@biomejs/biome@2.5.13 v0.0.19
ChatbotXIO/ChatbotXSep 10, 2026 → Sep 10, 20260 days between releases
What's New
Newer release introduces runnable server artifacts and security hardening via CSPRNG and SSRF guards, replacing the older version's focus on linting rules.
Breaking Changes
- Plugin contentAccess must now be defined in the manifest as it is carried over from the config.
- Storage upload handling now passes through an SSRF-safe fetch guard, potentially breaking custom implementations.
New Features
- Runnable server artifacts are now available.
- Plugins can now ingest managed media.
- Sandbox generates random numbers using CSPRNG.
- Storage uploads are protected against SSRF via a fetch guard.
Improvements
- Plugin sandbox security has been enhanced with CSPRNG.
- Media handling capabilities have been improved.
- Site imports now correctly handle alt text and script order.
- Dev servers now install dependencies before starting.
Bug Fixes
- Plugin SDK now correctly carries contentAccess into the manifest.
- Site imports now preserve alt text, script order, and folders.
- Import wrapping logic for compound buttons is fixed.
- Runtime path containment now uses relative() instead of string prefix.
Upgrade Notes
Ensure your plugin manifest includes the `contentAccess` configuration if it was previously defined in the plugin config. Review media upload implementations as they now route through an SSRF-safe fetch guard.
The Two Releases
Biome CLI v2.5.13
Sep 10, 2026· 1 month ago
Patch release adding new CSS and DOM linting rules while improving performance for type-aware linting and fixing Astro template parsing.
Full release notesInstatic 0.0.19
Sep 10, 2026· 1 month ago
A coordinated security release that also adds runnable server artifacts and improves plugin sandbox security and media handling capabilities.
Full release notes