[dependabot]

Bumps the dev-dependencies group with 2 updates in the / directory: @biomejs/biome and @clerk/backend.

Updates @biomejs/biome from 2.5.15 to 2.6.3

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.3

2.6.3

Patch Changes

• #12275 807e616 Thanks @​dyc3! - Added the new nursery rule noArraySortForMinMax, which reports sorting an array only to read its smallest or largest value. Use Math.min() or Math.max() instead.

  const minimum = array.toSorted((a, b) => a - b)[0];

• #12432 cf61682 Thanks @​dyc3! - Added the nursery rule noBooleanSortComparator, which reports sort comparators that return a boolean instead of a number. For example, array.sort((a, b) => a > b) never puts the first item before the second, so the array isn't sorted correctly.

• #12304 b4654c5 Thanks @​dyc3! - Added the new nursery rule noEagerArrayMethodsInLoops, which reports .map() and .filter() calls in the header of for...of loops. These calls build a new array that is only used by the loop.

  for (const name of users.map((user) => user.name)) {
    console.log(name);
  }

• #12121 66c3791 Thanks @​dyc3! - Added the nursery rule noNewRequire, which disallows calling require with new, such as new require("app-header").

• #12316 34b520d Thanks @​dyc3! - Added the new nursery rule noObsoleteAttributes, which disallows obsolete attributes on HTML elements and suggests what to use instead.

  <table bgcolor="#ffffff" cellpadding="5"></table>

• #12258 cce2385 Thanks @​dyc3! - Added the nursery rule noPathConcat, which disallows building file paths and URLs by joining strings to __dirname, __filename, import.meta.dirname, import.meta.filename, or import.meta.url.

  const fullPath = __dirname + "/foo.js"; // reported

• #12287 e12ad78 Thanks @​dyc3! - Added the new nursery rule noPlaywrightNthMethods, which disallows selecting Playwright elements by position with first(), last(), and nth(). A test that relies on the position of an element can act on a different element when the page changes.

  await page.locator("button").first().click();

• #12343 62ad123 Thanks @​vibbix! - Added the nursery rule noSelfNestedLayer, which disallows nesting a cascade layer inside a layer with the same name. Layer names inside an @layer block are relative to it, so the inner layer below creates the sublayer components.components instead of adding to components.

  @layer components {
    @layer components {
      .button {
        color: red;
      }

... (truncated)

Commits

• c5c3383 ci: release (#12500)
• 7bd38b7 feat(lint): add noVueWatchAfterAwait (#12385)
• 807e616 feat(lint): add noArraySortForMinMax (#12275)
• 407604d feat(lint): add useVueComponentIs (#12400)
• f748ec0 feat(lint): add noSvelteInternal (#12431)
• ab2eb9e feat(lint): add useBlockStatementOverIife (#12300)
• bf1a55a feat(lint): add useVueVOnExact (#12423)
• c371520 feat(lint): add useVueToggleInsideTransition (#12337)
• 8a5974a chore: add syntaxfm to sponsors (#12577)
• 0be8d10 feat(lint): add noUnsafeReturn (#12422)
• Additional commits viewable in compare view

Updates @clerk/backend from 3.26.0 to 3.26.2

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

Changelog

Sourced from @​clerk/backend's changelog.

3.26.2

Patch Changes

• Updated dependencies [8c3739d, 0334b05]:
  • @​clerk/shared@​4.41.1

3.26.1

Patch Changes

• Stop accepting the legacy cl_I7d4PD111III JWT category as a session or handshake token. Clerk no longer issues it, so authenticateRequest() now returns a signed-out state with reason token-type-mismatch for a token carrying it, the same as for other non-session categories. (#10286) by @​dominic-clerk

Commits

• 8b9403b ci(repo): Version packages (#10347)
• 0334b05 fix(clerk-js): preserve indefinite session deadlines (#9871)
• 80b0813 ci(repo): Version packages (#10315)
• 49c8afd fix(backend): stop accepting the legacy ignore JWT category as a session toke...
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d55ba79

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 069638e4-56bd-4fd8-b8c9-901ed9629181

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

[freshtonic]

Biome 2.6 is a breaking update for this repo, and three required checks fail:

• Run Tests (Node 22 / 24): biome check . refuses biome.json because its $schema names 2.5.3 and the CLI expects 2.6.3 ("Run the command biome migrate").
• Lint (Biome): 2.6 formats Markdown, so code:check now reports formatter diffs in .changeset/*.md and other Markdown files.

To fix it, run pnpm exec biome migrate --write, then either exclude Markdown from the formatter in biome.json or commit the reformat. The reformat is a separate decision, because biome.json excludes the files the @cipherstash/auth wrapper publishes, and the Markdown files include the skills/ that ship in the stash tarball. The @clerk/shared 4.41.1 part of this PR is fine on its own.

[freshtonic]

The config is migrated to 2.6.3. The Markdown formatter is off and YAML is excluded, so the upgrade changes no surface that Biome checked before. All required checks pass. When you squash-merge, remove the Co-Authored-By and Claude-Session trailers from the message of d55ba79.