Bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Updates the requirements on @biomejs/biome, release-it and sass to permit the latest version.
Updates @biomejs/biome to 2.3.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.3.9

2.3.9

Patch Changes

• #8232 84c9e08 Thanks @​ruidosujeira! - Added the nursery rule noScriptUrl.

  This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.

  <a href="javascript:alert('XSS')">Click me</a>

• #8341 343dc4d Thanks @​arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

  Invalid

  await "value";
  const createValue = () => "value";
  await createValue();

  Caution

  This is a first iteration of the rule, and does not yet detect generic "thenable" values.

• #8034 e7e0f6c Thanks @​Netail! - Added the nursery rule useRegexpExec. Enforce RegExp#exec over String#match if no global flag is provided.

• #8137 d407efb Thanks @​denbezrukov! - Reduced the internal memory used by the Biome formatter.

• #8281 30b046f Thanks @​tylersayshi! - Added the rule useRequiredScripts, which enforces presence of configurable entries in the scripts section of package.json files.

• #8290 d74c8bd Thanks @​dyc3! - The HTML formatter has been updated to match Prettier 3.7's behavior for handling <iframe>'s allow attribute.

  - <iframe allow="layout-animations 'none'; unoptimized-images 'none'; oversized-images 'none'; sync-script 'none'; sync-xhr 'none'; unsized-media 'none';"></iframe>
  + <iframe
  + 	allow="
  + 		layout-animations 'none';
  + 		unoptimized-images 'none';
  + 		oversized-images 'none';
  + 		sync-script 'none';
  + 		sync-xhr 'none';
  + 		unsized-media 'none';
  + 	"
  + ></iframe>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.3.9

Patch Changes

• #8232 84c9e08 Thanks @​ruidosujeira! - Added the nursery rule noScriptUrl.

  This rule disallows the use of javascript: URLs, which are considered a form of eval and can pose security risks such as XSS vulnerabilities.

  <a href="javascript:alert('XSS')">Click me</a>

• #8341 343dc4d Thanks @​arendjr! - Added the nursery rule useAwaitThenable, which enforces that await is only used on Promise values.

  Invalid

  await "value";
  const createValue = () => "value";
  await createValue();

  Caution

  This is a first iteration of the rule, and does not yet detect generic "thenable" values.

• #8034 e7e0f6c Thanks @​Netail! - Added the nursery rule useRegexpExec. Enforce RegExp#exec over String#match if no global flag is provided.

• #8137 d407efb Thanks @​denbezrukov! - Reduced the internal memory used by the Biome formatter.

• #8281 30b046f Thanks @​tylersayshi! - Added the rule useRequiredScripts, which enforces presence of configurable entries in the scripts section of package.json files.

• #8290 d74c8bd Thanks @​dyc3! - The HTML formatter has been updated to match Prettier 3.7's behavior for handling <iframe>'s allow attribute.

  - <iframe allow="layout-animations 'none'; unoptimized-images 'none'; oversized-images 'none'; sync-script 'none'; sync-xhr 'none'; unsized-media 'none';"></iframe>
  + <iframe
  + 	allow="
  + 		layout-animations 'none';
  + 		unoptimized-images 'none';
  + 		oversized-images 'none';
  + 		sync-script 'none';
  + 		sync-xhr 'none';
  + 		unsized-media 'none';
  + 	"
  + ></iframe>

• #8302 d1d5014 Thanks @​mlafeldt! - Fixed #8109: return statements in Astro frontmatter no longer trigger "Illegal return statement" errors when using experimentalFullSupportEnabled.

... (truncated)

Commits

• ec43141 ci: release (#8469)
• 382786b fix(lint): remove useExhaustiveDependencies spurious errors on dependency-f...
• fc32352 fix: improve rustdoc for IndentStyle (#8425)
• 09acf2a feat(lint): update docs & diagnostic for lint/nursery/noProto (#8414)
• 84c9e08 feat: implement noScriptUrl rule (#8232)
• d407efb refactor(formatter): reduce best fitting allocations (#8137)
• 3710702 feat(lint): implement useDestructuring (#8335)
• 111ff34 chore: move depot to platinum sponsor (#8337)
• 343dc4d feat(linter): implement useAwaitThenable (#8341)
• 153e3c6 fix(lint): improve noBiomeFirstException (#8326)
• Additional commits viewable in compare view

Updates release-it to 19.1.0

Release notes

Sourced from release-it's releases.

Release 19.1.0

• Ignore .npmrc (8ccd060)
• Update lockfile (c4cd2ba)
• Support interactive shell in non-CI mode for 2FA flow (resolve #1263) (a10b20d)
• Add --workspaces=false to get rid of the null/matches error (14a4907)
• Remove npm config env var warnings (b8c1247)
• doc(readme): add release-it-beautiful-changelog plugin to list of plugins (#1261) (1b68c21)
• Add 403 to consider resource alive (7969849)

Changelog

Sourced from release-it's changelog.

Changelog

This document lists breaking changes for each major release.

See the GitHub Releases page for detailed changelogs: https://github.com/release-it/release-it/releases

v19 (2025-04-18)

• No breaking changes (dependency party)

v18 (2025-01-06)

• Removed support for Node.js v18.

v17 (2023-11-11)

• Removed support for Node.js v16.

v16 (2023-07-05)

• Removed support for Node.js v14.

v15 (2022-04-30)

• Removed support for Node.js v10 and v12.
• Removed support for GitLab v12.4 and lower.
• Removed anonymous metrics (and the option to disable it).
• Programmatic usage and plugins only through ES Module syntax (import)

Use release-it v14 in legacy environments.

v14 (2020-09-03)

• Removed global property from plugins. Use this.config[key] instead.
• Removed deprecated npm.access option. Set this in package.json instead.

v13 (2020-03-07)

• Dropped support for Node v8
• Dropped support for GitLab v11.6 and lower.
• Deprecated scripts are removed (in favor of hooks).
• Removed deprecated --non-interactive (-n) argument. Use --ci instead.
• Removed old %s and [REV_RANGE] syntax in command substitutions. Use ${version} and ${latestTag} instead.

v12 (2019-05-03)

• The --follow-tags argument for git push has been moved to the default configuration. This is only a breaking change if git.pushArgs was not empty (it was empty by default).

... (truncated)

Commits

• b903fde Release 19.1.0
• 8ccd060 Ignore .npmrc
• c4cd2ba Update lockfile
• a10b20d Support interactive shell in non-CI mode for 2FA flow (resolve #1263)
• 14a4907 Add --workspaces=false to get rid of the null/matches error
• b8c1247 Remove npm config env var warnings
• 1b68c21 doc(readme): add release-it-beautiful-changelog plugin to list of plugins (...
• 7969849 Add 403 to consider resource alive
• See full diff in compare view

Updates sass to 1.96.0

Release notes

Sourced from sass's releases.

Dart Sass 1.96.0

To install Sass 1.96.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Allow numbers with complex units (more than one numerator unit or more than zero denominator units) to be emitted to CSS. These are now emitted as calc() expressions, which now support complex units in plain CSS.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.96.0

• Allow numbers with complex units (more than one numerator unit or more than zero denominator units) to be emitted to CSS. These are now emitted as calc() expressions, which now support complex units in plain CSS.

1.95.1

• No user-visible changes.

1.95.0

• Add support for the CSS-style if() function. In addition to supporting the plain CSS syntax, this also supports a sass() query that takes a Sass expression that evaluates to true or false at preprocessing time depending on whether the Sass value is truthy. If there are no plain-CSS queries, the function will return the first value whose query returns true during preprocessing. For example, if(sass(false): 1; sass(true): 2; else: 3) returns 2.

• The old Sass if() syntax is now deprecated. Users are encouraged to migrate to the new CSS syntax. if($condition, $if-true, $if-false) can be changed to if(sass($condition): $if-true; else: $if-false).

  See the Sass website for details.

• Plain-CSS if() functions are now considered "special numbers", meaning that they can be used in place of arguments to CSS color functions.

• Plain-CSS if() functions and attr() functions are now considered "special variable strings" (like var()), meaning they can now be used in place of multiple arguments or syntax fragments in various CSS functions.

1.94.3

• Fix the span reported for standalone % expressions followed by whitespace.

1.94.2

Command-Line Interface

• Using --fatal-deprecation <version> no longer emits warnings about deprecations that are obsolete.

Dart API

• Deprecation.forVersion now excludes obsolete deprecations from the set it returns.

... (truncated)

Commits

• f6bdc02 Add support for complex units in CSS (#2699)
• 4aa6d5f Support parseSelectors in ImportCache (#2701)
• eae38c5 Fix an incorrect link in the changelog (#2700)
• 4747063 Bump the sass-parser version (#2697)
• 2abc89e Merge pull request #2693 from sass/css-if
• 2f7a16c Revert "Bump chokidar from 4.0.3 to 5.0.0 in /package (#2690)" (#2691)
• 38d4ac8 Add ArgumentList.namedSpans
• 6f9a593 Add support for plain-CSS if()
• 3b95eb7 Rename IfExpression to LegacyIfExpression
• e2bf843 Make the recursive AST visitor comprehensive (#2694)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.