v2.4.9

Compare Source

Patch Changes

• #​9315 085d324 Thanks @​ematipico! - Added a new nursery CSS rule noDuplicateSelectors, that disallows duplicate selector lists within the same at-rule context.

  For example, the following snippet triggers the rule because the second selector and the first selector are the same:

  /* First selector */
  .x .y .z {
  }
  
  /* Second selector */
  .x {
    .y {
      .z {
      }
    }
  }

• #​9567 b7ab931 Thanks @​ematipico! - Fixed #​7211: useOptionalChain now detects negated logical OR chains. The following code is now considered invalid:

  !foo || !foo.bar;

• #​8670 607ebf9 Thanks @​tt-a1i! - Fixed #​8345: useAdjacentOverloadSignatures no longer reports false positives for static and instance methods with the same name. Static methods and instance methods are now treated as separate overload groups.

  class Kek {
    static kek(): number {
      return 0;
    }
    another(): string {
      return "";
    }
    kek(): number {
      return 1;
    } // no longer reported as non-adjacent
  }

• #​9476 97b80a8 Thanks @​masterkain! - Fixed #9475: Fixed a panic when Biome analyzed ambient TypeScript modules containing class constructor, getter, or setter signatures that reference local type aliases. Biome now handles these declarations without crashing during semantic analysis.

• #​9553 0cd5298 Thanks @​dyc3! - Fixed a bug where enabling the rules of a whole group, would enable rules that belonged to a domain under the same group.

  For example, linter.rules.correctness = "error" no longer enables React- or Qwik-specific correctness rules unless linter.domains.react, linter.domains.qwik, or an explicit rule config also enables them, or their relative dependencies are installed.

• #​9586 4cafb71 Thanks @​dyc3! - Fixed #​8828: Grit patterns using export { $foo } from $source now match named re-exports in JavaScript and TypeScript files.

• #​9550 d4e3d6e Thanks @​dyc3! - Fixed #​9548: Biome now parses conditional expressions whose consequent is an arrow function returning a parenthesized object expression.

• #​8696 a7c19cc Thanks @​Faizanq! - Fixed #​8685 where noUselessLoneBlockStatements would remove empty blocks containing comments. The rule now preserves these blocks since comments may contain important information like TODOs or commented-out code.

• #​9557 6671ac5 Thanks @​datalek! - Fixed #​9557: Biome's LSP server no longer crashes on startup when used with editors that don't send workspaceFolders during initialization. This affected any LSP client that only sends rootUri, which is valid per the LSP specification.

• #​9455 1710cf1 Thanks @​omar-y-abdi! - Fixed #​9174: useExpect now correctly rejects asymmetric matchers in Vitest or Jest like expect.stringContaining(), expect.objectContaining(), and utilities like expect.extend() that are not valid assertions. Previously these constructs caused false negatives, allowing tests without real assertions to pass the lint rule.

• #​9584 956e367 Thanks @​ematipico! - Fixed a bug where Vue directive attribute values like v-bind:class="{'dynamic': true}" were incorrectly parsed as JavaScript statements instead of expressions. Object literals inside directive values like :class, v-if, and v-html are now correctly parsed as expressions, preventing spurious parse errors.

• #​9474 e168494 Thanks @​ematipico! - Added the new nursery rule noUntrustedLicenses. This rule disallows dependencies that ship with invalid licenses or licenses that don't meet the criteria of your project/organisation.

  The rule has the following options:

  • allow: a list of licenses that can be allowed. Useful to bypass possible invalid licenses from downstream dependencies.
  • deny: a list of licenses that should trigger the rule. Useful to deny licenses that don't fit your project/organisation.
    When both deny and allow are provided, deny takes precedence.
  • requireOsiApproved: whether the licenses need to be approved by the Open Source Initiative.
  • requireFsfLibre: whether the licenses need to be approved by the Free Software Foundation.

• #​9544 723798b Thanks @​ViniciusDev26! - Added an unsafe fix to useConsistentMethodSignatures that automatically converts between method-style and property-style signatures.

• #​9555 8a3647b Thanks @​ematipico! - Fixed #188: the Biome Language Server no longer panics when open files change abruptly, such as during git branch checkouts.

• #​9605 f65c637 Thanks @​ematipico! - Fixed #​9589. Now Biome correctly parses object expressions inside props and directives. The following code doesn't emit errors anymore:

  <style is:global define:vars={{ bgLight: light }}>
  <Component name={{ first, name }} />

• #​9565 ccb249e Thanks @​eyupcanakman! - Fixed #​9505: noUselessStringConcat no longer reports tagged template literals as useless string concatenations. Tagged templates invoke a function and can return non-string values, so combining them with + is not equivalent to a single template literal.

• #​9534 4d050df Thanks @​Netail! - Added the nursery rule noInlineStyles. The rule disallows the use of inline style attributes in HTML and the style prop in JSX, including React.createElement calls. Inline styles make code harder to maintain and can interfere with Content Security Policy.

• #​9611 cddaa44 Thanks @​gaauwe! - Fixed a regression where Biome LSP could misread editor settings sent through workspace/didChangeConfiguration when the payload was wrapped in a top-level biome key. This caused requireConfiguration and related settings to be ignored in some editors.

v19.6.6

Compare Source

Full Changelog: raineorshine/npm-check-updates@v19.6.5...v19.6.6

v0.3.8

Compare Source

Released on 2026-03-23.

Enhancements

• Add experimental language: deno support (#​1516)
• Add pretty-format-json as builtin hook (#​915)
• Add check-vcs-permalinks as builtin hook (#​1842)
• Add check-illegal-windows-names as builtin hook (#​1841)
• Add check-shebang-scripts-are-executable builtin hook (#​1847)
• Add destroyed-symlinks builtin hook (#​1851)
• Add file-contents-sorter as builtin hook (#​1846)
• Add --all flag to prek uninstall (#​1817)
• Improve file pattern parse errors (#​1829)
• Validate uv binary after download (#​1825)

Bug fixes

• Fix workspace-relative added file paths (#​1852)
• Relax alias-anchor ratio check for check-yaml (#​1839)

Contributors

• @​j178
• @​shaanmajid
• @​mvanhorn
• @​feliblo
• @​Tiryoh

v0.15.8

Compare Source

Released on 2026-03-26.

Preview features

• [ruff] New rule unnecessary-if (RUF050) (#​24114)
• [ruff] New rule useless-finally (RUF072) (#​24165)
• [ruff] New rule f-string-percent-format (RUF073): warn when using % operator on an f-string (#​24162)
• [pyflakes] Recognize frozendict as a builtin for Python 3.15+ (#​24100)

Bug fixes

• [flake8-async] Use fully-qualified anyio.lowlevel import in autofix (ASYNC115) (#​24166)
• [flake8-bandit] Check tuple arguments for partial paths in S607 (#​24080)
• [pyflakes] Skip undefined-name (F821) for conditionally deleted variables (#​24088)
• E501/W505/formatter: Exclude nested pragma comments from line width calculation (#​24071)
• Fix %foo? parsing in IPython assignment expressions (#​24152)
• analyze graph: resolve string imports that reference attributes, not just modules (#​24058)

Rule changes

• [eradicate] ignore ty: ignore comments in ERA001 (#​24192)
• [flake8-bandit] Treat sys.executable as trusted input in S603 (#​24106)
• [flake8-self] Recognize Self annotation and self assignment in SLF001 (#​24144)
• [pyflakes] F507: Fix false negative for non-tuple RHS in %-formatting (#​24142)
• [refurb] Parenthesize generator arguments in FURB142 fixer (#​24200)

Performance

• Speed up diagnostic rendering (#​24146)

Server

• Warn when Markdown files are skipped due to preview being disabled (#​24150)

Documentation

• Clarify extend-ignore and extend-select settings documentation (#​24064)
• Mention AI policy in PR template (#​24198)

Other changes

• Use trusted publishing for NPM packages (#​24171)

Contributors

• @​bitloi
• @​Sim-hu
• @​mvanhorn
• @​chinar-amrutkar
• @​markjm
• @​RenzoMXD
• @​vivekkhimani
• @​seroperson
• @​moktamd
• @​charliermarsh
• @​ntBre
• @​zanieb
• @​dylwil3
• @​MichaReiser

v0.9.11

Compare Source

What's Changed

We released inlay hint

🚀 New Features

• Add hover configuration to extension features by @​ya70https://github.com/tombi-toml/tombi/pull/1641l/1641
• Add extension did_open registry prefetch by @​ya70https://github.com/tombi-toml/tombi/pull/1643l/1643
• Add lockfile-based dependency inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1645l/1645
• Limit Cargo hover metadata to crate keys by @​ya70https://github.com/tombi-toml/tombi/pull/1646l/1646
• Add workspace package inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1647l/1647
• Cache lockfiles for inlay hints by @​ya70https://github.com/tombi-toml/tombi/pull/1651l/1651
• Add uv dependency version hints by @​ya70https://github.com/tombi-toml/tombi/pull/1653l/1653

🛠️ Other Changes

• docs: update v0.9.10 extension docs by @​ya70https://github.com/tombi-toml/tombi/pull/1640l/1640
• docs: add schema deprecated lint docs by @​ya70https://github.com/tombi-toml/tombi/pull/1642l/1642
• Fix cache path for non-JSON remote URLs by @​ya70https://github.com/tombi-toml/tombi/pull/1644l/1644
• Merge workspace default features when inheriting deps by @​ya70https://github.com/tombi-toml/tombi/pull/1648l/1648
• Remove deprecated Kiro instructions from AGENTS.md by @​ya70https://github.com/tombi-toml/tombi/pull/1650l/1650
• Refactor inlay hint test fixtures by @​ya70https://github.com/tombi-toml/tombi/pull/1649l/1649
• Rename cargo workspace-value config by @​ya70https://github.com/tombi-toml/tombi/pull/1652l/1652

Full Changelog: tombi-toml/tombi@v0.9.10...v0.9.11

v0.9.10

Compare Source

What's Changed

👒 Dependencies

• chore(deps): bump rustls-webpki from 0.103.4 to 0.103.10 in the cargo group across 1 directory by @​dependabot[bot] in #​1613

🛠️ Other Changes

• docs: clarify file:// hostname resolution in #:schema by @​ya7010 in #​1611
• fix: unify docs code block font size on mobile by @​ya7010 in #​1612
• fix: clarify Tombi's formatting policy regarding user data preservation by @​ya7010 in #​1615
• fix: add warning about goto type definition requests in Zed extension documentation by @​ya7010 in #​1616
• fix: add const: true to workspace and optional boolean fields in cargo schema by @​ya7010 in #​1625
• Complete singleton value key completions by @​ya7010 in #​1626
• Add Cargo workspace inheritance completion by @​ya7010 in #​1627
• Add dependency hover metadata by @​ya7010 in #​1628
• Add extension feature config by @​ya7010 in #​1630
• Refactor cargo/uv extension TOML helpers by @​ya7010 in #​1631
• Rename uv extension to pyproject by @​ya7010 in #​1633
• Add schema-level deprecated lint config by @​ya7010 in #​1632
• Cache remote package metadata by @​ya7010 in #​1634
• Cache Cargo completion metadata by @​ya7010 in #​1635
• stype: workspace member declarations and adjust formatting in Cargo.toml files by @​ya7010 in #​1639

Full Changelog: tombi-toml/tombi@v0.9.9...v0.9.10

v0.11.2

Compare Source

Released on 2026-03-26.

Enhancements

• Add a dedicated Windows PE editing error (#​18710)
• Make uv self update fetch the manifest from the mirror first (#​18679)
• Use uv reqwest client for self update (#​17982)
• Show uv self update success and failure messages with --quiet (#​18645)

Preview features

• Evaluate extras and groups when determining auditable packages (#​18511)

Bug fixes

• Skip redundant project configuration parsing for uv run (#​17890)

v0.11.1

Compare Source

Released on 2026-03-24.

Bug fixes

• Add missing hash verification for riscv64gc-unknown-linux-musl (#​18686)
• Fallback to direct download when direct URL streaming is unsupported (#​18688)
• Revert treating 'Dynamic' values as case-insensitive (#​18692)
• Remove torchdata from list of packages to source from the PyTorch index (#​18703)
• Special-case == Python version request ranges (#​9697)

Documentation

• Cover --python <dir> in "Using arbitrary Python environments" (#​6457)
• Fix version annotations for PS_MODULE_PATH and UV_WORKING_DIR (#​18691)

v0.11.0

Compare Source

Released on 2026-03-23.

Breaking changes

This release includes changes to the networking stack used by uv. While we think that breakage will be rare, it is possible that these changes will result in the rejection of certificates previously trusted by uv so we have marked the change as breaking out of an abundance of caution.

The changes are largely driven by the upgrade of reqwest, which powers uv's HTTP clients, to v0.13 which included some breaking changes to TLS certificate verification.

The following changes are included:

• rustls-platform-verifier is used instead of rustls-native-certs and webpki for certificate verification

  This change should have no effect unless you are using the native-tls option to enable reading system certificates.

  rustls-platform-verifier delegates to the system for certificate validation (e.g., Security.framework on macOS) instead of eagerly loading certificates from the system and verifying them via webpki. The effects of this change will vary based on the operating system. In general, uv's certificate validation should now be more consistent with browsers and other native applications. However, this is the most likely cause of breaking changes in this release. Some previously failing certificate chains may succeed, and some previously accepted certificate chains may fail. In either case, we expect the validation to be more correct and welcome reports of regressions.

  In particular, because more responsibility for validating the certificate is transferred to your system's security library, some features like CA constraints or revocation of certificates via OCSP and CRLs may now be used.

  This change should improve performance when using system certificate on macOS, as uv no longer needs to load all certificates from the keychain at startup.

• aws-lc is used instead of ring for a cryptography backend

  There should not be breaking changes from this change. We expect this to expand support for certificate signature algorithms.

• --native-tls is deprecated in favor of a new --system-certs flag

  The --native-tls flag is still usable and has identical behavior to --system-certs.

  This change was made to reduce confusion about the TLS implementation uv uses. uv always uses rustls not native-tls.

• Building uv on x86-64 and i686 Windows requires NASM

  NASM is required by aws-lc. If not found on the system, a prebuilt blob provided by aws-lc-sys will be used.

  If you are not building uv from source, this change has no effect.

  See the CONTRIBUTING guide for details.

• Empty SSL_CERT_FILE values are ignored (for consistency with SSL_CERT_DIR)

See #​18550 for details.

Python

• Enable frame pointers for improved profiling on Linux x86-64 and aarch64

See the python-build-standalone release notes for details.

Enhancements

• Treat 'Dynamic' values as case-insensitive (#​18669)
• Use a dedicated error for invalid cache control headers (#​18657)
• Enable checksum verification in the generated installer script (#​18625)

Preview features

• Add --service-format and --service-url to uv audit (#​18571)

Performance

• Avoid holding flat index lock across indexes (#​18659)

Bug fixes

• Find the dynamic linker on the file system when sniffing binaries fails (#​18457)
• Fix export of conflicting workspace members with dependencies (#​18666)
• Respect installed settings in uv tool list --outdated (#​18586)
• Treat paths originating as PEP 508 URLs which contain expanded variables as relative (#​18680)
• Fix uv export for workspace member packages with conflicts (#​18635)
• Continue to alternative authentication providers when the pyx store has no token (#​18425)
• Use redacted URLs for log messages in cached client (#​18599)

Documentation

• Add details on Linux versions to the platform policy (#​18574)
• Clarify FLASH_ATTENTION_SKIP_CUDA_BUILD guidance for flash-attn installs (#​18473)
• Split the dependency bots page into two separate pages (#​18597)
• Split the alternative indexes page into separate pages (#​18607)