Skip to content

chore(deps-dev): bump the dev-dependencies group with 8 updates - #1375

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-e9476be3d8
Open

chore(deps-dev): bump the dev-dependencies group with 8 updates#1375
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-e9476be3d8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 8 updates:

Package From To
@biomejs/biome 2.5.9 2.5.15
turbo 2.10.10 2.11.9
@clerk/backend 3.16.7 3.25.0
@supabase/postgrest-js 2.112.3 2.118.0
@supabase/supabase-js 2.112.3 2.118.0
fast-check 4.9.0 4.10.2
fta-cli 3.0.1 3.1.0
yaml 2.9.0 2.9.1

Updates @biomejs/biome from 2.5.9 to 2.5.15

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.15

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.15

Patch Changes

  • #10634 b436ba0 Thanks @​subaru-hello! - Added the new nursery rule noReactObjectTypeAsDefaultProp, which disallows array, object, and function values as default props in React components.

    For example, the following snippet triggers the rule.

    function Component({ items = [] }) {
  return items;
}

  • #11956 faa8b37 Thanks @​dyc3! - Added the nursery rule noSvelteExportLet, which disallows declaring Svelte component props with the legacy export let syntax. Use the $props() rune instead.

    <script>
  export let name;
</script>

  • #10816 1b9479e Thanks @​Th3S4mur41! - Added a new nursery rule useLogicalProperties that enforces the use of logical properties in CSS, promoting better internationalization and accessibility practices. The rule supports a direction option with "ltr" as the default and "rtl" as the alternative. This is a first rule covering parts of #9034

    {
  "linter": {
    "rules": {
      "nursery": {
        "useLogicalProperties": {
          "level": "warn",
          "options": {
            "direction": "rtl"
          }
        }
      }
    }
  }
}

  • #11960 1fdb5c2 Thanks @​dyc3! - Added the nursery rule useSvelteKitRuneImports, which reports imports from the deprecated $app/stores module and suggests $app/state instead.

    import { page } from "$app/stores";

  • #11723 3b429d1 Thanks @​m1handr! - Fixed #11656: noAstroSetHtmlDirective now correctly reports set:html directives inside Astro template expressions.

... (truncated)

Commits

Updates turbo from 2.10.10 to 2.11.9

Release notes

Sourced from turbo's releases.

Turborepo v2.11.9

What's Changed

Changelog

... (truncated)

Commits
  • 64d5e48 publish 2.11.9 to registry
  • 78b039e fix(cache): Parallelize dry-run HEAD fallback (#14801)
  • 6834819 docs: Use .NET in the multi-language guide (#14793)
  • 679efb8 refactor: Remove setup lifecycle script controls (#14818)
  • 9c90852 fix: Allow native package manager configuration during setup (#14816)
  • a3bcc4a chore: Release Turborepo 2.11.9-canary.1 (#14817)
  • 9328416 fix: Stop installing the Unix shell hook automatically (#14813)
  • 74c9fbc fix: Attribute Cargo.lock changes to the crates whose dependencies changed (#...
  • a3ef52a chore: Update with-changesets example (#14638)
  • f05411f perf: Skip newline normalization copies for already-normalized TUI output (#1...
  • Additional commits viewable in compare view

Updates @clerk/backend from 3.16.7 to 3.25.0

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.25.0

Minor Changes

  • Added an optional issuer option to verifyJwt(), verifyToken(), and authenticateRequest() to validate the JWT iss claim against a string or list of allowed strings. For verifyToken() and authenticateRequest(), this applies only to session tokens. Omitting issuer preserves existing behavior. (#8772) by @​jacekradko
Changelog

Sourced from @​clerk/backend's changelog.

3.25.0

Minor Changes

  • Added an optional issuer option to verifyJwt(), verifyToken(), and authenticateRequest() to validate the JWT iss claim against a string or list of allowed strings. For verifyToken() and authenticateRequest(), this applies only to session tokens. Omitting issuer preserves existing behavior. (#8772) by @​jacekradko

3.24.0

Minor Changes

  • Add deprovisioned to the Backend User object and UserJSON, so you can tell when Directory Sync has deactivated a user, including in user.updated webhook payloads, without casting. It's separate from banned: Directory Sync sets and clears deprovisioned, while you set banned through the Dashboard or Backend API. (#10245) by @​manovotny

3.23.2

Patch Changes

3.23.1

Patch Changes

  • Updated dependencies [568c668]:
    • @​clerk/shared@​4.39.1

3.23.0

Minor Changes

  • Add clerkClient.invitations.deleteInvitation(invitationId), which permanently deletes an instance invitation and the stored copies of its invitation email. Unlike revokeInvitation, this removes the invitation record itself, so it can be used to honor a data erasure request from someone who was invited but never signed up. (#10034) by @​dominic-clerk

  • Verified OAuth access tokens now expose act, the RFC 8693 actor chain, when the token was issued by an OAuth 2.0 Token Exchange. It is available on the IdPOAuthAccessToken returned for both opaque and JWT access tokens. (#9929) by @​wyattjoh

Patch Changes

  • Updated dependencies [2654caa]:
    • @​clerk/shared@​4.39.0

3.22.0

Minor Changes

  • SAML connections can trust several Identity Provider signing certificates at once. SamlConnection and EnterpriseConnection.samlConnection now include idpCertificates, every trusted certificate with its validity window, and createSamlConnection(), updateSamlConnection(), createEnterpriseConnection() and updateEnterpriseConnection() accept an idpCertificates array that replaces the connection's whole set. The single idpCertificate parameter is deprecated in favor of the array; it keeps working and still replaces the whole set. (#9995) by @​mauricioabreu

Patch Changes

  • Updated dependencies [f6937c8]:
    • @​clerk/shared@​4.38.0

... (truncated)

Commits

Updates @supabase/postgrest-js from 2.112.3 to 2.118.0

Release notes

Sourced from @​supabase/postgrest-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/postgrest-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

  • postgrest: treat TimeoutError as an abort in retry guard (#2732)

❤️ Thank You

2.117.2 (2026-09-25)

🩹 Fixes

  • postgrest: avoid instantiation depth errors for large relationship unions (#2701)

❤️ Thank You

2.117.1 (2026-09-23)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.117.0 (2026-09-22)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.116.0 (2026-09-07)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.115.0 (2026-09-03)

🚀 Features

  • postgrest: add getOpenApiSpec() (#2651)

❤️ Thank You

... (truncated)

Commits
  • fd07c4d test(postgrest): add type inference cases for the generated types (#2750)
  • 146fd47 chore(supabase): bump supabase cli to 2.120.0 (#2729)
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • cb76828 fix(postgrest): treat TimeoutError as an abort in retry guard (#2732)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 6d21e3f fix(postgrest): avoid instantiation depth errors for large relationship union...
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • 84af33f chore(release): version 2.116.0 changelogs (#2679)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.112.3 to 2.118.0

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.118.0

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)
  • storage: add content-encoding support for uploads (#1949)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Atharv Gaur @​Athaxv
  • Ferhat Elmas
  • Lukas Klingsbo

v2.118.0-canary.2

2.118.0-canary.2 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.1

2.118.0-canary.1 (2026-10-12)

This was a version bump only, there were no code changes.

v2.118.0-canary.0

2.118.0-canary.0 (2026-10-09)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

🩹 Fixes

  • ci: patch next and sharp advisories and pin node-browser playwright (#2753)

❤️ Thank You

  • Lukas Klingsbo

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.118.0 (2026-10-15)

🚀 Features

  • postgrest: leave computed fields out of select('*') and resolve no-argument rpc overloads for postgrest-typegen output (#2730)

❤️ Thank You

  • Lukas Klingsbo

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

2.117.2 (2026-09-25)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.117.1 (2026-09-23)

🩹 Fixes

  • auth: return stored session when a refresh loses to another tab (#2698)

❤️ Thank You

2.117.0 (2026-09-22)

🚀 Features

  • auth: enable passkey API by default and deprecate experimental passkey opt-in (#2695)

❤️ Thank You

  • fadymak

2.116.0 (2026-09-07)

🚀 Features

  • auth: add MFA recovery codes API (#2676)

... (truncated)

Commits
  • b9753a1 feat(postgrest): leave computed fields out of select('*') and resolve no-argu...
  • 88faa11 fix(ci): patch next and sharp advisories and pin node-browser playwright (#2753)
  • aac9d32 chore(release): version 2.117.3 changelogs (#2744)
  • 4d23055 fix(storage): send multipart fields before files (#2736)
  • a684cf9 chore(release): version 2.117.2 changelogs (#2707)
  • 54c225d chore(release): version 2.117.1 changelogs (#2700)
  • 739b351 fix(auth): return stored session when a refresh loses to another tab (#2698)
  • f34d428 chore(release): version 2.117.0 changelogs (#2697)
  • cc45ccf feat(auth): enable passkey API by default and deprecate experimental passkey ...
  • c511286 docs(realtime): document relationship of accessToken() and heartbeat (#2680)
  • Additional commits viewable in compare view

Updates fast-check from 4.9.0 to 4.10.2

Release notes

Sourced from fast-check's releases.

v4.10.2

Fix interrupt plugin (throwing) [Code][Diff]

Fixes

  • (PR#7333) Bug: Plugin interruptAfterTimeLimit crashes

Fix fake-timer compatibility in timeout and interrupt plugins

[Code][Diff]

Fixes

  • (PR#7293) Bug: Capture timers for interruptAfterTimeLimit plugin
  • (PR#7282) CI: Temporarily disable documentation updates until v5
  • (PR#7279) Doc: Release note for 4.10.0

New plugin API and deprecations ahead of v5

[Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

  • (PR#7225) Bug: Proper ordering between plugins
  • (PR#7127) CI: Announce on Bluesky when drafting the release
  • (PR#7217) CI: Dedupe packages for pnpm
  • (PR#7137) Doc: Release note for 4.9.0

... (truncated)

Changelog

Sourced from fast-check's changelog.

4.10.2

Fix interrupt plugin (throwing) [Code][Diff]

Fixes

  • (PR#7333) Bug: Plugin interruptAfterTimeLimit crashes

4.10.1

Fix fake-timer compatibility in timeout and interrupt plugins [Code][Diff]

Fixes

  • (PR#7292) Bug: Capture timer globals for timeout plugin
  • (PR#7293) Bug: Capture timers for interruptAfterTimeLimit plugin
  • (PR#7282) CI: Temporarily disable documentation updates until v5
  • (PR#7279) Doc: Release note for 4.10.0

4.10.0

New plugin API and deprecations ahead of v5 [Code][Diff]

Features

  • (PR#7216) Introduce a plugin API
  • (PR#7221) Refine plugin API
  • (PR#7222) Add ability to configure plugins globally
  • (PR#7224) Add the beforeEach plugin to hook in life-cycle
  • (PR#7227) Create an afterEach plugin
  • (PR#7232) Deprecate life-cycle methods
  • (PR#7235) Support teardown of beforeEach plugin
  • (PR#7228) Add timeout plugin to stop long running predicates
  • (PR#7237) Deprecate timeout from parameters
  • (PR#7238) Pass a store to plugins
  • (PR#7239) Add extra plugin's method called onAllRunsComplete
  • (PR#7240) Deprecate reporter and asyncReporter from parameters
  • (PR#7229) Add plugin to interrupt after time limit
  • (PR#7245) Support failOnInterrupt on the plugin
  • (PR#7230) Add plugins to drop runs on already covered cases
  • (PR#7259) Add ability to decorate generate via Plugins
  • (PR#7231) Add the unbiased plugin to generate without bias
  • (PR#7260) Deprecate parameters superseded by plugins
  • (PR#7261) Deprecate v5 removals

Fixes

... (truncated)

Commits

Updates fta-cli from 3.0.1 to 3.1.0

Release notes

Sourced from fta-cli's releases.

v3.1.0

  • Fix: launcher should preserve paths and arguments containing spaces (#339)
  • Upgraded various internal Rust dependencies
Changelog

Sourced from fta-cli's changelog.

v3.1.0

  • Fix: launcher should preserve paths and arguments containing spaces (#339)
  • Upgraded various internal Rust dependencies
Commits
  • 812bd55 Bump versions and update changelog for v3.1.0 (#340)
  • 79ee6a9 fix: preserve launcher paths and arguments containing spaces (#339)
  • 86a8c4b Bump wasm-bindgen from 0.2.128 to 0.2.129 (#337)
  • ef32931 Bump clap from 4.6.6 to 4.6.7 (#336)
  • 074d51f Bump wasm-bindgen from 0.2.127 to 0.2.128 (#335)
  • 83fab52 Bump log from 0.4.33 to 0.4.34 (#334)
  • 6a8df60 Add release notes for v3.0.1
  • 5f5428d Add manual workflow to publish the npm package via OIDC (#333)
  • 07ab67f Update NPM publishing to use Trusted Publisher via OIDC (#331)
  • See full diff in compare view

Updates yaml from 2.9.0 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

  • Limit recursive merge aliases (#685, #713)
  • Simplify line unfolding during quoted string parsing (#714)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version ...

Description has been truncated

@dependabot
chore(deps-dev): bump the dev-dependencies group with 8 updates
a3a4017 
Bumps the dev-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.9` | `2.5.15` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.11.9` |
| [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend) | `3.16.7` | `3.25.0` |
| [@supabase/postgrest-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/postgrest-js) | `2.112.3` | `2.118.0` |
| [@supabase/supabase-js](https://github.com/supabase/supabase-js/tree/HEAD/packages/core/supabase-js) | `2.112.3` | `2.118.0` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` |
| [fta-cli](https://github.com/sgb-io/fta) | `3.0.1` | `3.1.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |


Updates `@biomejs/biome` from 2.5.9 to 2.5.15
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/@biomejs/biome@2.5.15/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.15/packages/@biomejs/biome)

Updates `turbo` from 2.10.10 to 2.11.9
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.10...v2.11.9)

Updates `@clerk/backend` from 3.16.7 to 3.25.0
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.25.0/packages/backend)

Updates `@supabase/postgrest-js` from 2.112.3 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/postgrest-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/postgrest-js)

Updates `@supabase/supabase-js` from 2.112.3 to 2.118.0
- [Release notes](https://github.com/supabase/supabase-js/releases)
- [Changelog](https://github.com/supabase/supabase-js/blob/master/packages/core/supabase-js/CHANGELOG.md)
- [Commits](https://github.com/supabase/supabase-js/commits/v2.118.0/packages/core/supabase-js)

Updates `fast-check` from 4.9.0 to 4.10.2
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check)

Updates `fta-cli` from 3.0.1 to 3.1.0
- [Release notes](https://github.com/sgb-io/fta/releases)
- [Changelog](https://github.com/sgb-io/fta/blob/main/CHANGELOG.md)
- [Commits](sgb-io/fta@v3.0.1...v3.1.0)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.11.9
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@clerk/backend"
  dependency-version: 3.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/postgrest-js"
  dependency-version: 2.118.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: "@supabase/supabase-js"
  dependency-version: 2.118.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: fast-check
  dependency-version: 4.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: fta-cli
  dependency-version: 3.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from a team as a code owner October 25, 2026 21:07
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 25, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@changeset-bot

changeset-bot Bot commented Oct 25, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: a3a4017

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI; Enforced overrides: Organization
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: d3754bfe-59fd-4bdd-a723-d4dd6d0ec26f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

freshtonic
freshtonic approved these changes Oct 25, 2026
View reviewed changes

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. All eight bumps are development dependencies, and every new version comes from the npm registry.

  • @biomejs/biome goes to ^2.5.15, turbo to 2.11.9, fta-cli to 3.1.0, fast-check to ^4.10.2 and yaml to ^2.9.1.
  • @supabase/supabase-js and @supabase/postgrest-js go to 2.118.0, and @clerk/backend goes to 3.25.0. All of them are test or development dependencies of stack, stack-supabase and test-kit. The peer ranges that we publish do not change.
  • The lockfile adds no new package names and removes none. It has no git or tarball sources. None of the new versions has a preinstall, install or postinstall script.
  • All 30 checks pass, including Biome (code:check) on the new Biome version.

PR #1376 also changes pnpm-lock.yaml. Whichever of the two PRs merges second needs @dependabot rebase.

@freshtonic freshtonic mentioned this pull request Oct 25, 2026
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freshtonic freshtonic freshtonic approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@freshtonic