Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates - #830

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-fdcdba4576
Open

chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates#830
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-fdcdba4576

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 6 updates in the / directory:

Package From To
@biomejs/biome 2.5.3 2.5.5
@changesets/cli 2.31.0 2.31.1
turbo 2.10.4 2.10.7
@clerk/backend 3.11.3 3.13.1
@supabase/postgrest-js 2.110.2 2.110.8
@supabase/supabase-js 2.110.2 2.110.8

Updates @biomejs/biome from 2.5.3 to 2.5.5

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.5

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.5

Patch Changes

  • #10972 ab8c21b Thanks @​ematipico! - Fixed useExhaustiveSwitchCases for unions of bigint literals. The rule now reports missing bigint cases and compares bigint literals by value, including binary, octal, hexadecimal, and separator-containing spellings. For example, this switch now reports the missing 2n case:

    declare const value: 1n | 2n;
switch (value) {
  case 1n:
    break;
}

  • #10972 ab8c21b Thanks @​ematipico! - Fixed false positives in noBaseToString and useNullishCoalescing when member, stringification, or nullish inference cannot complete. These rules now suppress diagnostics instead of reporting from partial type information. For example, neither expression is reported when a recursive type cannot be fully resolved:

    type Recursive = Recursive;
declare const value: Recursive;
String(value);
value || "fallback";

  • #10977 0bf7486 Thanks @​ematipico! - Fixed #10922: the action useSortedAttributes no longer triggers for HTML instructions.

  • #10957 cf263c4 Thanks @​dyc3! - Fixed noThenProperty failing to detect Object.fromEntries, Object.defineProperty, and Reflect.defineProperty calls with comments between their tokens.

  • #10983 edc0ed7 Thanks @​ayaangazali! - Fixed #10980: useAriaPropsSupportedByRole no longer reports false positives when the attribute that determines an element's implicit ARIA role is written as a shorthand attribute, such as <a {href} aria-label="..."> in Astro and Svelte files.

    Shorthand attributes are now taken into account when computing the implicit role, so the anchor above correctly resolves to the link role instead of generic.

  • #10889 89526e3 Thanks @​denbezrukov! - Fixed CSS formatter casing for syntax-owned names while preserving author-defined names, including scoped keyframes and container scroll-state queries.

    - A:HOVER { COLOR: INITIAL; }
+ A:hover { color: initial; }
- @KEYFRAMES :GLOBAL KeepFrames { FROM { COLOR: RED; } }
+ @keyframes :GLOBAL KeepFrames { from { color: RED; } }
- @CONTAINER scroll-state((SCROLLED: TOP) AND (STUCK)) { A:HOVER { COLOR: RED; } }
+ @container scroll-state((SCROLLED: TOP) AND (STUCK)) { A:hover { color: RED; } }

  • #10964 794ccd0 Thanks @​denbezrukov! - Fixed CSS formatting for comments between declaration values and !important.

    -a { color: /* before */ /* after */ red !important; }
+a { color: /* before */ red /* after */ !important; }

... (truncated)

Commits

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

  • #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.
Commits
  • a897bb8 Use a different publish tag for maintenance/v2 branch (#2162)
  • e8650b9 Version Packages (#2161)
  • 15cf592 Fixed handling of the npm 12 info output (#2159)
  • 9f2cb2a Configure Changesets for maintenance/v2 line (#2076)
  • 97247cb Change allowed publish pattern to maintenance/v* given rulesets behavior (#...
  • 13286a8 Build(deps): Bump the github-actions group across 1 directory with 3 updates ...
  • 8f6acd6 Update dependabot group to exclude major (#2067)
  • c70c675 Setup backport workflow and sync next setup (#2057)
  • 9672019 Remove SECURITY.md to defer to .github (#2055)
  • 18e1661 Use internal bot for versioning (#2039)
  • Additional commits viewable in compare view

Updates turbo from 2.10.4 to 2.10.7

Release notes

Sourced from turbo's releases.

Turborepo v2.10.7

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.6...v2.10.7

Turborepo v2.10.7-canary.1

What's Changed

Changelog

... (truncated)

Commits

Updates @clerk/backend from 3.11.3 to 3.13.1

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.13.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8
Changelog

Sourced from @​clerk/backend's changelog.

3.13.1

Patch Changes

  • Updated dependencies [01f2c12]:
    • @​clerk/shared@​4.25.8

3.13.0

Minor Changes

  • Add an fapiUrl option to Frontend API proxy helpers so requests can target a custom Clerk Frontend API URL. (#9223) by @​thiskevinwang

Patch Changes

  • Updated dependencies [097432d]:
    • @​clerk/shared@​4.25.7

3.12.0

Minor Changes

  • Fix a cross-origin handshake bypass where isKnownClerkReferrer() trusted overly broad referrer hosts as Clerk-owned: any accounts.* host (e.g. accounts.attacker.com), plus dev account-portal domains (*.accounts.dev and legacy suffixes) on production instances. These let unrelated origins skip the handshake and its session-freshness check. The referrer is now trusted only for the accounts portal derived from the instance's frontend API, plus dev account-portal domains on non-production instances. (#9145) by @​dominic-clerk

  • Add an optional orgId parameter to createSignInToken() for activating an Organization when the token is redeemed. (#9192) by @​swolfand

Patch Changes

  • Standardize JSDoc punctuation to always follow e.g. and i.e. with a comma (e.g., / i.e.,), matching the docs style guide. Comment-only change; no runtime behavior is affected. This keeps the generated Typedoc reference output consistent. (#9201) by @​SarahSoutoul

  • Add the required provider field to CreateEnterpriseConnectionParams. The Backend API has always required provider when creating an enterprise connection, so calls to createEnterpriseConnection() without it type-checked but failed at runtime. The field is typed to the supported provider values ('saml_custom', 'saml_okta', 'saml_google', 'saml_microsoft', 'oidc_custom', 'oidc_github_enterprise', 'oidc_gitlab'), so unsupported values are also caught at compile time. (#9155) by @​manovotny

  • Add the remaining optional enterprise connection parameters supported by the Backend API. CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams now accept allowOrganizationAccountLinking, customAttributes, authenticatable, and disableJitProvisioning (update also accepts disableAdditionalIdentifications), and SAML params accept loginHint for configuring the login_hint sent to the IdP. (#9155) by @​manovotny

  • Align CreateEnterpriseConnectionParams and UpdateEnterpriseConnectionParams with the Backend API contract: (#9155) by @​manovotny

    • name and domains are now required on CreateEnterpriseConnectionParams. The Backend API already rejected requests missing either of them, so calls that omitted these fields failed at runtime; the types now surface this at compile time.
    • Deprecated syncUserAttributes on CreateEnterpriseConnectionParams. The Backend API ignores this parameter on create; use updateEnterpriseConnection() to set it.
    • Deprecated provider on UpdateEnterpriseConnectionParams. The Backend API ignores this parameter on update; the provider cannot be changed after creation.

  • Updated dependencies [858a689, c904fb4]:

    • @​clerk/shared@​4.25.6

3.11.7

Patch Changes

  • Reject machine tokens (M2M and OAuth JWTs) presented in the __session cookie. Previously such a token could pass session verification and produce a signed-in state with the machine identity as userId, defeating if (userId) authorization checks. The cookie path now mirrors the existing header-path guard and returns a signed-out state for these tokens. (#9168) by @​dominic-clerk

  • Updated dependencies [bcbdda6]:

    • @​clerk/shared@​4.25.5

... (truncated)

Commits
  • 9081534 ci(repo): Version packages (#9240)
  • acef8a1 ci(repo): Version packages (#9219)
  • 848eefe feat(backend): support configurable Frontend API proxy URLs (#9223)
  • 430ae23 ci(repo): Version packages (#9195)
  • 858a689 docs(repo): Add trailing comma after e.g. and i.e. in JSDoc (#9201)
  • a009d91 fix(backend): Align enterprise connection create and update params with the B...
  • ff5d991 fix(backend): Fix cross-origin handshake bypass (#9145)
  • 26530ce feat(backend): support organization-scoped sign-in tokens (#9192)
  • b37ba0d ci(repo): Version packages (#9175)
  • e657d99 fix(backend): reject machine JWTs presented as session tokens (#9168)
  • Additional commits viewable in compare view

Updates @supabase/postgrest-js from 2.110.2 to 2.110.8

Release notes

Sourced from @​supabase/postgrest-js's releases.

v2.110.8

2.110.8 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)
  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • storage: url-encode object key in CDN purge methods (#2545)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

v2.110.8-canary.2

2.110.8-canary.2 (2026-07-21)

🩹 Fixes

  • storage: url-encode object key in CDN purge methods (#2545)

❤️ Thank You

v2.110.8-canary.1

2.110.8-canary.1 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)

❤️ Thank You

v2.110.8-canary.0

2.110.8-canary.0 (2026-07-21)

🩹 Fixes

  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/postgrest-js's changelog.

2.110.8 (2026-07-21)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.7 (2026-07-16)

🩹 Fixes

  • postgrest: correct self-reference inference (#2525)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • postgrest: type hinted self-referencing embeds as arrays (#2520)

❤️ Thank You

2.110.5 (2026-07-14)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.4 (2026-07-14)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.3 (2026-07-13)

🩹 Fixes

  • postgrest: pin tstyche target off floating latest (#2509)

❤️ Thank You

Commits
  • 150b00c chore(release): version 2.110.7 changelogs (#2533)
  • 5c18b62 fix(postgrest): correct self-reference inference (#2525)
  • c90b1cd chore(release): version 2.110.6 changelogs (#2527)
  • 035b1ed fix(postgrest): type hinted self-referencing embeds as arrays (#2520)
  • 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
  • 25da097 chore(release): version 2.110.4 changelogs (#2523)
  • aaec93f chore(release): version 2.110.3 changelogs (#2519)
  • f8889ce docs(postgrest): fix outdated cross-fetch guidance (#2507)
  • 05bab02 fix(postgrest): pin tstyche target off floating latest (#2509)
  • 4164458 chore(release): version 2.110.2 changelogs (#2506)
  • See full diff in compare view

Updates @supabase/supabase-js from 2.110.2 to 2.110.8

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.110.8

2.110.8 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)
  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • storage: url-encode object key in CDN purge methods (#2545)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

v2.110.8-canary.2

2.110.8-canary.2 (2026-07-21)

🩹 Fixes

  • storage: url-encode object key in CDN purge methods (#2545)

❤️ Thank You

v2.110.8-canary.1

2.110.8-canary.1 (2026-07-21)

🩹 Fixes

  • auth: downgrade aborted/transient fetch failures from console.error to warn (#2544)

❤️ Thank You

v2.110.8-canary.0

2.110.8-canary.0 (2026-07-21)

🩹 Fixes

  • functions: clean up cross-signal abort listener on invoke() return (#2487)
  • functions: match response Content-Type case-insensitively (#2515)
  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.110.8 (2026-07-21)

🩹 Fixes

  • supabase: skip Node warning in Deno (#2541)

❤️ Thank You

2.110.7 (2026-07-16)

🩹 Fixes

  • realtime: trigger set auth on INITIAL_SESSION event (#2531)

❤️ Thank You

2.110.6 (2026-07-15)

🩹 Fixes

  • supabase: warn instead of throw for unrecognized sb_ API key subtypes (#2526)

❤️ Thank You

2.110.5 (2026-07-14)

🩹 Fixes

  • supabase: avoid edge runtime warning (#2522)

❤️ Thank You

2.110.4 (2026-07-14)

🩹 Fixes

  • functions: stop sending API key in Authorization header for function calls (#2511)

❤️ Thank You

... (truncated)

Commits
  • 01dbb53 fix(supabase): skip Node warning in Deno (#2541)
  • 150b00c chore(release): version 2.110.7 changelogs (#2533)
  • 130fa11 fix(realtime): trigger set auth on INITIAL_SESSION event (#2531)
  • c90b1cd chore(release): version 2.110.6 changelogs (#2527)
  • c23e1ab fix(supabase): warn instead of throw for unrecognized sb_ API key subtypes (#...
  • 8af3c3a chore(release): version 2.110.5 changelogs (#2524)
  • 25da097 chore(release): version 2.110.4 changelogs (#2523)
  • dafa7f5 fix(supabase): avoid edge runtime warning (#2522)
  • 558c1f5 fix(functions): stop sending API key in Authorization header for function cal...
  • aaec93f chore(release): version 2.110.3 changelogs (#2519)
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 29, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 29, 2026 07:09
@changeset-bot

changeset-bot Bot commented Jul 29, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 02264dc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
02264dc 
…ith 6 updates

Bumps the dev-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.3` | `2.5.5` |
| [@changesets/cli](https://github.com/changesets/changesets) | `2.31.0` | `2.31.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.4` | `2.10.7` |
| [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.11.3` | `3.13.1` |
| [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.110.2` | `2.110.8` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.110.2` | `2.110.8` |



Updates `@biomejs/biome` from 2.5.3 to 2.5.5
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.5/packages/@biomejs/biome)

Updates `@changesets/cli` from 2.31.0 to 2.31.1
- [Release notes](https://github.com/changesets/changesets/releases)
- [Commits](https://github.com/changesets/changesets/compare/@changesets/cli@2.31.0...@changesets/cli@2.31.1)

Updates `turbo` from 2.10.4 to 2.10.7
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.4...v2.10.7)

Updates `@clerk/backend` from 3.11.3 to 3.13.1
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.13.1/packages/backend)

Updates `@supabase/postgrest-js` from 2.110.2 to 2.110.8
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.110.8/packages/core/postgrest-js)

Updates `@supabase/supabase-js` from 2.110.2 to 2.110.8
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.110.8/packages/core/supabase-js)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@changesets/cli"
  dependency-version: 2.31.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@clerk/backend"
  dependency-version: 3.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/postgrest-js"
  dependency-version: 2.110.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.110.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.10.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps-dev): bump the dev-dependencies group with 6 updates chore(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates Aug 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-fdcdba4576 branch from 452d371 to 02264dc Compare August 2, 2026 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants