deps: Upgrade @biomejs/biome,@vercel/ncc & cspell - #173

Walkthrough

Removed Nu 0.87.1 from the CI test matrix in .github/workflows/full-matrix.yaml. Updated several devDependencies in package.json (biome, @types/node, @types/semver, @vercel/ncc, cspell, lefthook). No functional code or public API changes.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• deps: Upgrade @biomejs/biome, @types/node and lefthook #167 — Similar devDependency upgrades (biome, @types/node, lefthook).
• deps: Upgrade typescript,cspell, and @biomejs/biome #163 — Overlapping updates to biome, @types/node, and cspell.
• deps: Upgrade @biomejs/biome,@types/shelljs,cspell and lefthook #158 — Bumps the same devDependencies (biome, cspell, lefthook, types).

Poem

A whisk of versions, hop-hop—gone,
0.87 hops off the lawn.
Tools get shiny, lint winds hum,
Types and hooks go thrum-thrum-thrum.
In CI fields I nibble hay—
Green checks bloom. Ship away! 🐇✨

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Code Analysis

• Dependency version updates across multiple packages (Biome, Node types, semver types, NCC, cspell, lefthook)
• All updates appear to be minor/patch version bumps following semantic versioning
• No breaking changes expected based on version increments
• Maintains consistent development tooling ecosystem

Security Review

• ✅ NCC update from 0.38.3 to 0.38.4 likely includes security patches
• ✅ cspell update from 9.2.0 to 9.2.1 may include dictionary/security improvements
• ✅ lefthook update from 1.12.3 to 1.13.1 could include security enhancements
• ✅ All updates are to trusted, widely-used development tools

Optimization Suggestions

• Consider adding --prefer-offline flag to npm/yarn installs to cache these dev dependencies
• Evaluate if any of these tools could be moved to optional dependencies if not used in all workflows
• Monitor bundle size impact from NCC update (though minimal for dev dependencies)

Overall Quality: 4

Code Analysis

• This appears to be a GitHub Actions workflow and package.json update, not frontend React/Vue code
• Changes involve CI/CD configuration and dependency version bumps
• Removed Nu version 0.87.1 from testing matrix
• Updated multiple devDependencies to newer patch versions

Security Review

• Dependency updates include security patches (e.g., @biomejs/biome 2.2.2 → 2.2.4)
• @types/node update (24.3.0 → 24.5.2) likely includes security fixes
• lefthook update (1.12.3 → 1.13.1) may contain security improvements
• No obvious security vulnerabilities introduced in these changes

Optimization Suggestions

• Consider adding caching to GitHub Actions workflow for faster CI runs
• Evaluate if all tested Nu versions are still necessary for maintenance
• Monitor bundle size impact from dependency updates (though minimal for devDependencies)

Overall Quality: 4
(Note: This review focuses on infrastructure/config changes rather than frontend code. The changes appear to be routine maintenance and dependency updates with no concerning patterns.)