fix(deps): update minor-and-patch

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@biomejs/biome (source)	2.5.8 → 2.5.9
aws-cdk (source)	2.1136.0 → 2.1138.0
aws-cdk-lib (source)	2.265.0 → 2.266.0

---

Release Notes

biomejs/biome (@​biomejs/biome)

v2.5.9

Compare Source

Patch Changes

• #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #​11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #​11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #​11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #​10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #​11333 715e0cd Thanks @​kkkhs! - Fixed #​11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #​11343 9b98211 Thanks @​johncarmack1984! - Fixed #​11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #​11220 3e8c488 Thanks @​santichausis! - Fixed #​9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>
    export function greet() {
      console.log("Hello!");
    }
  </script>
  
  <script>
    greet();
  </script>

• #​11300 36430eb Thanks @​dyc3! - Fixed the HTML formatter's whitespace handling for marquee, noscript, video, audio, and object elements.

  - <marquee behavior="alternate"> This text will bounce </marquee>
  + <marquee behavior="alternate">This text will bounce</marquee>

• #​11299 6559e6c Thanks @​jp-knj! - Added the nursery rule useAstroClientOnlyDirectiveValue, which reports Astro client:only directives without an initializer.

  For example, <Component client:only /> triggers the rule.

• #​11365 7529811 Thanks @​MHJahanbakhsh! - Fixed #​11229: The useGenericFontNames rule now treats math as a valid generic font family.

• #​11346 674f5f4 Thanks @​Jayllyz! - Fixed #​11335: noComponentHookFactories now reports a use-prefixed variable only when a function is assigned to it directly.

  function factory() {
    const useColors = true; // no longer reported
    const useStore = createStore({ count: 0 }); // no longer reported
    const useData = () => useState(null); // still reported
    return useColors;
  }

• #​11334 c87c46a Thanks @​zkasuran! - Fixed #​11317: noSvgWithoutTitle no longer reports an svg that uses the boolean shorthand aria-hidden (equivalent to aria-hidden={true} in React).

• #​11364 13853b1 Thanks @​ematipico! - Fixed a bug where useJsxKeyInIterable incorrectly flagged Astro files.

• #​11321 41386f3 Thanks @​dyc3! - Fixed #​11315: Invalid CSS declarations in HTML style attributes now produce parser diagnostics instead of causing a panic.

• #​11325 67c3bf0 Thanks @​dyc3! - Fixed HTML text wrapping to account for the width of an adjacent closing tag, avoiding lines that exceed the configured width when the final word and tag must move together.

   <a-long-long-long-element
  -  >foo bar foo bar foo bar foo bar foo bar foo bar foo bar</a-long-long-long-element
  +  >foo bar foo bar foo bar foo bar foo bar foo
  +  bar</a-long-long-long-element
   >

• #​11367 fe5b5d4 Thanks @​ematipico! - Fixed TypeScript compilerOptions.paths resolution when mapping targets omit ./. Biome now resolves these targets relative to their configured path base.

• #​11316 17e48d6 Thanks @​wanxiankai! - Fixed #​11289: the safe fix for noExtraBooleanCast now preserves parentheses around nested conditional expressions.

• #​11254 d25d113 Thanks @​dyc3! - Fixed #​11242: Biome no longer crashes with an access violation when analysing files on Windows ARM64.

• #​11221 85aac73 Thanks @​freeatnet! - Added the nursery rule noUnsafeTypeAssertion, which disallows TypeScript type assertions while allowing const assertions.

  const value = input as SomeType;

• #​11314 7ffb677 Thanks @​ematipico! - Fixed #​11310: Restored the performance of noMisusedPromises and noFloatingPromises when analyzed expressions share deep imported type paths.

• #​11356 6cd3263 Thanks @​johncarmack1984! - The Tailwind parser now understands modifiers on bare utilities (@container/sidebar, shadow/50).

• #​11318 76059e9 Thanks @​johncarmack1984! - The Tailwind parser now understands container-query variants (@sm:, @max-lg:, @min-[400px]:) and child and descendant variants (*:, **:).

• #​11357 faa2074 Thanks @​johncarmack1984! - The Tailwind parser now accepts the legacy leading ! important marker (!flex, hover:!p-4).

• #​11344 f34e15c Thanks @​johncarmack1984! - The Tailwind parser now understands combinator selectors in arbitrary variants (has-[>svg]:, has-[+p]:), modifiers on variants (group-hover/menu:, @sm/main:), and arbitrary container-query sizes (@[400px]:).

• #​11324 2f5d452 Thanks @​dyc3! - Fixed HTML formatting that inserted rendered whitespace between an element and touching text when the line wrapped.

    <div>
  -   before<meter value=".5"></meter>
  -   after
  +   before<meter value=".5"></meter
  +   >after
    </div>

• #​11312 e65f07e Thanks @​xosnos! - Added a new nursery rule useControlLabel for both HTML and JSX, which reports interactive control elements (button, menuitem) without an accessible label.

  <button />

• #​11364 13853b1 Thanks @​ematipico! - Fixed SVG parsing for files with an XML declaration followed by a PUBLIC doctype, such as <?xml version="1.0"?><!DOCTYPE svg PUBLIC "a" "b">.

• #​11301 610ee28 Thanks @​dyc3! - Fixed parent tag wrapping when an HTML element starts or ends with a block-like or hidden child such as source, track, or param.

  - <video src="brave.webm"><track kind="subtitles" src="brave.en.vtt"></video>
  + <video src="brave.webm">
  +   <track kind="subtitles" src="brave.en.vtt">
  + </video>

aws/aws-cdk-cli (aws-cdk)

v2.1138.0

Compare Source

2.1138.0 (2026-08-19)

Features

• cli: add "errors-only" progress mode that only prints errors (#​1800) (a4c0282)
• cli: support notification-arns in cdk import (#​1740) (f8e7da1), closes aws/aws-cdk#23548

Bug Fixes

• cli: cdk context header always claims the context was found in cdk.json (#​1816) (b7783b5), closes #​1814
• cli: cdk flags --set leaks synthesized cloud assembly directories (#​1833) (fd891fb), closes #​1832
• cli: fail fast when --proxy has no or an unsupported protocol (#​1843) (da37001), closes #​453
• cli: refactor fails on stacks with bundled assets (#​1812) (8458a4a), closes #​1810
• cli: reject non-numeric ids in cdk acknowledge (#​1844) (c71ab23), closes #​248

v2.1137.0

Compare Source

2.1137.0 (2026-08-17)

Features

• deps: upgrade aws-cdk-lib (#​1840) (0b2e50a)

Bug Fixes

• toolkit-lib: every change-set deployment announces "waiting in review for manual execution (--no-execute)" although the change set is executed (#​1818) (86ee97e), closes #​1815 #​1273

aws/aws-cdk (aws-cdk-lib)

v2.266.0

Compare Source

Features

• adding controlPlaneScalingConfig to Cluster (#​36863) (94e5c1a)
• update L1 CloudFormation resource definitions (#​38578) (ccd2633)

Bug Fixes

• ec2: add DependsOn VPCGatewayAttachment to IPv6 default route (#​37893) (ab272bc), closes #​37853
• sns-subscriptions: use regionalized service principal for opt-in region SQS subscriptions (#​38339) (67a7eb1), closes #​32526

---

Alpha modules (2.266.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by
  dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#​38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#​38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#​38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#​38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#​38587) (fd01268)

Bug Fixes

• glue-alpha: correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items (#​38593) (35aefaf)
• glue-alpha: omit comments from struct type strings (#​38008) (5f16a86), closes #​26935
• mediapackagev2-alpha: add GetChannel grant on MediaPackageV2 (#​38582) (74d922c), closes #​38581

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.