chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #988 · cipherstash/stack

dependabot · 2026-09-20T23:54:03Z

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@biomejs/biome	`2.5.9`	`2.5.13`
turbo	`2.10.10`	`2.10.12`
@clerk/backend	`3.16.7`	`3.17.2`
@supabase/postgrest-js	`2.112.3`	`2.116.0`
@supabase/supabase-js	`2.112.3`	`2.116.0`
fast-check	`4.9.0`	`4.10.0`
yaml	`2.9.0`	`2.9.1`

Updates @biomejs/biome from 2.5.9 to 2.5.13

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.5.13

Patch Changes
#11379 07a0073 Thanks @Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.
/* Invalid */
@import 'foo.css';
.my-style {
color: red;
}
/* Valid */
@import 'foo.css' layer(base);
@layer base {
.my-style {
color: red;
}
}
#11667 e997900 Thanks @devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.
element.childNodes[0];
element.children[0];
element.parentElement.parentElement;
element.querySelector("a").querySelector("b");
#11620 20e513a Thanks @jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

#11657 e322040 Thanks @ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

#11670 4969ee1 Thanks @ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

#11627 23aad6d Thanks @ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

#11631 00dbd3a Thanks @ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.
#11628 a2f8ff7 Thanks @dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.
const kibibyte = 2 ^ 10; // 8, not 1024
#11670 4969ee1 Thanks @ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

810ea56 ci: release (#11614)
e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
c23e4c7 feat: noUnsafeIframeSandbox (#11622)
a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
611767f chore: update depot logo (#11602)
0a31d7c ci: release (#11530)
a20f44a feat: noBunModules (#11597)
Additional commits viewable in compare view

Updates turbo from 2.10.10 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

chore: Release Turborepo 2.10.11 by @github-actions[bot] in vercel/turborepo#13765

feat: Refresh documentation social cards by @christopherkindl in vercel/turborepo#13764

fix: Preserve showcase logo sizes by @christopherkindl in vercel/turborepo#13766

fix: Refine mobile homepage interactions by @christopherkindl in vercel/turborepo#13767

fix: Align homepage KPIs to the right by @christopherkindl in vercel/turborepo#13769

fix: Prevent homepage KPI overflow by @christopherkindl in vercel/turborepo#13770

chore: Update Geistdocs to 1.20.4 by @molebox in vercel/turborepo#13771

perf: Skip unused Package Configuration stats by @vercel-gh-bot-4[bot] in vercel/turborepo#13746

chore: Update with-solid example by @vercel-gh-bot-5[bot] in vercel/turborepo#13752

chore: Update with-tailwind example by @vercel-gh-bot-5[bot] in vercel/turborepo#13762

perf: Stream dry-run JSON output by @vercel-gh-bot-4[bot] in vercel/turborepo#13760

chore: Update with-ultracite example by @vercel-gh-bot-5[bot] in vercel/turborepo#13772

perf: Merge same-prefix tree-wildcard globs into one directory walk by @vercel-gh-bot-5[bot] in vercel/turborepo#13763

chore: Update with-svelte example by @floriansalihovic in vercel/turborepo#13118

chore: Add unified agent control plane by @anthonyshew in vercel/turborepo#13757

fix: Remove incremental task caching by @anthonyshew in vercel/turborepo#13773

chore: Rename agents app to factory by @anthonyshew in vercel/turborepo#13774

chore: Update oxlint and oxfmt by @charpeni in vercel/turborepo#13777

feat: Add security.txt endpoint by @charpeni in vercel/turborepo#13778

feat: Redesign factory control plane by @anthonyshew in vercel/turborepo#13775

perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @vercel-gh-bot-2[bot] in vercel/turborepo#13776

chore: Upgrade the factory eve agent to 0.39.3 by @anthonyshew in vercel/turborepo#13783

chore: Update with-rsbuild-module-federation example by @vercel-gh-bot-4[bot] in vercel/turborepo#13786

perf: Index Berry lockfile resolution overrides by dependency name by @vercel-gh-bot-5[bot] in vercel/turborepo#13787

chore: Update remote cache action to v1.1.0 by @anthonyshew in vercel/turborepo#13789

docs: Fix reference links and validation by @charpeni in vercel/turborepo#13784

feat: Add SSH command affordance for factory sandboxes by @anthonyshew in vercel/turborepo#13779

fix: Show invalid affected task glob by @anthonyshew in vercel/turborepo#13793

perf: Skip unused repository indexing for package listings by @vercel-gh-bot-4[bot] in vercel/turborepo#13792

feat: Rebuild the factory image on every merge to main by @anthonyshew in vercel/turborepo#13781

chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @anthonyshew in vercel/turborepo#13780

chore: Update with-shell-commands example by @vercel-gh-bot-4[bot] in vercel/turborepo#13791

chore: Allow SSH terminal for completed-run sandboxes in Factory by @anthonyshew in vercel/turborepo#13782

fix: Decouple graceful shutdown tests from the shell commands example by @anthonyshew in vercel/turborepo#13799

feat: Start ad-hoc factory work from the operator page by @anthonyshew in vercel/turborepo#13798

chore: Update with-solid example by @vercel-gh-bot-4[bot] in vercel/turborepo#13797

fix: Rebuild factory images without custom workflows by @anthonyshew in vercel/turborepo#13801

feat: Add factory navigation by @anthonyshew in vercel/turborepo#13802

refactor: Migrate Factory styles to Tailwind by @anthonyshew in vercel/turborepo#13803

feat: Add durable Factory workspaces by @anthonyshew in vercel/turborepo#13804

feat: Stream Factory sandbox as terminal by @anthonyshew in vercel/turborepo#13807

fix: Restore Factory workspace creation by @anthonyshew in vercel/turborepo#13812

fix: Update Factory session network policy by @anthonyshew in vercel/turborepo#13814

fix: Improve Factory terminal line spacing by @anthonyshew in vercel/turborepo#13815

fix: Install Factory publishing skill by @anthonyshew in vercel/turborepo#13817

... (truncated)

Commits

53752d4 publish 2.10.12 to registry
9d2b03b fix: Run pnpm directly on Windows (#13843)
c97782b feat: Require high confidence for issue fixes (#13842)
f153cda chore: Alert Slack for low-confidence issues (#13841)
e1674e4 chore: Add automatic issue handling (#13840)
7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
a76330b chore: Handle feedback on Factory pull requests (#13836)
3787c06 chore: Use geistdocs 1.23.1 (#13834)
bbe5406 chore: Skip redundant Factory PR approval (#13837)
72805d7 fix: Move model selector to workspace creation (#13835)
Additional commits viewable in compare view

Updates @clerk/backend from 3.16.7 to 3.17.2

Release notes

Sourced from @clerk/backend's releases.

@clerk/backend@3.17.2

Patch Changes

Update Clerk Dashboard links in option descriptions, error messages, and READMEs to use the active-instance shortcut (https://dashboard.clerk.com/~/…) instead of the legacy /last-active?path=… URL. (#9653) by @SarahSoutoul

Updated dependencies [452107a, 7ea009f, 06be25f, c47e9cb, 1601100]:

@clerk/shared@4.31.1

Changelog

Sourced from @clerk/backend's changelog.

3.17.2

Patch Changes

Update Clerk Dashboard links in option descriptions, error messages, and READMEs to use the active-instance shortcut (https://dashboard.clerk.com/~/…) instead of the legacy /last-active?path=… URL. (#9653) by @SarahSoutoul

Updated dependencies [452107a, 7ea009f, 06be25f, c47e9cb, 1601100]:

@clerk/shared@4.31.1

3.17.1

Patch Changes

Updated dependencies [25d8633]:

@clerk/shared@4.31.0

3.17.0

Minor Changes

Add experimental methods for sending and retrieving internal transactional emails, including Clerk suppression state and reasons. (#9553) by @jescalan

Patch Changes

Reject JWT-template tokens presented as session tokens in the Authorization header when acceptsToken is 'any' or an array that includes 'session_token'. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token, matching the existing acceptsToken: 'session_token' behavior. (#9511) by @dominic-clerk

3.16.13

Patch Changes

Align JSDoc link targets with the docs link rules: internal docs links don't open in a new tab (removed {{ target: '_blank' }} from the Invitation Metadata link), while API reference links do (added it to the ExternalAccount Backend API link and the currentUser() endpoint link). (#9556) by @manovotny

Updated dependencies [0d224f2]:

@clerk/shared@4.30.2

3.16.12

Patch Changes

Updated dependencies [dbaa95a]:

@clerk/shared@4.30.1

3.16.11

Patch Changes

Updated dependencies [28b77ac, 46bf7ce, 8bc1c9f, 17b865b]:

@clerk/shared@4.30.0

3.16.10

... (truncated)

Commits

ed4e84d ci(repo): Version packages (#9658)
88a965c chore(repo): Migrate to Vitest 5 (#9664)
7ea009f fix(repo): use canonical Dashboard links and ban legacy last-active URLs (#9653)
15d4814 chore(backend): Update dependency msw to v2.15.0 (#9528)
804a501 ci(repo): Version packages (#9635)
63a8efc ci(repo): Version packages (#9609)
c4f9883 feat(backend): add transactional email API (#9553)
eef0ceb fix(backend): Reject JWT-template tokens on the acceptsToken any/array header...
b89ce56 ci(repo): Version packages (#9552)
9c5e93c docs(backend,nextjs): Align JSDoc link targets with docs link rules (#9556)
Additional commits viewable in compare view

Updates @supabase/postgrest-js from 2.112.3 to 2.116.0

Release notes

Sourced from @supabase/postgrest-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

auth: add MFA recovery codes API (#2676)

storage: add bucket lifecycle configuration (#2659)

storage: topk 10k support (#2667)

storage: add versionId support to create URL methods (#2678)

🩹 Fixes

auth: silence commit-guard-discarded refresh in initial session (#2668)

storage: drop legacy prefix from lifecycles (#2674)

supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

fadymak

Ferhat Elmas

Katerina Skroumpelou @mandarini

Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

auth: add MFA recovery codes API (#2676)

storage: add versionId support to create URL methods (#2678)

❤️ Thank You

fadymak

Katerina Skroumpelou

Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

storage: topk 10k support (#2667)

🩹 Fixes

storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @supabase/postgrest-js's changelog.

2.116.0 (2026-09-07)

This was a version bump only for @supabase/postgrest-js to align it with other projects, there were no code changes.

2.115.0 (2026-09-03)

🚀 Features

postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

Katerina Skroumpelou @mandarini

2.114.0 (2026-09-02)

This was a version bump only for @supabase/postgrest-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

🩹 Fixes

postgrest: move override fixtures out of generated types, repair codegen (#2605)

❤️ Thank You

Katerina Skroumpelou @mandarini

Commits

dbe7679 chore(release): version 2.115.0 changelogs (#2664)
92fb8ba feat(postgrest): add getOpenApiSpec() (#2651)
aef432b chore(release): version 2.114.0 changelogs (#2653)
67b07b0 chore(release): version 2.113.0 changelogs (#2650)
062ae5e chore(release): version 2.112.4 changelogs (#2628)
c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
6653465 fix(postgrest): move override fixtures out of generated types, repair codegen...
bbc167c chore(release): version 2.112.3 changelogs (#2608)
See full diff in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.116.0

Release notes

Sourced from @supabase/supabase-js's releases.

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

auth: add MFA recovery codes API (#2676)

storage: add bucket lifecycle configuration (#2659)

storage: topk 10k support (#2667)

storage: add versionId support to create URL methods (#2678)

🩹 Fixes

auth: silence commit-guard-discarded refresh in initial session (#2668)

storage: drop legacy prefix from lifecycles (#2674)

supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

fadymak

Ferhat Elmas

Katerina Skroumpelou @mandarini

Tyler Hillery

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

auth: add MFA recovery codes API (#2676)

storage: add versionId support to create URL methods (#2678)

❤️ Thank You

fadymak

Katerina Skroumpelou

Tyler Hillery

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

storage: topk 10k support (#2667)

🩹 Fixes

storage: drop legacy prefix from lifecycles (#2674)

❤️ Thank You

... (truncated)

Changelog

Sourced from @supabase/supabase-js's changelog.

2.116.0 (2026-09-07)

🚀 Features

auth: add MFA recovery codes API (#2676)

🩹 Fixes

supabase: warn when schema is passed outside db options (#2663)

❤️ Thank You

fadymak

Katerina Skroumpelou @mandarini

2.115.0 (2026-09-03)

🚀 Features

postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

Katerina Skroumpelou @mandarini

2.114.0 (2026-09-02)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.113.0 (2026-09-02)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

2.112.4 (2026-08-24)

This was a version bump only for @supabase/supabase-js to align it with other projects, there were no code changes.

Commits

5aedaab feat(auth): add MFA recovery codes API (#2676)
e4f675a fix(supabase): warn when schema is passed outside db options (#2663)
dbe7679 chore(release): version 2.115.0 changelogs (#2664)
3eb6193 docs(supabase): clarify db.schema needs the second generic (#2662)
92fb8ba feat(postgrest): add getOpenApiSpec() (#2651)
aef432b chore(release): version 2.114.0 changelogs (#2653)
67b07b0 chore(release): version 2.113.0 changelogs (#2650)
062ae5e chore(release): version 2.112.4 changelogs (#2628)
c7397c1 chore(supabase): bump supabase cli to 2.113.0 (#2606)
bbc167c chore(release): version 2.112.3 changelogs (#2608)
See full diff in compare view

Updates fast-check from 4.9.0 to 4.10.0

Release notes

Sourced from fast-check's releases.

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

(PR#7216) Introduce a plugin API

(PR#7221) Refine plugin API

(PR#7222) Add ability to configure plugins globally

(PR#7224) Add the beforeEach plugin to hook in life-cycle

(PR#7227) Create an afterEach plugin

(PR#7232) Deprecate life-cycle methods

(PR#7235) Support teardown of beforeEach plugin

(PR#7228) Add timeout plugin to stop long running predicates

(PR#7237) Deprecate timeout from parameters

(PR#7238) Pass a store to plugins

(PR#7239) Add extra plugin's method called onAllRunsComplete

(PR#7240) Deprecate reporter and asyncReporter from parameters

(PR#7229) Add plugin to interrupt after time limit

(PR#7245) Support failOnInterrupt on the plugin

(PR#7230) Add plugins to drop runs on already covered cases

(PR#7259) Add ability to decorate generate via Plugins

(PR#7231) Add the unbiased plugin to generate without bias

(PR#7260) Deprecate parameters superseded by plugins

(PR#7261) Deprecate v5 removals

Fixes

(PR#7225) Bug: Proper ordering between plugins

(PR#7127) CI: Announce on Bluesky when drafting the release

(PR#7217) CI: Dedupe packages for pnpm

(PR#7137) Doc: Release note for 4.9.0

(PR#7226) Doc: Fix admonition titles on the website

(PR#7246) Doc: Add jkomyno as code contributor

(PR#7251) Performance: Single timer for interruptAfterTimeLimit

Changelog

Sourced from fast-check's changelog.

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

(PR#7216) Introduce a plugin API

(PR#7221) Refine plugin API

(PR#7222) Add ability to configure plugins globally

(PR#7224) Add the beforeEach plugin to hook in life-cycle

(PR#7227) Create an afterEach plugin

(PR#7232) Deprecate life-cycle methods

(PR#7235) Support teardown of beforeEach plugin

(PR#7228) Add timeout plugin to stop long running predicates

(PR#7237) Deprecate timeout from parameters

(PR#7238) Pass a store to plugins

(PR#7239) Add extra plugin's method called onAllRunsComplete

(PR#7240) Deprecate reporter and asyncReporter from parameters

(PR#7229) Add plugin to interrupt after time limit

(PR#7245) Support failOnInterrupt on the plugin

(PR#7230) Add plugins to drop runs on already covered cases

(PR#7259) Add ability to decorate generate via Plugins

(PR#7231) Add the unbiased plugin to generate without bias

(PR#7260) Deprecate parameters superseded by plugins

(PR#7261) Deprecate v5 removals

Fixes

(PR#7225) Bug: Proper ordering between plugins

(PR#7127) CI: Announce on Bluesky when drafting the release

(PR#7217) CI: Dedupe packages for pnpm

(PR#7137) Doc: Release note for 4.9.0

(PR#7226) Doc: Fix admonition titles on the website

(PR#7246) Doc: Add jkomyno as code contributor

(PR#7251) Performance: Single timer for interruptAfterTimeLimit

Commits

4fba17d 🔖 Update CHANGELOG.md for fast-check@4.10.0, @fast-check/jest@2.3.0, @fast-ch...
a433d8b ⬆️ Update dependency @types/node to ^24.13.4 (#7263)
8470c46 ⬆️ Update dependency @microsoft/api-extractor to ^7.59.1 (#7255)
5382221 🗑️ Deprecate v5 removals (#7261)
3cc3696 🗑️ Deprecate parameters superseded by plugins (#7260)
a93374d ✨ Add the unbiased plugin to generate without bias (#7231)
0f1bf99 ✨ Add ability to decorate generate via Plugins (#7259)
917a447 ✨ Add plugins to drop runs on already covered cases (#7230)
32daf74 ⚡️ Single timer for interruptAfterTimeLimit (#7251)
485f337 👥 Add jkomyno as code contributor (#7246)
Additional commits viewable in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

Limit recursive merge aliases (#685, #713)

Simplify line unfolding during quoted string parsing (#714)

Commits

1440ecd 2.9.1
c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
d11ce77 fix: Limit recursive merge aliases (#713)

…ith 7 updates Bumps the dev-dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.13` | | [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.10.12` | | [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.16.7` | `3.17.2` | | [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.112.3` | `2.116.0` | | [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.116.0` | | [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.0` | | [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` | Updates `@biomejs/biome` from 2.5.9 to 2.5.13 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.13/packages/@biomejs/biome) Updates `turbo` from 2.10.10 to 2.10.12 - [Release notes](https://github.com/vercel/turborepo/releases) - [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md) - [Commits](vercel/turborepo@v2.10.10...v2.10.12) Updates `@clerk/backend` from 3.16.7 to 3.17.2 - [Release notes](https://github.com/clerk/javascript/releases) - [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md) - [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.17.2/packages/backend) Updates `@supabase/postgrest-js` from 2.112.3 to 2.116.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/postgrest-js) Updates `@supabase/supabase-js` from 2.112.3 to 2.116.0 - [Release notes](https://github.com/supabase/supabase-js/releases) - [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md) - [Commits](https://github.com/supabase/supabase-js/commits/v2.116.0/packages/core/supabase-js) Updates `fast-check` from 4.9.0 to 4.10.0 - [Release notes](https://github.com/dubzzz/fast-check/releases) - [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md) - [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.0/packages/fast-check) Updates `yaml` from 2.9.0 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.5.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: turbo dependency-version: 2.10.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@clerk/backend" dependency-version: 3.17.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/postgrest-js" dependency-version: 2.116.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@supabase/supabase-js" dependency-version: 2.116.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: fast-check dependency-version: 4.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-09-20T23:54:05Z

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

changeset-bot · 2026-09-20T23:54:07Z

⚠️ No Changeset found

Latest commit: ba8083e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

freshtonic

Requesting changes. The bumps themselves are fine, but the PR is not mergeable as-is: Biome 2.5.13 formats two files differently from 2.5.9, and Lint (Biome) fails with exactly those two errors.

The blocker

packages/stack-prisma/test/operation-types.types.test-d.ts: the closing > of several M3<…> generics now joins the previous line (five sites, lines 109–126).
packages/stack/__tests__/operation-failure-diagnostics.test.ts: the same shape at line 82.

Reproduced locally:

pnpm dlx @biomejs/biome@2.5.13 check . --diagnostic-level=error

Dependabot will not fix this itself. Someone needs to push one commit onto this branch:

pnpm install --frozen-lockfile && pnpm run code:fix

It touches only those two files. Bumping Biome on main first has the same problem there, so the reformat has to ride with the bump.

Two more things 2.5.13 changes that CI does not gate on, worth the same commit

e2e/wasm/supabase-declared.test.ts:84: the biome-ignore lint/suspicious/noExplicitAny comment no longer reaches const qb: any on line 86, because a deno-lint-ignore line sits between them. 2.5.13 reports the suppression as unused and the any as unsuppressed (both warnings today). Move the biome-ignore directly above line 86.
lint/suspicious/useIterableCallbackReturn now fires, at error level under our config, on a forEach callback whose arrow body returns a call's value (for example xs.forEach((x) => walk(x))). Nothing on main trips it. New code will, so expect it on rebases.

What I checked on the bumps

@supabase/postgrest-js / @supabase/supabase-js 2.112.3 → 2.116.0 (devDependencies, pinned exactly): the only postgrest-js change in the range is a new getOpenApiSpec(); the rest is auth, storage and realtime. The live Supabase v3 integration job passed on this PR, which is the check that matters for the PostgREST wire behaviour the adapter depends on.
@clerk/backend 3.16.7 → 3.17.2 is not verified by this PR's CI. It is only exercised by the Drizzle identity (lock-context) suites, and those fail on every Dependabot PR with missing CLERK_MACHINE_TOKEN: the two Clerk tokens are Actions secrets but not Dependabot secrets (details in my review on #986). Add them to Dependabot secrets and rebase, and those cells will both go green and actually test this bump.
fast-check 4.9 → 4.10, turbo 2.10.10 → 2.10.12, yaml 2.9.0 → 2.9.1: unit, property and e2e jobs green.
Lockfile-only otherwise. No onlyBuiltDependencies change; frozen-lockfile install, OSV scan and the supply-chain e2e passed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026

dependabot Bot requested a review from a team as a code owner September 20, 2026 23:54

dependabot Bot added the dependencies Pull requests that update a dependency file label Sep 20, 2026

freshtonic requested changes Sep 21, 2026

View reviewed changes

Navigation Menu

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates - #988

chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 updates#988
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-57690da707

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 20, 2026

Uh oh!

changeset-bot Bot commented Sep 20, 2026

Uh oh!

freshtonic left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 20, 2026

Biome CLI v2.5.13

2.5.13

Patch Changes

2.5.13

Patch Changes

Turborepo v2.10.12

What's Changed

Changelog

@​clerk/backend@​3.17.2

Patch Changes

3.17.2

Patch Changes

3.17.1

Patch Changes

3.17.0

Minor Changes

Patch Changes

3.16.13

Patch Changes

3.16.12

Patch Changes

3.16.11

Patch Changes

3.16.10

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

🩹 Fixes

❤️ Thank You

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

❤️ Thank You

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

🩹 Fixes

❤️ Thank You

2.116.0 (2026-09-07)

2.115.0 (2026-09-03)

🚀 Features

❤️ Thank You

2.114.0 (2026-09-02)

2.113.0 (2026-09-02)

2.112.4 (2026-08-24)

🩹 Fixes

❤️ Thank You

v2.116.0

2.116.0 (2026-09-07)

🚀 Features

🩹 Fixes

❤️ Thank You

v2.116.0-canary.3

2.116.0-canary.3 (2026-09-07)

🚀 Features

❤️ Thank You

v2.116.0-canary.2

2.116.0-canary.2 (2026-09-07)

🚀 Features

🩹 Fixes

❤️ Thank You

2.116.0 (2026-09-07)

🚀 Features

🩹 Fixes

❤️ Thank You

2.115.0 (2026-09-03)

🚀 Features

❤️ Thank You

2.114.0 (2026-09-02)

2.113.0 (2026-09-02)

2.112.4 (2026-08-24)

New plugin API and deprecations ahead of v5

Features

Fixes

4.10.0

Features

Fixes

v2.9.1

`@clerk/backend@3`.17.2