5...v5.1.0

conventional-changelog/conventional-changelog (conventional-changelog-conventionalcommits)

v10.0.0

Compare Source

⚠ BREAKING CHANGES

• the commit type effect property replaces the hidden commit type property and the bumpStrict preset option for controlling changelog visibility and version bumps.

Fixes #​1476.

• Handlebars template strings and partial files were replaced with render functions.
• packages now require Node.js 22 or newer.

Features

• replace handlebars templates with render functions (#​1477) (55e6716)
• require node 22 (de5e136)
• support commit type effects (#​1484) (78761ae)

Bug Fixes

• encode compare URL tags (#​1483) (96bf235)
• render non-closing references separately (#​1482) (adb2c69)
• sort notes without compare-func (#​1487) (dc78285)

get-convex/convex-backend (convex)

v1.42.0

• Added a new npx convex project create command that can be used
  to create new projects programmatically.
• Added a new --names-only flag to npx convex env list
  (and npx convex env default list). This flag shows the names of
  the env vars that are set, without the values. It can be useful
  to let AI coding agents know the variables that are set on a deployment,
  without giving them the actual values.
• Added a new useStaleSnapshot option to the arguments for runQuery.
  This is an advanced feature that can be used to allow mutations
  to avoid optimistic concurrency control (OCC) conflicts in some cases
  where they can commit even though they depend on conflicting reads.
  This change allows us to improve the performance of some of the
  official Convex components, including Workpool.
• Improved the documentation of db.* methods to more clearly explain
  the difference between the old APIs without table names
  (e.g. db.get(userId)) and the new APIs with table names
  (e.g. db.get("users", userId)).
• Fixed an issue where the CLI would not surface permission errors
  correctly when the user or token doesn’t have permission to do something.
• Exposes the current scheduled function's ID as scheduledFunctionId in
  ctx.meta.getRequestMetadata().
• npx convex insights has a new --json flag that makes the command
  output easier to parse programmatically.
• File storage: marked a few TypeScript types in convex/server as @deprecated
  (FileMetadata, FileStorageId, StorageId). These types are used
  only by file storage APIs that were deprecated in convex@1.6.0,
  so we also marked them as @deprecated for clarity.
• Bumps the ws peer dependency to avoid a vulnerable range.

get-convex/convex-helpers (convex-helpers)

v0.1.120

Compare Source

• Zod 4 support: fix a regression introduced in 0.1.119 in the return types of
  zodToConvex/zodOutputToConvex when using branded types (including zid)

get-convex/convex-test (convex-test)

v0.0.54

Compare Source

• Support the transactionLimits option on nested ctx.runQuery /
  ctx.runMutation calls (Convex 1.41). The nested call is enforced against
  its own limits, capped at the global transaction limits so they can only be
  lowered, never raised.
• Bandwidth tracking now mirrors the database's nested-transaction layers: a
  nested call's usage folds into its parent only when it commits, so the writes
  of a rolled-back nested ctx.runMutation no longer count against the
  transaction's limits.
• Enforce the Convex runtime rule that a single function execution may only
  run one paginated query (.paginate()). Calling it more than once now
  throws, catching a production-only failure that previously passed silently
  in tests.

motiondivision/motion (motion)

v12.42.0

Compare Source

Changed

• animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

• animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.
• animateView: Disabled automatic border-radius animation.

v12.41.0

Compare Source

Added

• animateView: Moves from Motion+ Early Access and alpha to main library.
• animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.
• animateView: .new() and .old() configures values to animate on new and old layers.
• animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.
• animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.
• animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

• AnimatePresence: Prevent stuck exit animations when children interrupt.
• drag: Child e.stopPropagation() no longer break drag end.
• Fixing Next.js OOM on Windows when importing via motion package.
• animateLayout: Improve handling of parallel/interleaved calls.

Changed

• animateView: .enter() and .exit() now refer specifically to new and old layers where there are no matching old or new layers.
• animateView: Interrupted transition setups now return resolved animation rather than throwing.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blueprint	Ready	Preview, Comment	Jun 27, 2026 1:30am