chore(deps-dev): bump the dev-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the dev-dependencies group with 8 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.3	2.5.7
@changesets/cli	2.31.0	2.31.1
turbo	2.10.4	2.10.9
@neon-rs/cli	0.1.82	0.2.6
@clerk/backend	3.11.3	3.16.1
@supabase/postgrest-js	2.110.2	2.112.2
@supabase/supabase-js	2.110.2	2.112.2
@types/semver	7.7.1	7.8.0

Updates @biomejs/biome from 2.5.3 to 2.5.7

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.7

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.7

Patch Changes

• #10822 c171b3b Thanks @​pkallos! - Added the option ignoreIfStatements to useNullishCoalescing. Biome now flags if statements that only assign to a nullish variable (such as if (!a) { a = b }) and can rewrite them to ??=. When enabled, Biome ignores those if statements.

• #11136 e63354c Thanks @​AkashNaickar! - Added a new nursery rule noExtendNative, which reports extending the prototype of a built-in object.

• #10094 e007143 Thanks @​THEjacob1000! - Added the nursery rule noTailwindArbitraryValue. Biome now reports Tailwind CSS arbitrary values such as w-[400px], including in HTML/JSX class attributes, configured utility functions, and tagged templates.

• #11184 135f476 Thanks @​subotac! - Fixed #11176: noUnknownPseudoClass now recognizes Vue's :deep() pseudo-class inside .vue style blocks.

• #8239 a519f9d Thanks @​cormacrelf! - Fixed #8233, where Biome CLI in stdin mode didn't work correctly when handling files in projects with nested configurations. For example, with the following structure, --stdin-file-path=subdirectory/... would not use the nested configuration in subdirectory/biome.json:

  ├── biome.json
  └── subdirectory
      ├── biome.json
      └── lib.js
  

  biome format --write --stdin-file-path=subdirectory/lib.js < subdirectory/lib.js

  Now, the nested configuration is correctly picked up and applied.

  In addition, Biome now shows a warning if --stdin-file-path is provided but that path is ignored and therefore not formatted or fixed.

• #11138 8c2c6bd Thanks @​ematipico! - Fixed noUnnecessaryConditions: Biome now chooses the same function overload as TypeScript when an argument is a callback, so conditions that were previously missed are reported.

  The following code is now invalid, because a parameter typed () => void accepts an async callback and schedule therefore returns string:

  declare function schedule(handler: () => void): string;
  declare function schedule(handler: () => Promise<void>): string | undefined;
  schedule(async () => {}) ?? "fallback";

  The following code is also now invalid, because map(() => 42) returns 42:

  type Mapper<T> = () => T;
  declare function map<T>(mapper: Mapper<T>): T;

... (truncated)

Commits

• 191d051 ci: release (#11119)
• 9847e68 feat(lint): add noNonScalableViewport rule (#11168)
• e63354c feat(lint): add noExtendNative nursery rule (#11136)
• 2fa0a62 docs: rework CLI (#11134)
• e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
• c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• 412a0e9 ci: release (#10948)
• b3b12b3 feat(lint): add noNegationInEqualityCheck rule (#10915)
• Additional commits viewable in compare view

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Changelog

Sourced from @​changesets/cli's changelog.

2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• See full diff in compare view

Updates turbo from 2.10.4 to 2.10.9

Release notes

Sourced from turbo's releases.

Turborepo v2.10.9

What's Changed

Changelog

• chore: Release Turborepo 2.10.8 by @​github-actions[bot] in vercel/turborepo#13626
• perf: Walk literal-prefix tree globs without wax compilation by @​charpeni in vercel/turborepo#13522
• fix: Accept semver ranges in devEngines.packageManager.version by @​bangseongbeom in vercel/turborepo#13623
• docs: Explain affected package invalidation reasons by @​ghoullier in vercel/turborepo#13594
• perf(lockfiles): Borrow field-name scalars in the pnpm fast parser by @​anthonyshew in vercel/turborepo#13648
• perf(repository): Avoid discarded alias allocation in Relationship by @​anthonyshew in vercel/turborepo#13650
• perf(lockfiles): Drop redundant human_name clone for pnpm v7/v9 by @​anthonyshew in vercel/turborepo#13649
• perf: Index workspace nodes by name in project_relationships by @​anthonyshew in vercel/turborepo#13647
• perf: Share resolution identity lists across identical workspace closures by @​anthonyshew in vercel/turborepo#13641
• docs: Fix duplicated word in runtime dependencies guide summary by @​anthonyshew in vercel/turborepo#13630
• refactor: Remove turborepo-lsp dependency on turborepo-lib by @​anthonyshew in vercel/turborepo#13631
• perf: Index Bun nested lockfile entries by name for fallback resolution by @​anthonyshew in vercel/turborepo#13633
• perf: Memoize framework inference per package during task hashing by @​anthonyshew in vercel/turborepo#13634
• perf: Avoid materializing transient declarations in external_dependencies by @​anthonyshew in vercel/turborepo#13646
• perf: Enable shared closure DP for npm and yarn1 lockfiles by @​anthonyshew in vercel/turborepo#13635
• perf: Parse pnpm explicit-key entries in the lockfile fast path by @​anthonyshew in vercel/turborepo#13640
• perf: Parallelize resolution fingerprint hashing by @​anthonyshew in vercel/turborepo#13642
• perf: Build resolution identity lists in parallel by @​anthonyshew in vercel/turborepo#13643
• perf: Intern resolution identities as Arc<str> across closures by @​anthonyshew in vercel/turborepo#13645
• fix: Compose affected tasks with package filters by @​anthonyshew in vercel/turborepo#13656
• docs: Explain worktree cache path isolation by @​anthonyshew in vercel/turborepo#13657
• fix: Upgrade brace-expansion to 5.0.9 by @​anthonyshew in vercel/turborepo#13658
• docs: Correct verified inaccuracies in the Turborepo Agent Skill by @​charpeni in vercel/turborepo#13644
• chore: Update Next.js to 16.3.0 by @​anthonyshew in vercel/turborepo#13659
• fix: Don't use eprintln! in the panic hook by @​molofsky in vercel/turborepo#13637
• fix: Invalidate only when Git ignore sources change by @​smasato in vercel/turborepo#13632
• docs: Update Geistdocs to 1.19.4 by @​christopherkindl in vercel/turborepo#13680
• docs: Exclude Turborepo from its own OSS products menu by @​christopherkindl in vercel/turborepo#13681
• docs: Use the geistdocs Turborepo logo in the navbar by @​christopherkindl in vercel/turborepo#13682
• docs: Update redirected vercel.com/nextjs.org links to current targets by @​molebox in vercel/turborepo#13685
• refactor: Generalize native command arguments by @​anthonyshew in vercel/turborepo#13664
• refactor: Move native contracts to tasks by @​anthonyshew in vercel/turborepo#13665
• docs: Fix loadTransformers reference in turbo-codemod README by @​latent-9 in vercel/turborepo#13683
• refactor: Model native task execution explicitly by @​anthonyshew in vercel/turborepo#13666
• feat: Compose aggregate native task dependencies by @​anthonyshew in vercel/turborepo#13667
• fix: Respect aggregate task overrides by @​anthonyshew in vercel/turborepo#13668
• test: Stabilize watch task inputs regression test by @​anthonyshew in vercel/turborepo#13686
• feat: Parse Python quality tool declarations by @​anthonyshew in vercel/turborepo#13669
• feat: Resolve Python quality plans by @​anthonyshew in vercel/turborepo#13670
• refactor: Extract uv native task specs by @​anthonyshew in vercel/turborepo#13671
• feat: Synthesize Python quality tasks by @​anthonyshew in vercel/turborepo#13672
• test: Cover Python quality task commands by @​anthonyshew in vercel/turborepo#13673
• feat: Hash Python quality task inputs by @​anthonyshew in vercel/turborepo#13674
• test: Cover Python quality task graph by @​anthonyshew in vercel/turborepo#13675
• chore: Release Turborepo 2.10.9-canary.1 by @​github-actions[bot] in vercel/turborepo#13687

... (truncated)

Commits

• 33237d4 publish 2.10.9 to registry
• 3b0e57f fix: Prevent Windows process cleanup PID reuse (#13695)
• efe4e1b fix: Prune Bun wildcard workspace dev dependencies (#13694)
• a98e5cd docs: Document dependency-driven Python tasks (#13676)
• c09a92f chore: Release Turborepo 2.10.9-canary.1 (#13687)
• 09bd548 test: Cover Python quality task graph (#13675)
• 3584a5f feat: Hash Python quality task inputs (#13674)
• 0d43ff3 test: Cover Python quality task commands (#13673)
• 94708ad feat: Synthesize Python quality tasks (#13672)
• e14f04e refactor: Extract uv native task specs (#13671)
• Additional commits viewable in compare view

Updates @neon-rs/cli from 0.1.82 to 0.2.6

Commits

• 8043a58 v0.2.6
• 0213f55 Fix prepack script to not overwrite package.json
• 5d8a3fb Clean up @​neon-rs/cli dependencies and build scripts
• 78e1825 v0.2.5
• 06871b2 Add cargo-messages to verdaccio proxy isolated packages
• 5e63fde Add missing repository field to @​neon-rs/manifest package.json
• d571d23 v0.2.4
• 936c08c Fix repository URLs to match GitHub org for npm provenance
• 817a885 v0.2.3
• 7803686 Switch to npm OIDC trusted publishing and revert versions to 0.2.2
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​neon-rs/cli since your current version.

Updates @clerk/backend from 3.11.3 to 3.16.1

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.16.1

Patch Changes

• Use a root-relative link (/contact/support) for the passwordHasher "contact support" reference so the generated API reference renders it as an internal same-tab link instead of an external one. (#9347) by @​manovotny

• Updated dependencies [34d278b]:

  • @​clerk/shared@​4.27.1

@​clerk/backend@​3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

Changelog

Sourced from @​clerk/backend's changelog.

3.16.1

Patch Changes

• Use a root-relative link (/contact/support) for the passwordHasher "contact support" reference so the generated API reference renders it as an internal same-tab link instead of an external one. (#9347) by @​manovotny

• Updated dependencies [34d278b]:

  • @​clerk/shared@​4.27.1

3.16.0

Minor Changes

• Add clerkClient.users.removePassword(userId, params?) to remove a user's password through the Backend API. Password removal is allowed even when the user has no alternate sign-in method configured. Existing sessions remain active by default; pass { signOutOfOtherSessions: true } to revoke them. (#9326) by @​joshrowley

Patch Changes

• Improve generated API reference links, expose BillingSubscriptionItemStatus, and clarify the createUser() identification status documentation. (#9340) by @​SarahSoutoul

• Updated dependencies [1ef84c3, d639048, a66cbbf]:

  • @​clerk/shared@​4.27.0

3.15.1

Patch Changes

• Add the optional emailAddressIdentificationStatus and phoneNumberIdentificationStatus parameters to CreateUserParams. The Backend API has supported these arrays on POST /v1/users since they shipped, but createUser() had no way to pass them, so every email address and phone number was necessarily created verified. Each array runs parallel to emailAddress / phoneNumber — one item per identifier, applied by position — and an item set to 'reserved' creates that identifier unverified but still usable for sign-in and locked so no other user can claim it. (#9305) by @​dmoerner

  The createUser() documentation is corrected accordingly: it stated unconditionally that created email addresses and phone numbers are automatically verified, which is only the default.

• Updated dependencies [5c81479]:

  • @​clerk/shared@​4.26.0

3.15.0

Minor Changes

• Update fields for BillingSubscription and BillingSubscriptionItem (#9196) by @​dstaley

Patch Changes

• Return a TokenVerificationError from decodeJwt and verifyToken for tokens whose header, payload, or signature cannot be decoded. (#9268) by @​wobsoriano

• Updated dependencies [aaea141]:

  • @​clerk/shared@​4.25.10

3.14.0

Minor Changes

... (truncated)

Commits

• 6100719 ci(repo): Version packages (#9353)
• 63d25ba docs(backend): Use root-relative link for passwordHasher contact support refe...
• a53c672 ci(repo): Version packages (#9334)
• f38cf02 feat(backend): support removing user passwords (#9326)
• 1ef84c3 fix(backend,shared): fix generated TypeDoc references (#9340)
• 438f2e5 ci(repo): Version packages (#9306)
• a601cd7 fix(backend): Update params and documention on createUser (#9305)
• 38f347c ci(repo): Version packages (#9289)
• fe6ee54 fix(backend): Update Subscription and SubscriptionItem resources (#9196)
• 9c51d74 fix(backend): Return TokenVerificationError from decodeJwt for undecodable to...
• Additional commits viewable in compare view

Updates @supabase/postgrest-js from 2.110.2 to 2.112.2

Release notes

Sourced from @​supabase/postgrest-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)
• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Filipe Cabaço @​filipecabaco
• Vaibhav @​7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Vaibhav @​7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

• auth: preserve 5xx error message (#2587)
• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel
• Vaibhav @​7ttp

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/postgrest-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.112.0 (2026-08-03)

🩹 Fixes

• postgrest: honour throwOnError when maybeSingle finds multiple rows (#2580)

❤️ Thank You

• Juhef @​juheff
• Zuhef Ahmed @​Zuhef

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

This was a version bump only for @​supabase/postgrest-js to align it with other projects, there were no code changes.

2.110.7 (2026-07-16)

🩹 Fixes

• postgrest: correct self-reference inference (#2525)

❤️ Thank You

• Vaibhav @​7ttp

2.110.6 (2026-07-15)

🩹 Fixes

• postgrest: type hinted self-referencing embeds as arrays (#2520)

❤️ Thank You

• Katerina Skroumpelou @​mandarini

... (truncated)

Commits

• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 4c13bf0 fix(postgrest): honour throwOnError when maybeSingle finds multiple rows (#2580)
• 6331898 docs(postgrest): document that statusText may be empty over HTTP/2 (#2574)
• a262492 chore(release): version 2.111.0 changelogs (#2572)
• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• 22050de chore(release): version 2.110.8 changelogs (#2546)
• 150b00c chore(release): version 2.110.7 changelogs (#2533)
• 5c18b62 fix(postgrest): correct self-reference inference (#2525)
• c90b1cd chore(release): version 2.110.6 changelogs (#2527)
• Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.110.2 to 2.112.2

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.112.2

2.112.2 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)
• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Filipe Cabaço @​filipecabaco
• Vaibhav @​7ttp

v2.112.2-canary.1

2.112.2-canary.1 (2026-08-06)

🩹 Fixes

• realtime: clear stale join payload on sign-out (#2597)

❤️ Thank You

• Vaibhav @​7ttp

v2.112.2-canary.0

2.112.2-canary.0 (2026-08-06)

🩹 Fixes

• realtime: prevent duplicate on bindings (#2594)

❤️ Thank You

• Filipe Cabaço @​filipecabaco

v2.112.1

2.112.1 (2026-08-05)

🩹 Fixes

• auth: preserve 5xx error message (#2587)
• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel
• Vaibhav @​7ttp

v2.112.1-canary.1

2.112.1-canary.1 (2026-08-05)

... (truncated)

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.112.2 (2026-08-06)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.112.1 (2026-08-05)

🩹 Fixes

• realtime: ensure setAuth doesn't disable token refresh (#2592)

❤️ Thank You

• Eduardo Gurgel

2.112.0 (2026-08-03)

🚀 Features

• supabase: move OpenTelemetry tracing to opt-in /tracing subpath (#2583)

🩹 Fixes

• supabase: forward db retry option (#2571)

❤️ Thank You

• Katerina Skroumpelou @​mandarini
• Vaibhav @​7ttp

2.111.0 (2026-07-28)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.9 (2026-07-27)

This was a version bump only for @​supabase/supabase-js to align it with other projects, there were no code changes.

2.110.8 (2026-07-21)

🩹 Fixes

• supabase: skip Node warning in Deno (#2541)

❤️ Thank You

• Vaibhav @​7ttp

2.110.7 (2026-07-16)

🩹 Fixes

... (truncated)

Commits

• 07b27ee chore(release): version 2.112.1 changelogs (#2593)
• 1831402 fix(realtime): ensure setAuth doesn't disable token refresh (#2592)
• 0136f34 chore(release): version 2.112.0 changelogs (#2589)
• 2877b5b test(supabase): replace test-tracing harness with real-OTel unit and e2e cove...
• a413544 feat(supabase): move OpenTelemetry tracing to opt-in /tracing subpath (#2583)
• e6c975c fix(supabase): forward db retry option (#2571)
• a262492 chore(release): version 2.111.0 changelogs (#2572)
• 18b5bb2 chore(release): version 2.110.9 changelogs (#2567)
• fc2e61e chore(repo): bump postcss override and fix playwright 1.62 tsconfig failure (...
• 22050de chore(release): version 2.110.8 changelogs (#2546)
• Additional commits viewable in compare view

Updates @types/semver from 7.7.1 to 7.8.0

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cd96e9c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR