Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates - #988

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-57690da707
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-57690da707

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 7 updates in the / directory:

Package From To
@biomejs/biome 2.5.9 2.5.13
turbo 2.10.10 2.10.12
@clerk/backend 3.16.7 3.17.2
@supabase/postgrest-js 2.112.3 2.116.0
@supabase/supabase-js 2.112.3 2.116.0
fast-check 4.9.0 4.10.0
yaml 2.9.0 2.9.1

Updates @biomejs/biome from 2.5.9 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

  • #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

    /* Invalid */
    @import 'foo.css';
    .my-style {
    color: red;
    }
    /* Valid */
    @​import 'foo.css' layer(base);
    @​layer base {
    .my-style {
    color: red;
    }
    }

  • #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

    element.childNodes[0];
    element.children[0];
    element.parentElement.parentElement;
    element.querySelector("a").querySelector("b");
  • #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

  • #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

  • #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

  • #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

  • #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

  • #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

    const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

... (truncated)

Commits

Updates turbo from 2.10.10 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

... (truncated)

Commits

Updates @clerk/backend from 3.16.7 to 3.17.2

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.17.2

Patch Changes

  • Update Clerk Dashboard links in option descriptions, error messages, and READMEs to use the active-instance shortcut (https://dashboard.clerk.com/~/…) instead of the legacy /last-active?path=… URL. (#9653) by @​SarahSoutoul

  • Updated dependencies [452107a, 7ea009f, 06be25f, c47e9cb, 1601100]:

    • @​clerk/shared@​4.31.1
Changelog

Sourced from @​clerk/backend's changelog.

3.17.2

Patch Changes

  • Update Clerk Dashboard links in option descriptions, error messages, and READMEs to use the active-instance shortcut (https://dashboard.clerk.com/~/…) instead of the legacy /last-active?path=… URL. (#9653) by @​SarahSoutoul

  • Updated dependencies [452107a, 7ea009f, 06be25f, c47e9cb, 1601100]:

    • @​clerk/shared@​4.31.1

3.17.1

Patch Changes

  • Updated dependencies [25d8633]:
    • @​clerk/shared@​4.31.0

3.17.0

Minor Changes

  • Add experimental methods for sending and retrieving internal transactional emails, including Clerk suppression state and reasons. (#9553) by @​jescalan

Patch Changes

  • Reject JWT-template tokens presented as session tokens in the Authorization header when acceptsToken is 'any' or an array that includes 'session_token'. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token, matching the existing acceptsToken: 'session_token' behavior. (#9511) by @​dominic-clerk

3.16.13

Patch Changes

  • Align JSDoc link targets with the docs link rules: internal docs links don't open in a new tab (removed {{ target: '_blank' }} from the Invitation Metadata link), while API reference links do (added it to the ExternalAccount Backend API link and the currentUser() endpoint link). (#9556) by @​manovotny

  • Updated dependencies [0d224f2]:

    • @​clerk/shared@​4.30.2

3.16.12

Patch Changes

  • Updated dependencies [dbaa95a]:
    • @​clerk/shared@​4.30.1

3.16.11

Patch Changes

3.16.10

... (truncated)

Commits
  • ed4e84d ci(repo): Version packages (#9658)
  • 88a965c chore(repo): Migrate to Vitest 5 (#9664)
  • 7ea009f fix(repo): use canonical Dashboard links and ban legacy last-active URLs (#9653)
  • 15d4814 chore(backend): Update dependency msw to v2.15.0 (#9528)
  • 804a501 ci(repo): Version packages (#9635)
  • 63a8efc ci(repo): Version packages (#9609)
  • c4f9883 feat(backend): add transactional email API (#9553)
  • eef0ceb fix(backend): Reject JWT-template tokens on the acceptsToken any/array header...
  • b89ce56 ci(repo): Version packages (#9552)
  • 9c5e93c docs(backend,nextjs): Align JSDoc link targets with docs link rules (#9556)
  • Additional commits viewable in compare view

Updates @supabase/postgrest-js from 2.112.3 to 2.116.0

Release notes

Sourced from @​supabase/postgrest-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add bucket lifecycle configuration (#2659)
  • storage: topk 10k support (#2667)
  • storage: add versionId support to create URL methods (#2678)

🩹 Fixes

  • auth: silence commit-guard-discarded refresh in initial session (#2668)
  • storage: drop legacy prefix from lifecycles (#2674)
  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

  • fadymak
  • Ferhat Elmas
  • Katerina Skroumpelou @​mandarini
  • Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add versionId support to create URL methods (#2678)

❤️ Thank You

  • fadymak
  • Katerina Skroumpelou
  • Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

  • storage: topk 10k support (#2667)

🩹 Fixes

  • storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/postgrest-js's changelog.

2.116.0 (2026-09-07)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

🩹 Fixes

  • postgrest: move override fixtures out of generated types, repair codegen (#2605)

❤️ Thank You

Commits
  • dbe7679 chore(release): version 2.115.0 changelogs (#2664)
  • 92fb8ba feat(postgrest): add getOpenApiSpec() (#2651)
  • aef432b chore(release): version 2.114.0 changelogs (#2653)
  • 67b07b0 chore(release): version 2.113.0 changelogs (#2650)
  • 062ae5e chore(release): version 2.112.4 changelogs (#2628)
  • c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
  • 6653465 fix(postgrest): move override fixtures out of generated types, repair codegen...
  • bbc167c chore(release): version 2.112.3 changelogs (#2608)
  • See full diff in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.116.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add bucket lifecycle configuration (#2659)
  • storage: topk 10k support (#2667)
  • storage: add versionId support to create URL methods (#2678)

🩹 Fixes

  • auth: silence commit-guard-discarded refresh in initial session (#2668)
  • storage: drop legacy prefix from lifecycles (#2674)
  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

  • fadymak
  • Ferhat Elmas
  • Katerina Skroumpelou @​mandarini
  • Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)
  • storage: add versionId support to create URL methods (#2678)

❤️ Thank You

  • fadymak
  • Katerina Skroumpelou
  • Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

  • storage: topk 10k support (#2667)

🩹 Fixes

  • storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

🩹 Fixes

  • supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

2.114.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

Commits

Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit

Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0
  • (PR#7226) Doc: Fix admonition titles on the website
  • (PR#7246) Doc: Add jkomyno as code contributor
  • (PR#7251) Performance: Single timer for interruptAfterTimeLimit

Commits
  • 4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @​fast-check/jest@​2.3.0, @​fast-ch...
  • a433d8b ⬆️ Update dependency @​types/node to ^24.13.4 (#7263)
  • 8470c46 ⬆️ Update dependency @​microsoft/api-extractor to ^7.59.1 (#7255)
  • 5382221 🗑️ Deprecate v5 removals (#7261)
  • 3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
  • a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
  • 0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
  • 917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
  • 32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
  • 485f337 👥 Add jkomyno as code contributor (#7246)
  • Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

…ith 7 updates

Bumps the dev-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.13` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.10.12` |
| [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.16.7` | `3.17.2` |
| [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.112.3` | `2.116.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.116.0` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |



Updates `@biomejs/biome` from 2.5.9 to 2.5.13
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome)

Updates `turbo` from 2.10.10 to 2.10.12
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.10...v2.10.12)

Updates `@clerk/backend` from 3.16.7 to 3.17.2
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.17.2/packages/backend)

Updates `@supabase/postgrest-js` from 2.112.3 to 2.116.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/postgrest-js)

Updates `@supabase/supabase-js` from 2.112.3 to 2.116.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/supabase-js)

Updates `fast-check` from 4.9.0 to 4.10.0
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.0/packages/fast-check)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.10.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@clerk/backend"
  dependency-version: 3.17.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/postgrest-js"
  dependency-version: 2.116.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.116.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: fast-check
  dependency-version: 4.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner September 20, 2026 23:54
@dependabot @github

dependabot Bot commented on behalf of github Sep 20, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026
@changeset-bot

changeset-bot Bot commented Sep 20, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: ba8083e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Requesting changes. The bumps themselves are fine, but the PR is not mergeable as-is: Biome 2.5.13 formats two files differently from 2.5.9, and Lint (Biome) fails with exactly those two errors.

The blocker

  • packages/stack-prisma/test/operation-types.types.test-d.ts: the closing > of several M3<…> generics now joins the previous line (five sites, lines 109–126).
  • packages/stack/__tests__/operation-failure-diagnostics.test.ts: the same shape at line 82.

Reproduced locally:

pnpm dlx @biomejs/biome@2.5.13 check . --diagnostic-level=error

Dependabot will not fix this itself. Someone needs to push one commit onto this branch:

pnpm install --frozen-lockfile && pnpm run code:fix

It touches only those two files. Bumping Biome on main first has the same problem there, so the reformat has to ride with the bump.

Two more things 2.5.13 changes that CI does not gate on, worth the same commit

  • e2e/wasm/supabase-declared.test.ts:84: the biome-ignore lint/suspicious/noExplicitAny comment no longer reaches const qb: any on line 86, because a deno-lint-ignore line sits between them. 2.5.13 reports the suppression as unused and the any as unsuppressed (both warnings today). Move the biome-ignore directly above line 86.
  • lint/suspicious/useIterableCallbackReturn now fires, at error level under our config, on a forEach callback whose arrow body returns a call's value (for example xs.forEach((x) => walk(x))). Nothing on main trips it. New code will, so expect it on rebases.

What I checked on the bumps

  • @supabase/postgrest-js / @supabase/supabase-js 2.112.3 → 2.116.0 (devDependencies, pinned exactly): the only postgrest-js change in the range is a new getOpenApiSpec(); the rest is auth, storage and realtime. The live Supabase v3 integration job passed on this PR, which is the check that matters for the PostgREST wire behaviour the adapter depends on.
  • @clerk/backend 3.16.7 → 3.17.2 is not verified by this PR's CI. It is only exercised by the Drizzle identity (lock-context) suites, and those fail on every Dependabot PR with missing CLERK_MACHINE_TOKEN: the two Clerk tokens are Actions secrets but not Dependabot secrets (details in my review on #986). Add them to Dependabot secrets and rebase, and those cells will both go green and actually test this bump.
  • fast-check 4.9 → 4.10, turbo 2.10.10 → 2.10.12, yaml 2.9.0 → 2.9.1: unit, property and e2e jobs green.
  • Lockfile-only otherwise. No onlyBuiltDependencies change; frozen-lockfile install, OSV scan and the supply-chain e2e passed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant