chore(deps-dev): Bump the dev-dependencies group with 4 updates

[dependabot]

Bumps the dev-dependencies group with 4 updates: @biomejs/biome, @types/node, aws-cdk and aws-cdk-lib.

Updates @biomejs/biome from 2.5.1 to 2.5.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.2

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.2

Patch Changes

• #10595 f458028 Thanks @​pkallos! - Added the option ignoreBooleanCoercion to useNullishCoalescing. When enabled, Biome ignores || and ||= used inside a Boolean() call, where coalescing on falsy values is intentional.

• #10798 4a32b63 Thanks @​pkallos! - Added the option ignorePrimitives to useNullishCoalescing. When enabled, Biome ignores ||, ||=, and ternary expressions whose non-nullish operands are all primitives the option opts out of. Use true to ignore all primitives, or an object selecting string, number, boolean, or bigint.

• #10545 f3d4c00 Thanks @​Mokto! - Added the new nursery rule noSvelteUnnecessaryStateWrap, which reports unnecessary $state() wrapping of classes from svelte/reactivity that are already reactive.

  <script>
  import { SvelteMap } from "svelte/reactivity";
  const map = $state(new SvelteMap()); // redundant
  </script>

• #10752 f62fb8b Thanks @​ematipico! - Fixed #10739. Now the rule useValidAutocomplete correctly flags the autoComplete attribute.

• #10796 f1b3ab2 Thanks @​ematipico! - Fixed #10768. Improved the performance of the Biome Language Server by cancelling certain in-flight operations when there are fast updates.

• #10719 aa649b5 Thanks @​minseong0324! - Fixed noMisleadingReturnType false positive on returns that use a widening type assertion: "a" as string is no longer reported as misleading. The rule now also reports a literal-pinning assertion such as false as false, matching the existing as const behavior.

  // No longer flagged (returns are `string`):
  function getValue(b: boolean): string {
    if (b) return "a" as string;
    return "b" as string;
  }
  // Now also reported, like as const (returns false):
  function isReady(): boolean {
  return false as false;
  }

• #10678 8f073a7 Thanks @​PranavAchar01! - Fixed #7718: Biome now correctly parses CSS nesting selectors when & appears as a trailing sub-selector after a type selector, e.g. h1& { color: red; }.

• #10756 5ec965a Thanks @​denbezrukov! - Fixed CSS formatter output for selector lists with allowWrongLineComments and // comments after a selector comma. Biome now keeps the selector before the line comment inline instead of breaking it across descendant combinators.

  -.powerPathNavigator
  -  .helm
  -  button.pressedButton, // pressed
  +.powerPathNavigator .helm button.pressedButton, // pressed
   .powerPathNavigator .helm button:active:not(.disabledButton) {
   }

• #10757 6232fcd Thanks @​PranavAchar01! - Fixed #8269: the CSS parser now accepts Tailwind @variant and @utility names that start with a digit, such as the 2xl breakpoint.

... (truncated)

Commits

• e649198 ci: release (#10747)
• 4a32b63 feat(lint): add ignorePrimitives option to useNullishCoalescing (#10798)
• f3d4c00 feat(js/nursery): add noSvelteNoUnnecessaryStateWrap rule (#10545)
• f458028 feat(lint): add ignoreBooleanCoercion option to useNullishCoalescing (#10595)
• See full diff in compare view

Updates @types/node from 22.20.0 to 26.1.0

Commits

• See full diff in compare view

Updates aws-cdk from 2.1128.1 to 2.1129.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1129.0

2.1129.0 (2026-07-01)

Features

• cli: allow customizing role session name via CDK_ROLE_SESSION_NAME (#1672) (9943606), closes #1120 aws/aws-cdk#22631
• cli: Integrate with express mode using --express flag for deploy, destroy, and bootstrap (#1689) (629ca49)

Bug Fixes

• cli: cdk list pollutes stdout with synth and dependency status lines (#1663) (bb33189), closes aws/aws-cdk#38165 #1677 #1603 #1603
• cli: a declined cdk destroy now returns exit code 1 (#1667) (fff4c93)
• cli: route cdk destroy through toolkit-lib (#1686) (5659329)

Commits

• 629ca49 feat(cli): Integrate with express mode using --express flag for deploy, des...
• bb33189 fix(cli): cdk list pollutes stdout with synth and dependency status lines (...
• fc95a5a chore: modernize tsconfig settings across all packages (#1685)
• 5659329 fix(cli): route cdk destroy through toolkit-lib (#1686)
• 3560ff5 chore(cli): record effective output for cdk deploy (#1684)
• 20f2400 chore(cli): async and predicate-based CliIoHost message listeners (#1679)
• 9943606 feat(cli): allow customizing role session name via CDK_ROLE_SESSION_NAME (#1672)
• fff4c93 fix(cli): a declined cdk destroy now returns exit code 1 (#1667)
• 520f0e3 chore(cli): CliIoHost listeners can set level handle and requests (#1666)
• 7718050 chore(cli): record effective output in IoHostRecorder (#1661)
• See full diff in compare view

Updates aws-cdk-lib from 2.260.0 to 2.261.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.261.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
• aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

Features

• update L1 CloudFormation resource definitions (#38189) (5aabd32)
• core: add git source metadata to CloudFormation templates (#37368) (765271b)
• rds: support native Secrets Manager integration for RDS Cluster and Instance (#35734) (07d5623), closes #29239

Bug Fixes

• improve internal path detection (#38205) (6a1934d)
• ecr-assets: tarball asset build command not escaped (#38171) (bad8a3a)
• print validation errors according to new style (#38166) (031aba8)

---

Alpha modules (2.261.0-alpha.0)

Features

• metrics-facade-alpha: generate metrics facades (#37334) (aa9beb0)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.261.0-alpha.0 (2026-07-02)

Features

• metrics-facade-alpha: generate metrics facades (#37334) (aa9beb0)

2.260.0-alpha.0 (2026-06-16)

2.259.0-alpha.0 (2026-06-11)

2.258.1-alpha.0 (2026-06-08)

2.258.0-alpha.0 (2026-06-04)

Features

• integ-tests-alpha: add option to set the provider log level (#38005) (c634a79)

Bug Fixes

• custom-resource-handlers: deterministic asset hashes for generated lambdas (#37634) (6c3d5bc), closes #34307
• glue-alpha: deprecate Ray Jobs (#38055) (3fa428b)
• glue-alpha: restore notifyDelayAfter to PySpark and Scala Spark ETL jobs (#37815) (05be88a), closes #33839
• integ-tests-alpha: assertion failures print too much unnecessary information (#37974) (bc0de1d)
• mediapackagev2-alpha: cdnAuth on OriginEndpoint now generates the required policy (#38013) (1d56b46)

2.257.0-alpha.0 (2026-05-21)

2.256.1-alpha.0 (2026-05-20)

2.256.0-alpha.0 (2026-05-19)

2.255.0-alpha.0 (2026-05-18)

Features

• bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)

2.254.0-alpha.0 (2026-05-13)

Features

... (truncated)

Commits

• 1be62ae chore: update analytics metadata blueprints
• a5da749 chore(aws-cdk-lib): remove unused table dependency (CVE-2026-13676) (#38235)
• 5aabd32 feat: update L1 CloudFormation resource definitions (#38189)
• 2c6988d chore(ec2): add g7e instance class (NVIDIA Blackwell B200) (#37971)
• 6a1934d fix: improve internal path detection (#38205)
• 45c9d5e docs: fix grammar errors and typos in source comments (#37577)
• 07d5623 feat(rds): support native Secrets Manager integration for RDS Cluster and Ins...
• bad8a3a fix(ecr-assets): tarball asset build command not escaped (#38171)
• 031aba8 fix: print validation errors according to new style (#38166)
• 1a342e0 chore(core): use cloud-assembly-schema types for validation (#38168)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions