v6.3.0

• Isolate Windows BSD tar read scratch files per operation and make cleanup best-effort, preventing concurrent cache restores from racing over shared temporary archives (#​2497).
• Update compatible runtime and development dependencies, refresh transitive dependencies, and resolve npm audit findings.

v6.2.0

• Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
• Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v6.1.0

• Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v6.0.1

• Bump dependency versions (#​2393):
  • @actions/core to ^3.0.1
  • @actions/http-client to ^4.0.1
  • @actions/io to ^3.0.2
  • @azure/core-rest-pipeline to ^1.23.0
  • @azure/storage-blob to ^12.31.0
  • semver to ^7.7.4

v6.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v5.3.0

• Isolate Windows BSD tar scratch files for concurrent cache list and extract operations, preventing calls from sharing cache.tar #​2497.
• Update compatible runtime and development dependencies and resolve npm audit findings.

v5.2.0

• Handle cache read error due to read-only token: detect the cache read denied: prefix on cache download failures (both the v2 twirp path and the v1 _apis/artifactcache path) and surface it as a core.warning (without failing the run).
• Honor the ACTIONS_CACHE_MODE environment variable: skip restore when the effective cache-mode does not permit reads (none, write-only) and skip save when it does not permit writes (none, read), logging a single non-fatal core.info line. When ACTIONS_CACHE_MODE is unset or unrecognized, behavior is unchanged.

v5.1.0

• Handle cache write error due to read-only token: detect the cache write denied: prefix on cache reservation failures and surface it as a core.warning (without failing the run).

v5.0.5

• Bump @actions/glob to 0.5.1

v5.0.4

• Bump @actions/http-client to 3.0.2

v5.0.3

Prevent retries for rate limited cache operations 2243.

v5.0.1

• Fix Node.js 24 punycode deprecation warning by updating @azure/storage-blob from ^12.13.0 to ^12.29.1 #​2213
• Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http, which eliminates the transitive dependency on node-fetch@2 → whatwg-url@5 → tr46@0.0.3 that used the deprecated punycode module

v5.0.0

• Remove @azure/ms-rest-js dependency #​2197
  • The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead of @azure/ms-rest-js
• Bump @actions/core from ^1.11.1 to ^2.0.0 #​2198
• Bump @actions/exec from ^1.0.1 to ^2.0.0 #​2198
• Bump @actions/glob from ^0.1.0 to ^0.5.0 #​2198
• Bump @actions/http-client from ^2.1.1 to ^3.0.0 #​2198
• Bump @actions/io from ^1.0.1 to ^2.0.0 #​2198
• Add support for Node.js 24 #​2110
• Add node-fetch override to resolve audit vulnerabilities #​2110

v3.0.1

• Bump undici from 6.23.0 to 6.24.1 #​2348

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.3

• Bump @actions/http-client to 3.0.2

v2.0.1

• Bump @​actions/exec from 1.1.1 to 2.0.0 #​2199

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/http-client from 2.0.1 to 3.0.0

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Bump @​actions/io dependency from ^1.0.1 to ^2.0.0

v4.0.1

• Bump undici from 6.23.0 to 6.24.0 #​2347

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v3.0.2

• Bump undici from 5.28.5 to 6.23.0

v3.0.1

• Add support for ACTIONS_ORCHESTRATION_ID in user-agent and default user-agent #​2229

v3.0.0

• Add support for Node 24 #​2110

v3.0.2

• Fix: update lock file version

v3.0.1

• Fix: export @actions/io/lib/io-util

v3.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

v2.0.0

• Add support for Node 24 #​2110
• Ensures consistent behavior for paths on Node 24 with Windows

v4.0.0

• Breaking change: Package is now ESM-only
  • CommonJS consumers must use dynamic import() instead of require()

3.0.1

• Bump @actions/http-client to 3.0.2

3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

2.0.2

• Update @actions/core to v1.11.1 #​1872
• Remove dependency on uuid package #​1824, #​1842

2.0.1

• Update to v2.0.1 of @actions/http-client #​1087

2.0.0

• Update to v2.0.0 of @actions/http-client
• The type of the headers parameter in the exported function downloadTool has been narrowed from { [header: string]: any } to { [header: string]: number | string | string[] | undefined; } (that is, http.OutgoingHttpHeaders).
  This is strictly a compile-time change for TypeScript consumers. Previous attempts to use a header value of a type other than those now accepted would have resulted in an error at run time.

1.7.2

• Update lockfileVersion to v2 in package-lock.json #​1025

1.7.1

• Fallback to os-releases file to get linux version
• Update to latest @​actions/io verison

1.7.0

• Allow arbirtary headers when downloading tools to the tc
• Export isExplicitVersion and evaluateVersions functions
• Force overwrite on default when extracted compressed files

1.6.1

• Update @​actions/core version

1.6.0

• Add extractXar function to extract XAR files

1.3.5

• Check if tool path exists before executing
• Make extract functions quiet by default

1.3.4

• Update the http-client to 1.0.8 which had a security fix

Here is the security issue that was fixed in the http-client 1.0.8 release

1.3.3

• Update downloadTool to only retry 500s and 408 and 429

1.3.2

• Update downloadTool with better error handling and retries

1.3.1

• Increase http-client min version

1.3.0

• Uses @​actions/http-client

1.2.0

• Overload downloadTool to accept destination path
• Fix extractTar on Windows
• Add "types" to package.json

1.1.2

• Use zip and unzip from PATH
• Support custom flags for extractTar

1.0.0

• Initial release

v3.0.1

• Bump @actions/http-client to 3.0.2

v3.0.0

• Update to v2.0.1 of @actions/core
• Update to v2.0.0 of @actions/exec
• Update to v3.0.1 of @actions/http-client
• Update to v2.0.0 of @actions/io

v8.0.7

Compare Source

🐛 Bug Fix

• babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env
  • #​18295 Bump regexpu-core to 6.5.3 (@​JLHwung)
• babel-plugin-transform-for-of
  • #​18292 Skip for await in transform-for-of (@​brunoborta)
• babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3
  • #​18283 Fix asyncIterator helper forwarding .throw() to .return() (@​brunoborta)
• babel-parser
  • #​18288 fix(parser): allow await as a function expression name inside async arrow (@​JLHwung)
• babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3
  • #​18284 Guard @@toPrimitive usage in toPrimitive helper (@​nicolo-ribaudo)
• babel-plugin-transform-block-scoping
  • #​18195 fix: closures in for-loop init capture wrong binding (@​joelle-a-dev)
• babel-helper-create-class-features-plugin, babel-plugin-transform-private-property-in-object
  • #​18265 Return false for #x in on static private fields before initialization (@​hoobnn)
• babel-traverse
  • #​18151 Evaluate TypeScript expression wrappers in NodePath#evaluate (@​CINC0S)
  • #​18250 fix(traverse): do not evaluate destructured bindings in path.evaluate (@​wulu007)
• Other
  • #​18257 Fix eslint-parser AST definition of AccessorProperty (@​jpradelle)
• babel-core
  • #​18254 fix(core): createConfigItem allows cb as 2nd arg (@​JLHwung)

🏠 Internal

• babel-helpers, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3
  • #​18255 Simplify interopRequireWildcard helper (@​nicolo-ribaudo)

v8.0.6

Compare Source

👓 Spec Compliance

• babel-helper-validator-identifier, babel-parser
  • #​18237 Update identifier definition to Unicode 18 (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​18240 Fix parsing of arrow function params inside ternaries with Flow (@​robhogan)
• babel-helper-string-parser, babel-parser
  • #​18239 fix: polish error message for invalid binary 0b19 (@​JLHwung)

🏠 Internal

• babel-code-frame, babel-core, babel-generator, babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-parser, babel-plugin-bugfix-safari-rest-destructuring-rhs-array, babel-plugin-proposal-destructuring-private, babel-plugin-proposal-discard-binding, babel-plugin-transform-regenerator, babel-plugin-transform-typescript, babel-preset-env, babel-traverse, babel-types
  • #​18235 Remove unused internal exports (@​nicolo-ribaudo)
• babel-parser
  • #​18245 test: test with ts-eslint 8.70.0 (@​JLHwung)
• babel-core
  • #​18231 build: do not emit sourcemap in production build (@​JLHwung)
• babel-build-external-helpers, babel-cli, babel-code-frame, babel-core, babel-generator, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-globals, babel-helper-string-parser, babel-helper-transform-fixture-test-runner, babel-helper-validator-identifier, babel-node, babel-parser, babel-plugin-transform-async-generator-functions, babel-plugin-transform-runtime, babel-register, babel-runtime-corejs3, babel-traverse
  • #​18236 Enforce usage of Yarn catalog for reused dependencies (@​nicolo-ribaudo)

🏃‍♀️ Performance

• babel-helper-compilation-targets, babel-helper-transform-fixture-test-runner
  • #​18232 Replace lru-cache with flru (@​nicolo-ribaudo)

v8.0.5

Compare Source

👓 Spec Compliance

• babel-parser
  • #​18218 fix(parser): do not form html entity for invalid codepoint (@​JLHwung)

🐛 Bug Fix

• babel-parser
  • #​18215 fix(parser): remove non-decimal prefix from bigint (@​JLHwung)
  • #​18063 Disallow new import prop access (@​JLHwung)
• babel-plugin-transform-destructuring
  • #​18214 fix: only collapse the empty-object check when it targets the declared binding (@​Kjubikstronk)
• babel-plugin-transform-typescript
  • #​18190 fix(ts): improve variable handling in namespace (@​JLHwung)
  • #​18207 [ts] Allow merging enum into a namespace (@​nicolo-ribaudo)
• babel-node
  • #​18217 Fix import path for babel-node.js (@​drubetti)
• babel-plugin-bugfix-safari-rest-destructuring-rhs-array
  • #​18213 fix(bugfix): bound check before array access (@​JLHwung)
• babel-traverse
  • #​18183 fix(remove): unwrap single sequence expression (@​JLHwung)
  • #​18153 Handle null in getAll{Prev,Next}Siblings (@​JLHwung)
• babel-plugin-transform-block-scoping
  • #​18194 fix: improve for loop closure environment check (@​JLHwung)
  • #​18193 fix: assign closure body after handling return (@​JLHwung)
  • #​18088 Fix initialization of nested for loop head declarations (@​journey-ad)
• babel-generator
  • #​18202 fix(generator): keep parens for ?. chain in tag (@​JLHwung)
• babel-register
  • #​18137 fix(babel-register): preserve app-managed graceful shutdown (@​jibin7jose)
• Other
  • #​18140 chore: fix @​babel/eslint-plugin peer deps (@​JLHwung)
• babel-cli, babel-helper-transform-fixture-test-runner, babel-register
  • #​18131 fix(register): do not inherit parent execArgv (@​JLHwung)
• babel-standalone
  • #​18095 Add types for @babel/standalone (@​liuxingbaoyu)

📝 Documentation

• #​18187 Add AI policy (@​nicolo-ribaudo)

🏠 Internal

• babel-cli, babel-core, babel-helper-compilation-targets, babel-helper-create-class-features-plugin, babel-helper-create-regexp-features-plugin, babel-helper-fixtures, babel-preset-env
  • #​18145 refactor: replace semver with verkit (@​sxzz)
• babel-node
  • #​18177 Update node flags list (@​nicolo-ribaudo)
• babel-types
  • #​18103 Simplify AST validators (@​fisker)

🏃‍♀️ Performance

• babel-parser
  • #​18176 perf: Improve @babel/parser (@​liuxingbaoyu)

v8.0.1

Compare Source

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #​18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

v8.0.0

Compare Source

👓 Spec Compliance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

💥 Breaking Change

• babel-cli, babel-node, babel-plugin-proposal-decorators, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-plugin-transform-modules-commonjs, babel-plugin-transform-object-rest-spread, babel-plugin-transform-parameters, babel-plugin-transform-react-constant-elements, babel-plugin-transform-regenerator, babel-preset-env, babel-register
  • #​18069 Fallback to assuming ESM support with modules: auto (@​nicolo-ribaudo)
• babel-plugin-transform-runtime, babel-runtime-corejs3, babel-runtime
  • #​18036 Remove corejs exports for @babe/runtime-corejs3 (@​liuxingbaoyu)
• babel-parser
  • #​18034 Remove locations: "packed" (@​liuxingbaoyu)

🐛 Bug Fix

• babel-generator
  • #​18046 fix(generator): improve new callee parens check (@​JLHwung)
• babel-plugin-transform-modules-systemjs
  • #​18032 fix(systemjs): support proto as an export name (@​JLHwung)

📝 Documentation

• #​18070 Add EOL date for Babel 7 (end of June 2027) to SECURITY.md (@​nicolo-ribaudo)

🏠 Internal

• #​18018 ci: enforce yarn integrity (@​JLHwung)

🏃‍♀️ Performance

• babel-core
  • #​18039 perf: Only extract source map comments at the end of the file (@​liuxingbaoyu)

v2.6.2

Compare Source

Minor Changes

• #​11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #​11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #​12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  
  enum Role {
    ADMIN
    USER
  }
  
  directive @auth on FIELD_DEFINITION

• #​6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #​11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #​10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #​11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

• #​11477 ab05554 Thanks @​nhedger! - Added automatic Git VCS integration when running biome init inside a Git repository, including from nested directories and Git worktrees. The generated configuration sets vcs.enabled and vcs.useIgnoreFile to true, with vcs.clientKind set to "git".

• #​11451 1ac4b09 Thanks @​ematipico! - #### YAML is now supported

  Added support for formatting YAML files, both .yaml and .yml extensions

• #​11432 4befd08 Thanks @​ematipico! - Configuration files can now recursively extend local files and npm package configurations up to ten levels. Every repeated reference participates in the merge, while resolving multiple versions of one extended package produces an error.

• #​11713 ac6a640 Thanks @​dyc3! - Added support for Grit range() patterns, addressing #​8454. Plugins can filter syntax nodes by optional start_line, start_column, end_line, and end_column bounds.

  For example, this pattern matches function calls contained entirely on line 2.

  range(start_line=2, end_line=2) as $call where {
      $call <: call_expression()
  }
  

• #​11244 0628b53 Thanks @​ematipico! - Added the new CLI option --profile-type-inference to the commands lint and check.

  The profiler is designed to track the execution time of internal queries and operations, group them by file, and sort them from the most expensive to the least expensive.

  biome lint --profile-type-inference

  profiler ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  
    i Type inference profile (Biome <version>)
  
    src/index.ts
  
      Requests (top 5 of 12 groups; 28 source records; 46 executions)
        1. Promise classification <- nursery/noFloatingPromises
        ...
  
      Queries (top 8 of 25 groups; 61 source records; 94 executions)
        1. Promises / infer_expression_is_promise
        ...
  
      Whole-module inference (top 1 of 1 group; 1 source record; 1 execution)
        1. Import depth limit
        ...
  
    68 files omitted.
  
    ℹ To show all the information, use the --verbose option. The output might be very verbose, so it's advised to analyze a single file.
  
    $ biome lint --profile-type-inference --verbose ./path/to/file.ts
  

  Use --verbose to include detailed timings, attribution, breadth, and implementation references for the top source records in each file.

• #​12108 4fcb880 Thanks @​ematipico! - Promoted 59 nursery rules to stable groups.

Correctness

Promoted the following rules to the correctness group with error severity. All of them are recommended:

• noDuplicateFieldDefinitionNames
• noVueRefAsOperand
• noVueImportCompilerMacros
• noVueVOnNumberValues
• useVueValidVFor
• noComponentHookFactories
• noJsxNamespace
• useReactAsyncServerFunction
• noReactNativeRawText
• useReactNativePlatformComponents
• useQwikLoaderLocation
• noPlaywrightMissingAwait
• usePlaywrightValidDescribeCallback

Suspicious

Promoted the following rules to the suspicious group:

• noLoopFunc
• noJsxLeakedDollar
• noReactStringRefs (recommended)
• useScopedStyles (recommended)
• noReactNativeDeepImports (recommended, error severity)
• noDrizzleDeleteWithoutWhere (recommended, error severity)
• noDrizzleUpdateWithoutWhere (recommended, error severity)
• noConditionalExpect
• useExpect
• noIdenticalTestTitle (recommended)
• noPlaywrightForceOption
• noPlaywrightNetworkidle
• noPlaywrightPagePause
• noPlaywrightWaitForNavigation
• noPlaywrightWaitForTimeout
• noDuplicateSelectors
• noEmptyObjectKeys
• useBaseline
• noUntrustedLicenses

Security

Promoted useIframeSandbox to the security group with error severity.

Performance

Promoted the recommended rule useDomNodeTextContent to the performance group with warning severity.

Complexity

Promoted the following rules to the complexity group:

• useArraySome
• useRegexpTest
• noUnnecessaryTemplateExpression
• noPlaywrightUselessAwait
• noExcessiveSelectorClasses
• useMathMinMax (recommended, warning severity)
• noExcessiveNestedCallbacks

Style

Promoted the following rules to the style group with information severity:

• useVueConsistentDefinePropsDeclaration

• useVueNextTickPromise (recommended)

• noReactNativeLiteralColors

• useConsistentTestIt

• useTestHooksInOrder

• useTestHooksOnTop

• noPlaywrightEval

• noPlaywrightElementHandle

• noPlaywrightWaitForSelector

• useReduceTypeParameter

• useNamedCaptureGroup

• useUnicodeRegex

• useImportsFirst

• useVarsOnTop

• useThisInClassMethods

• noInlineStyles

• useDomQuerySelector

• noTopLevelLiterals

• #​12206 0f984fb Thanks @​dyc3! - Added the ignoreUsingDeclarations option to noUnusedVariables. When enabled, the rule no longer reports unused variables declared with using or await using, because these declarations clean up their value automatically even when the code never reads it.

  {
    "linter": {
      "rules": {
        "correctness": {
          "noUnusedVariables": {
            "options": { "ignoreUsingDeclarations": true }
          }
        }
      }
    }
  }

• #​12424 6a41490 Thanks @​siketyan! - Removed the javascript.parser.gritMetavariables option. It was intended for internal use only and had no effect on how Biome parses JavaScript and TypeScript files. Biome now reports it as an unknown key and exits with a configuration error, so remove it from your configuration file.

• #​12055 54870c0 Thanks @​ff1451! - Added the new assist action useGraphqlSortedVariables, which sorts the variable definitions of GraphQL operations.

  Invalid:

  query GetUser($userId: ID!, $includePosts: Boolean = false, $after: String) {
    user(id: $userId) {
      name
    }
  }

• #​12149 83df808 Thanks @​dyc3! - Added the tailwind.stylesheet option, which points Biome at the CSS file that holds your Tailwind CSS configuration. useTailwindSortedClasses reads the @theme, @utility, and @custom-variant rules in that file and in the local files it imports, so your own theme values, utilities, and variants sort correctly.

  // biome.json
  {
    "tailwind": { "stylesheet": "./src/app.css" }
  }

  /* src/app.css */
  @import "tailwindcss";
  
  @theme {
    --color-brand: #​3b82f6;
  }
  
  @utility content-auto {
    content-visibility: auto;
  }
  
  @custom-variant theme-midnight (&:where([data-theme="midnight"] *));

• #​12206 0f984fb Thanks @​dyc3! - Added migration of the `ignoreRes

[!IMPORTANT]
✂ PR body was truncated to here.