chore(deps): bump the minor-and-patch group with 2 updates

[dependabot]

Bumps the minor-and-patch group with 2 updates: @pulumi/pulumi and @biomejs/biome.

Updates @pulumi/pulumi from 3.254.0 to 3.255.0

Release notes

Sourced from @​pulumi/pulumi's releases.

v3.255.0

3.255.0 (2026-07-28)

Features

• [cli] Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
• [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment #23993
• [engine] Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations #24016
• [cli/do] Add --resources to refer to existing resources in state in do input expressions #24037

Bug Fixes

• [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers #24017
• [pcl] Apply the providers option of a component block to the resources and invokes it declares #24016
• [cli/import] Fix import file generation when parent resources share names #24069
• [cli] Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error #24080
• [sdk/python] Allow Construct and Call methods to run concurrently in provider servers #24081

Improvements

• [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) #23856
• [cli] Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers #23960
• [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses #23987
• [engine] Allow policy packs to point to executable binaries, not just script folders #24052
• [cli/display] The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation #24075
• [sdk/python] Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used #24077
• [cli] Allow otel traces to be sent over https #24078

Changelog

Sourced from @​pulumi/pulumi's changelog.

3.255.0 (2026-07-28)

Features

• [cli] Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
• [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment #23993
• [engine] Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations #24016
• [cli/do] Add --resources to refer to existing resources in state in do input expressions #24037

Bug Fixes

• [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers #24017
• [pcl] Apply the providers option of a component block to the resources and invokes it declares #24016
• [cli/import] Fix import file generation when parent resources share names #24069
• [cli] Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error #24080
• [sdk/python] Allow Construct and Call methods to run concurrently in provider servers #24081

Improvements

• [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) #23856
• [cli] Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers #23960
• [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses #23987
• [engine] Allow policy packs to point to executable binaries, not just script folders #24052
• [cli/display] The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation #24075
• [sdk/python] Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used #24077
• [cli] Allow otel traces to be sent over https #24078

Commits

• 7d30b0c Add manual resource references to do (#24037)
• aa51d8a otel traces: allow traces over https:// (#24078)
• 0d702ca Parent invokes written inside a component to that component in nodejs (#24017)
• 3b6e0db Add an l3-component-invoke conformance test, and apply a component's provider...
• 6c9f7e4 Allow state converters to supply resource inputs and outputs (#23987)
• 04abe85 Add the l2-raw-string-bytes conformance test (#23856)
• d146f10 Use ResourceRefernce.Name and Type instead of URN parsing in NodeJS and Pytho...
• 43b2946 Changelog and go.mod updates for v3.254.0 (#24047)
• 8a46b20 Freeze v3.254.0 (#24039)
• See full diff in compare view

Updates @biomejs/biome from 2.5.5 to 2.5.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

• #10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions