Merge branch 'main' into dependabot/npm_and_yarn/js/babel/helpers-8.0.0

Author: gcko

.github/dependabot.yml

@@ -37,9 +37,6 @@ updates:
       - dependency-name: "@dagrejs/dagre"
       # Pinned: breaking API changes in v2
       - dependency-name: "html2canvas-pro"
-      # Pinned to 4.2.x (see js/pnpm-workspace.yaml): date-fns 4.3.0+ breaks
-      # vi.mock("date-fns") in TimelineEvent.test.tsx via subpath re-exports.
-      - dependency-name: "date-fns"
     groups:
       all-minor-patch:
         patterns: ["*"]

js/.husky/pre-commit

@@ -16,7 +16,7 @@ export GIT_WORK_TREE="$REPO_ROOT"
 #   ALLOW_BIOME_BUMP=1 git commit ...
 PINNED_PKG_JSON="js/package.json"
 if git diff --cached --name-only --diff-filter=ACM | grep -qx "$PINNED_PKG_JSON"; then
-    # Pinned: @biomejs/biome → 2.4.15.
+    # Pinned: @biomejs/biome → 2.5.0.
     #
     # Rationale: biome 2.4.12 through 2.4.16 have a deterministic Rust stack
     # overflow on macOS arm64 when running TS-aware nursery rules
@@ -26,12 +26,14 @@ if git diff --cached --name-only --diff-filter=ACM | grep -qx "$PINNED_PKG_JSON"
     # 2.4.16 locally on 2026-05-28 and CONFIRMED it still crashes — see
     # DataRecce/recce-cloud-infra#1382 for the testing notes.
     #
-    # The js/biome.json in this repo does NOT currently enable those rules,
-    # so 2.4.15 is safe here. But a silent dependabot bump past this version
-    # (or a future enabling of those rules) could regress us. Any change
-    # requires deliberate ack. When biome ships a release that confirms the
-    # full fix, update EXPECTED_BIOME in the same commit as the bump.
-    EXPECTED_BIOME="2.4.15"
+    # 2.5.0 is ABOVE the affected 2.4.12–2.4.16 range and verified clean on
+    # macOS arm64 (`biome check src/` + `packages/ui/src/` exit 0, no stack
+    # overflow). Bumped to 2.5.0 in #1435; this guard was left at 2.4.15 by
+    # that PR and reconciled here. The js/biome.json in this repo does NOT
+    # currently enable those nursery rules either. A silent dependabot bump
+    # still requires deliberate ack: when changing biome, update EXPECTED_BIOME
+    # in the same commit as the bump (and re-run the macOS arm64 check above).
+    EXPECTED_BIOME="2.5.0"
     # head -1 hardens against a future pnpm.overrides entry adding a second
     # "@biomejs/biome": line. Fail-loud (below) if extraction is empty so a
     # package.json reformat (or removed dep) can't silently disable the guard.

js/package.json

@@ -56,7 +56,7 @@
     "chart.js": "^4.5.1",
     "codemirror": "^6.0.2",
     "common-tags": "^1.8.2",
-    "date-fns": "~4.2.1",
+    "date-fns": "^4.4.0",
     "file-saver": "^2.0.5",
     "happy-dom": "^20.10.5",
     "import-in-the-middle": "^3.0.2",

js/pnpm-lock.yaml

@@ -52,10 +52,7 @@ overrides:
   'yaml@>=2.0.0 <2.8.3': '>=2.8.3'
   'js-cookie@<3.0.7': ^3.0.7
   'ws@>=8.0.0 <8.20.1': ^8.20.1
-  # Pinned to 4.2.x: date-fns 4.3.0 added a modularized optimization fallback
-  # that breaks `vi.mock("date-fns", ...)` in TimelineEvent.test.tsx (OSS).
-  # Revisit when the test mock is updated to handle subpath re-exports.
-  date-fns: ~4.2.1
+  date-fns: ^4.1.0
 
 allowBuilds:
   # Allowed: these packages produce native artifacts we use at runtime