⬆️ Bump the dependencies group with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates:

Package	From	To
dotenv	17.2.3	17.2.4
glob	13.0.0	13.0.1
@biomejs/biome	2.3.13	2.3.14
@modelcontextprotocol/sdk	1.25.3	1.26.0
@playwright/test	1.58.1	1.58.2
@types/node	25.2.0	25.2.2
@vitejs/plugin-react	5.1.2	5.1.3

Updates dotenv from 17.2.3 to 17.2.4

Changelog

Sourced from dotenv's changelog.

17.2.4 (2026-02-05)

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

Commits

• See full diff in compare view

Updates glob from 13.0.0 to 13.0.1

Commits

• c759f03 13.0.1
• 8354a18 update deps
• ff6e0f5 ci: update action versions
• 1469286 update workflows and formatting/docs
• See full diff in compare view

Updates @biomejs/biome from 2.3.13 to 2.3.14

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.14

2.3.14

Patch Changes

• #8921 29e2435 Thanks @​siketyan! - Fixed #8759: The useConsistentTypeDefinitions rule no longer converts empty object type declarations into interfaces, as it will conflict with the noEmptyInterface rule and can cause an infinite loop when both rules are enabled.

• #8928 ccaeac4 Thanks @​taga3s! - Added the nursery rule useGlobalThis. This rule enforces using globalThis over window, self and global.

• #8602 9a18daa Thanks @​dyc3! - Added the new nursery rule noVueArrowFuncInWatch. This rule forbids using arrow functions in watchers in Vue components, because arrow functions do not give access to the component instance (via this), while regular functions do.

• #8905 9b1eea8 Thanks @​ryan-m-walker! - Fixed #8428: Improved parsing recovery when encountering qualified rules inside CSS @page at-rule blocks.

• #8900 f788cff Thanks @​mdevils! - Fixed #8802: useExhaustiveDependencies now correctly suggests dependencies without including callback-scoped variables or method names.

  When accessing object properties with a callback-scoped variable, only the object path is suggested:

  // Now correctly suggests `props.value` instead of `props.value[day]`
  useMemo(() => {
    return WeekdayValues.filter((day) => props.value[day]);
  }, [props.value]);

  When calling methods on objects, only the object is suggested as a dependency:

  // Now correctly suggests `props.data` instead of `props.data.forEach`
  useMemo(() => {
    props.data.forEach((item) => console.log(item));
  }, [props.data]);

• #8913 e1e20ea Thanks @​dyc3! - Fixed #8363: HTML parser no longer crashes when encountering a < character followed by a digit in text content (e.g., <12 months). The parser now correctly emits an "Unescaped < bracket character" error instead of treating <12 as a tag name and crashing.

• #8910 2fb63a4 Thanks @​dyc3! - Fixed #8774: Type aliases with generic parameters that have extends constraints now properly indent comments after the equals sign.

  Previously, comments after the = in type aliases with extends constraints were not indented:

  -type A<B, C extends D> = // Some comment
  -undefined;
  +type A<B, C extends D> =
  +    // Some comment
  +    undefined;

• #8916 ea4bd04 Thanks @​ryan-m-walker! - Fixed #4013, where comments in member chains caused unnecessary line breaks.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.14

Patch Changes

• #8921 29e2435 Thanks @​siketyan! - Fixed #8759: The useConsistentTypeDefinitions rule no longer converts empty object type declarations into interfaces, as it will conflict with the noEmptyInterface rule and can cause an infinite loop when both rules are enabled.

• #8928 ccaeac4 Thanks @​taga3s! - Added the nursery rule useGlobalThis. This rule enforces using globalThis over window, self and global.

• #8602 9a18daa Thanks @​dyc3! - Added the new nursery rule noVueArrowFuncInWatch. This rule forbids using arrow functions in watchers in Vue components, because arrow functions do not give access to the component instance (via this), while regular functions do.

• #8905 9b1eea8 Thanks @​ryan-m-walker! - Fixed #8428: Improved parsing recovery when encountering qualified rules inside CSS @page at-rule blocks.

• #8900 f788cff Thanks @​mdevils! - Fixed #8802: useExhaustiveDependencies now correctly suggests dependencies without including callback-scoped variables or method names.

  When accessing object properties with a callback-scoped variable, only the object path is suggested:

  // Now correctly suggests `props.value` instead of `props.value[day]`
  useMemo(() => {
    return WeekdayValues.filter((day) => props.value[day]);
  }, [props.value]);

  When calling methods on objects, only the object is suggested as a dependency:

  // Now correctly suggests `props.data` instead of `props.data.forEach`
  useMemo(() => {
    props.data.forEach((item) => console.log(item));
  }, [props.data]);

• #8913 e1e20ea Thanks @​dyc3! - Fixed #8363: HTML parser no longer crashes when encountering a < character followed by a digit in text content (e.g., <12 months). The parser now correctly emits an "Unescaped < bracket character" error instead of treating <12 as a tag name and crashing.

• #8910 2fb63a4 Thanks @​dyc3! - Fixed #8774: Type aliases with generic parameters that have extends constraints now properly indent comments after the equals sign.

  Previously, comments after the = in type aliases with extends constraints were not indented:

  -type A<B, C extends D> = // Some comment
  -undefined;
  +type A<B, C extends D> =
  +    // Some comment
  +    undefined;

• #8916 ea4bd04 Thanks @​ryan-m-walker! - Fixed #4013, where comments in member chains caused unnecessary line breaks.

  // Before

... (truncated)

Commits

• 3a38d5c ci: release (#8888)
• 4561751 feat(linter): add rule noRedundantDefaultExport (#8931)
• ccaeac4 feat(biome_js_analyze): implement useGlobalThis (#8928)
• d876a38 feat(lint): implement useConsistentMethodSignatures from `typescript-eslint...
• 9a18daa feat(analyze/js/vue): add noVueArrowFuncInWatch (#8602)
• 3531687 feat(lint/css): add noDeprecatedMediaType (#8861)
• 95f1eea feat(lint/css): add noHexColors (#8860)
• d78e01d feat(graphql_analyze): implement useInputName (#8619)
• See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.25.3 to 1.26.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

• chore: bump v1.25.3 for backport fixes by @​pcarleton in modelcontextprotocol/typescript-sdk#1412
• fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x backport) by @​samuv in modelcontextprotocol/typescript-sdk#1382
• Fix #1430: Client Credentials providers scopes support (backported) by @​NSeydoux in modelcontextprotocol/typescript-sdk#1442
• chore: bump version to 1.26.0 by @​pcarleton in modelcontextprotocol/typescript-sdk#1479

New Contributors

• @​samuv made their first contribution in modelcontextprotocol/typescript-sdk#1382
• @​NSeydoux made their first contribution in modelcontextprotocol/typescript-sdk#1442

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

Commits

• fe9c07b chore: bump version to 1.26.0 (#1479)
• 4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
• a05be17 Merge commit from fork
• 50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
• aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
• 6aba065 chore: bump v1.25.3 for backport fixes (#1412)
• See full diff in compare view

Updates @playwright/test from 1.58.1 to 1.58.2

Release notes

Sourced from @​playwright/test's releases.

v1.58.2

Highlights

#39121 fix(trace viewer): make paths via stdin work #39129 fix: do not force swiftshader on chromium mac

Browser Versions

• Chromium 145.0.7632.6
• Mozilla Firefox 146.0.1
• WebKit 26.0

Commits

• ce480a9 cherry-pick(#39171): devops: add ubuntu-22.04-arm bot
• e40c137 chore: mark v1.58.2 (#39155)
• 50b7296 cherry-pick(#39152): chore: fix execSync inheriting stdio
• f3dcf50 cherry-pick(#39129): fix: do not force swiftshader on chromium mac
• 8684e08 cherry-pick(#39121): fix(trace viewer): make paths via stdin work
• See full diff in compare view

Updates @types/node from 25.2.0 to 25.2.2

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 5.1.2 to 5.1.3

Changelog

Sourced from @​vitejs/plugin-react's changelog.

5.1.3 (2026-02-02)

Commits

• cf0cb8a release: plugin-react@5.1.3
• 99e480c fix(deps): update all non-major dependencies (#1090)
• 77f5e42 fix(deps): update react 19.2.4 (#1084)
• e327da4 fix(deps): update all non-major dependencies (#1083)
• 3d3dbc2 chore: add metadata for vite-plugin-registry (#1078)
• 58dfb9d fix(deps): update all non-major dependencies (#1066)
• fefad3d fix(deps): update all non-major dependencies (#1048)
• 36704df chore: setup oxfmt for formatting (#997)
• 54231d9 docs(plugin-react): add docs for exclude option (#1046)
• 6d203af fix(deps): update all non-major dependencies (#1030)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions