chore(deps-dev): bump the dev-dependencies group across 1 directory with 9 updates

[dependabot]

Bumps the dev-dependencies group with 9 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.3	2.5.7
@changesets/cli	2.31.0	2.31.1
turbo	2.10.4	2.10.8
@types/pg	8.20.0	8.20.4
@neon-rs/cli	0.1.82	0.2.6
@clerk/backend	3.11.3	3.16.0
@supabase/postgrest-js	2.110.2	2.112.2
@supabase/supabase-js	2.110.2	2.112.2
@types/semver	7.7.1	7.8.0

Updates @biomejs/biome from 2.5.3 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

  type Mapper<T> = () => T;
  declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

• 191d051 ci: release (#11119)
• 9847e68 feat(lint): add noNonScalableViewport rule (#11168)
• e63354c feat(lint): add noExtendNative nursery rule (#11136)
• 2fa0a62 docs: rework CLI (#11134)
• e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
• c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• 412a0e9 ci: release (#10948)
• b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
• Additional commits viewable in compare view

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Changelog

Sourced from @​changesets/cli's changelog.

2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• See full diff in compare view

Updates turbo from 2.10.4 to 2.10.8

Release notes

Sourced from turbo's releases.

Turborepo v2.10.8

What's Changed

Changelog

• fix: Scroll TUI task list with mouse wheel by @​anthonyshew in vercel/turborepo#13479
• fix: Make releases resumable by @​anthonyshew in vercel/turborepo#13486
• refactor: Expose knowledge-backed package scope views by @​anthonyshew in vercel/turborepo#13456
• chore: Release Turborepo 2.10.7 by @​anthonyshew in vercel/turborepo#13489
• refactor: Use package knowledge for configuration scopes by @​anthonyshew in vercel/turborepo#13457
• refactor: Use package knowledge for run scope enumeration by @​anthonyshew in vercel/turborepo#13458
• release(turborepo): 2.10.8-canary.1 by @​github-actions[bot] in vercel/turborepo#13490
• refactor: Use package knowledge in repository views by @​anthonyshew in vercel/turborepo#13459
• refactor: Use package knowledge in package integrations by @​anthonyshew in vercel/turborepo#13460
• ci: Parallelize environment setup steps by @​anthonyshew in vercel/turborepo#13491
• release(turborepo): 2.10.8-canary.2 by @​github-actions[bot] in vercel/turborepo#13492
• refactor: Use package knowledge for task hashing paths by @​anthonyshew in vercel/turborepo#13461
• refactor: Use package knowledge for run-cache paths by @​anthonyshew in vercel/turborepo#13462
• refactor: Bind toolchain callbacks to package knowledge by @​anthonyshew in vercel/turborepo#13463
• refactor: Use package knowledge for microfrontend commands by @​anthonyshew in vercel/turborepo#13464
• refactor: Use package knowledge for run summaries by @​anthonyshew in vercel/turborepo#13465
• refactor: Use package knowledge for watcher paths by @​anthonyshew in vercel/turborepo#13466
• ci: Enable remote cache for types codegen by @​anthonyshew in vercel/turborepo#13495
• docs: Fix llms.txt links to page markdown routes by @​molebox in vercel/turborepo#13497
• refactor: Use package knowledge for prune paths by @​anthonyshew in vercel/turborepo#13467
• refactor: Use package knowledge in the LSP by @​anthonyshew in vercel/turborepo#13468
• refactor: Use consistent repository construction by @​anthonyshew in vercel/turborepo#13469
• refactor: Delete legacy package and scope authority by @​anthonyshew in vercel/turborepo#13470
• perf: Cache telemetry salt instead of re-reading config on every hash by @​charpeni in vercel/turborepo#13498
• feat: Support Android (Termux) by @​gtbuchanan in vercel/turborepo#12735
• ci: Restore Cargo targets on all test platforms by @​anthonyshew in vercel/turborepo#13505
• fix: Resolve gitdir for linked worktrees in repo index by @​charpeni in vercel/turborepo#13503
• test: Characterize relationship projections by @​anthonyshew in vercel/turborepo#13499
• refactor: Produce native relationship observations by @​anthonyshew in vercel/turborepo#13500
• feat: Resolve GitHub Actions remote base refs behind future flag by @​louis-bompart in vercel/turborepo#10732
• refactor: Add core relationship projections by @​anthonyshew in vercel/turborepo#13502
• refactor: Define external resolution contracts by @​anthonyshew in vercel/turborepo#13507
• refactor: Move repository tasks into Turbo configuration by @​anthonyshew in vercel/turborepo#13504
• refactor: Build JavaScript external resolution generations by @​anthonyshew in vercel/turborepo#13508
• refactor: Contribute Cargo external resolutions by @​anthonyshew in vercel/turborepo#13509
• refactor: Migrate external declaration consumers by @​anthonyshew in vercel/turborepo#13511
• ci: Auto-merge release PRs by @​anthonyshew in vercel/turborepo#13510
• chore: Release Turborepo 2.10.8-canary.3 by @​anthonyshew in vercel/turborepo#13512
• fix: Use tokenless release review gate by @​anthonyshew in vercel/turborepo#13513
• refactor: Use resolution fingerprints for task hashes by @​anthonyshew in vercel/turborepo#13514
• fix: Support fork PRs in review gate by @​anthonyshew in vercel/turborepo#13516
• refactor: Migrate lockfile affectedness by @​anthonyshew in vercel/turborepo#13519
• refactor: Migrate external resolution summaries by @​anthonyshew in vercel/turborepo#13520
• refactor: Migrate external package queries to resolution knowledge by @​anthonyshew in vercel/turborepo#13523
• fix: Serialize macOS Homebrew setup by @​anthonyshew in vercel/turborepo#13549

... (truncated)

Commits

• 2515f8b publish 2.10.8 to registry
• dd87718 test: Add uv workspace integration coverage (#13602)
• b3dc99b fix: Fall back to polling on macOS (#13622)
• f8f288e feat: Prune uv workspaces (#13613)
• b2e25d4 feat: Watch uv workspace changes (#13612)
• 00538d0 fix: Make Windows Cap'n Proto cache relocatable (#13621)
• e14de24 feat: Hash uv lockfile closures (#13611)
• 4195e41 feat: Run native uv tasks (#13610)
• 8715646 feat: Discover uv workspaces (#13609)
• 5cf35ad ci: Invalidate Cap'n Proto caches (#13616)
• Additional commits viewable in compare view

Updates @types/pg from 8.20.0 to 8.20.4

Commits

• See full diff in compare view

Updates @neon-rs/cli from 0.1.82 to 0.2.6

Commits

• 8043a58 v0.2.6
• 0213f55 Fix prepack script to not overwrite package.json
• 5d8a3fb Clean up @​neon-rs/cli dependencies and build scripts
• 78e1825 v0.2.5
• 06871b2 Add cargo-messages to verdaccio proxy isolated packages
• 5e63fde Add missing repository field to @​neon-rs/manifest package.json
• d571d23 v0.2.4
• 936c08c Fix repository URLs to match GitHub org for npm provenance
• 817a885 v0.2.3
• 7803686 Switch to npm OIDC trusted publishing and revert versions to 0.2.2
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​neon-rs/cli since your current version.

Updates @clerk/backend from 3.11.3 to 3.16.0

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

Changelog

Sourced from @​clerk/backend's changelog.

3.16.0

Minor Changes

• Add clerkClient.users.removePassword(userId, params?) to remove a user's password through the Backend API. Password removal is allowed even when the user has no alternate sign-in method configured. Existing sessions remain active by default; pass { signOutOfOtherSessions: true } to revoke them. (#9326) by @​joshrowley

Patch Changes

• Improve generated API reference links, expose BillingSubscriptionItemStatus, and clarify the createUser() identification status documentation. (#9340) by @​SarahSoutoul

• Updated dependencies [1ef84c3, d639048, a66cbbf]:

  • @​clerk/shared@​4.27.0

3.15.1

Patch Changes

• Add the optional emailAddressIdentificationStatus and phoneNumberIdentificationStatus parameters to CreateUserParams. The Backend API has supported these arrays on POST /v1/users since they shipped, but createUser() had no way to pass them, so every email address and phone number was necessarily created verified. Each array runs parallel to emailAddress / phoneNumber — one item per identifier, applied by position — and an item set to 'reserved' creates that identifier unverified but still usable for sign-in and locked so no other user can claim it. (#9305) by @​dmoerner

  The createUser() documentation is corrected accordingly: it stated unconditionally that created email addresses and phone numbers are automatically verified, which is only the default.

• Updated dependencies [5c81479]:

  • @​clerk/shared@​4.26.0

3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

3.14.0

Minor Changes

• Align the EnterpriseConnection response resource with what the Backend API actually returns: (#9156) by @​manovotny
  • EnterpriseConnection now exposes provider, logoPublicUrl, allowOrganizationAccountLinking, authenticatable, disableJitProvisioning, and customAttributes.
  • EnterpriseConnectionSamlConnection now exposes active, forceAuthn, and loginHint.
  • EnterpriseConnectionOauthConfig now exposes providerKey, authUrl, tokenUrl, userInfoUrl, and requiresPkce.
  • Deprecated properties the Backend API never returns, which were always undefined despite their declared types: allowSubdomains on EnterpriseConnection (use samlConnection.allowSubdomains), and idpMetadata and syncUserAttributes on EnterpriseConnectionSamlConnection (use the top-level syncUserAttributes).
  • organizationId is now normalized to null when the Backend API omits it, matching its declared string | null type. Properties backed by optional API fields (for example oauthConfig.clientId and the SAML IdP fields) are now typed as possibly undefined to match runtime behavior.

Patch Changes

... (truncated)

Commits

• See full diff in compare view

Updates @supabase/postgrest-js from 2.110.2 to 2.112.2

Release notes

Sourced from @​supabase/postgrest-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)
• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Filipe Cabaço @​filipecabaco
• Vaibhav @​7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Vaibhav @​7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

• auth: preserve 5xx error message (#2587)
• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel
• Vaibhav @​7ttp

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/postgrest-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.0 (2026-08-03)

🩹 Fixes

• postgrest: honour throwOnError when maybeSingle finds multiple rows (#2580)

❤️ Thank You

• Juhef @​juheff
• Zuhef Ahmed @​Zuhef

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.7 (2026-07-16)

🩹 Fixes

• postgrest: correct self-reference inference (#2525)

❤️ Thank You

• Vaibhav @​7ttp

2.110.6 (2026-07-15)

🩹 Fixes

• postgrest: type hinted self-referencing embeds as arrays (#2520)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

... (truncated)

Commits

• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 4c13bf0 fix(postgrest): honour throwOnError when maybeSingle finds multiple rows (#2580)
• 6331898 docs(postgrest): document that statusText may be empty over HTTP/2 (#2574)
• a262492 chore(release): version 2.111.0 changelogs (#2572)
• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• 22050de chore(release): version 2.110.8 changelogs (#2546)
• 150b00c chore(release): version 2.110.7 changelogs (#2533)
• 5c18b62 fix(postgrest): correct self-reference inference (#2525)
• c90b1cd chore(release): version 2.110.6 changelogs (#2527)
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.110.2 to 2.112.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)
• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Filipe Cabaço @​filipecabaco
• Vaibhav @​7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Vaibhav @​7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

• auth: preserve 5xx error message (#2587)
• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel
• Vaibhav @​7ttp

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

• supabase: forward db retry option (#2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

🩹 Fixes

• supabase: skip Node warning in Deno (#2541)

❤️ Thank You

• Vaibhav @​7ttp

2.110.7 (2026-07-16)

🩹 Fixes

... (truncated)

Commits

• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
• a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
• e6c975c fix(supabase): forward db retry option (#2571)
• a262492 chore(release): version 2.111.0 changelogs (#2572)
• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• fc2e61e chore(repo): bump postcss override and fix playwright 1.62 tsconfig failure (...
• 22050de chore(release): version 2.110.8 changelogs (#2546)
• Additional commits viewable in compare view

Updates @types/semver from 7.7.1 to 7.8.0

Commits

• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: d52e9d8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.