Skip to content

build(deps-dev): bump the npm-minor-patch group across 1 directory with 2 updates - #4032

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1e931744ab
Open

build(deps-dev): bump the npm-minor-patch group across 1 directory with 2 updates#4032
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-minor-patch-1e931744ab

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the npm-minor-patch group with 2 updates in the / directory: @anthropic-ai/claude-code and @biomejs/biome.

Updates @anthropic-ai/claude-code from 2.1.263 to 2.1.268

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.268

What's changed

  • Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
  • Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
  • Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
  • Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
  • Added configDirectory to the output of claude auth status --json
  • Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
  • Added browser-tab icons for published artifacts, chosen by Claude to match each page
  • Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
  • Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
  • Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
  • Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
  • Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
  • Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
  • Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
  • Fixed plugin and marketplace errors showing a token or password from a git source URL
  • Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
  • Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
  • Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
  • Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
  • Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
  • Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
  • Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
  • Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
  • Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
  • Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
  • Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
  • Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second
  • Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway
  • Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks
  • Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist
  • Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed
  • Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row
  • Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled
  • Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents
  • Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts
  • Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked
  • Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl
  • Fixed PermissionRequest hooks not firing in --print mode
  • Fixed policy-helper warnings not printing on headless (-p) runs
  • Fixed /resume listing a /fork background session under its parent's name instead of its own ⑂ fork name
  • Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message
  • Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)
  • Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page
  • Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"
  • Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed
  • Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript
  • Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.268

  • Added to the Claude apps gateway: with pricing: set in gateway.yaml, signed-in Claude Code clients receive the same rates through managed settings, so /cost and telemetry match the spend meter
  • Added a startup warning for gateways when access_control.allow_cidrs is empty, and a one-time warning the first time a request arrives from a public address
  • Added the gatewayInternalNetworks managed setting, letting administrators allow /login to a Claude apps gateway on their organization's own public IPv4 block
  • Added claude self-hosted-runner --remove-session-state (default off): delete each session's per-session directories under <base-dir>/_sessions/ when the session ends
  • Added configDirectory to the output of claude auth status --json
  • Added --json to claude plugin install, uninstall, update, enable and disable, and errorDetails/noteDetails to each row of claude plugin list --json
  • Added browser-tab icons for published artifacts, chosen by Claude to match each page
  • Fixed every turn failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL) since 2.1.265: a regex in the Artifact tool's input schema that those endpoints reject
  • Fixed WebFetch hanging indefinitely on a server that keeps the response open without finishing; a fetch now fails after 300 seconds. Set CLAUDE_CODE_WEBFETCH_DEADLINE_MS to override the deadline (0 turns it off)
  • Fixed a respawned in-process teammate picking up tools or a system prompt from a same-named agent file in a folder you have not trusted
  • Fixed sustained high CPU usage: a busy loop in long-running idle sessions no longer pins a CPU core, and rapid terminal focus reports during a session recap no longer keep the CPU high
  • Fixed Claude sometimes replying "your message came through empty" after an MCP tool call
  • Fixed deny and ask permission rules on symlinked directories (/etc, /tmp, /var on macOS; /bin on Linux) not applying when a path was given by its real location, and Bash commands ignoring deny rules written on a symlinked path spelling
  • Fixed a case where a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line
  • Fixed plugin and marketplace errors showing a token or password from a git source URL
  • Fixed /mcp and /plugin server details, claude mcp list/get, and MCP login errors showing secrets resolved from ${VAR} placeholders in MCP configs
  • Fixed prompt caching and extended thinking breaking mid-session for SDK sessions using excludeDynamicSections: the first message is no longer re-rendered each request
  • Fixed entitled users being told a model is restricted after restart or in the Desktop Code tab when a cached model-access denial was stale
  • Fixed a running session silently switching to the organization's default model when another Claude Code process refreshed a stale model-access entry
  • Fixed long-context 429s on Fable models showing the usage-credits consent prompt instead of the 1M-context message on Pro and Team plans
  • Fixed workload identity federation via a profile (as claude-code-action configures it): processes sharing the profile could fail mid-run with 401 … jti reused
  • Fixed MCP server OAuth sign-in failing with "No available ports for OAuth redirect" when the local callback port range can't be bound
  • Fixed the conversation summary produced by /compact and auto-compact mangling text that contained $ sequences
  • Fixed resuming a conversation that ended with /compact: its restored-file notes now load in the same order on every resume
  • Fixed SDK prompt suggestions, side questions and /rename sending the conversation from before a compaction
  • Fixed @ file and / command suggestions not appearing after recalling a previous prompt with the up arrow and editing it
  • Fixed claude agents: pressing ← again at a natural pace to go back to the agent list no longer gets ignored until you pause for over a second
  • Fixed claude agents session delete getting stuck when a worktree can't be removed: the message names the cause and next step, and for a git worktree ctrl+x again deletes the directory anyway
  • Fixed background agent and workflow rows in the agents panel expanding to many lines when their text contained line breaks
  • Fixed Claude in Slack sessions losing their Slack tools when org managed settings set an MCP allowlist
  • Fixed Claude in Chrome asking to allow the host "https" when a navigation URL had a scheme but a host that could not be parsed
  • Fixed the spinner wrapping onto several lines when the current task's label is long; the label and the "Next:" task line now stay within one terminal row
  • Fixed the /bug and /feedback description field showing no cursor when the terminal's native cursor is enabled
  • Fixed Remote Control sessions served by claude remote-control showing a generated name instead of their session title in ListAgents
  • Fixed claude plugin validate rejecting plugin paths whose directory name begins with two dots, which the plugin loader accepts
  • Fixed plugins silently skipping a default monitors file or root SKILL.md that could not be checked
  • Fixed WebFetch's error for localhost and other dotless hostnames to explain why the URL is refused and suggest curl
  • Fixed PermissionRequest hooks not firing in --print mode
  • Fixed policy-helper warnings not printing on headless (-p) runs
  • Fixed /resume listing a /fork background session under its parent's name instead of its own ⑂ fork name
  • Fixed /remote-control and other claude.ai-gated commands to suggest /login when signed out instead of showing a Claude for Enterprise migration message
  • Fixed CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS not extending SessionEnd hooks that have no per-hook timeout (they were still cancelled after 1.5 seconds)
  • Fixed /autofix-pr and other cloud-session commands saying to retry or install the Claude GitHub App when no GitHub account is connected; they now point to /web-setup or the web connect page
  • Fixed cloud-session commands such as /teleport and /remote-env to explain when an organization policy turns them off, instead of answering "Unknown command"
  • Fixed Bash sandbox instructions over-stating confinement: no unenforced path lists when filesystem isolation is off, and strict mode no longer claims commands can never run unsandboxed
  • Improved fullscreen mode: adding or removing a prompt line (Shift+Enter) now repaints as fast as typing a character instead of re-rendering the visible transcript
  • Improved --continue / --resume: the conversation appears immediately instead of waiting for SessionStart hooks, and the first message no longer re-reads the whole transcript
  • Improved responsiveness during tool-heavy turns by no longer redrawing the transcript for a hidden per-tool-batch reminder

... (truncated)

Commits
  • 536a2e2 chore: Update CHANGELOG.md and feed.xml
  • fb63c4a Merge pull request #93244 from anthropics/poteat/mods-telemetry-fixes
  • 1297731 mods/diff: backgrounds summary in two lines, as the internal copy has it
  • 573ada6 mods/diff: context lines draw on no background, not the cyan background-task ...
  • 8939dec mods/diff: the backend probes comment names where a host adds backends
  • 2142ece mods/diff: a backend seam, git as the built-in backend
  • 1a7c76e mods: API renames in diff, telemetry rows queue and third-party providers sen...
  • e62465d Merge pull request #93215 from anthropics/poteat/mods
  • d9c456d Add mods: sec-default, diff and telemetry, the hooks-module plugins built int...
  • 9cdc2a4 chore: Update CHANGELOG.md and feed.xml
  • Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.11 to 2.5.12

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.12

2.5.12

Patch Changes

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

    <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

    {x && <div><!-- first -->text<!-- last --></div>}
{cond && <a></a><!-- c --><b></b>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

    {cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

  • #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

    Math.max(Math.max(a, b), c);

    The fix flattens this expression to Math.max(a, b, c).

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.12

Patch Changes

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute expressions rejecting TypeScript and JSX syntax that is accepted in text expressions.

    <Component icon={<Icon />} count={total as number} onSelect={(e: Event) => e} />

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed Astro attribute names being split on : and . inside an expression, such as {x && <button x-on:keyup.enter={go} client:load.foo />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a bare > in the children of an Astro expression being treated as markup, such as {x && <div>a > b</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed HTML comments inside an Astro expression failing to parse. They are now read as trivia, wherever they appear among the children.

    {x && <div><!-- first -->text<!-- last --></div>}
{cond && <a></a><!-- c --><b></b>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed is:raw children inside an Astro expression being read as JSX, such as {x && <div is:raw>{not js} < & text</div>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed an apostrophe or quote in the text of a JSX element inside an Astro expression ending the expression early, such as {items.map((i) => <li>it's {i}</li>)}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed the children of a <script> or <style> inside an Astro expression being read as JSX. Their contents are text, so braces and comparisons no longer have to be escaped.

    {cond && <style>a { color: red }</style>}
{cond && <script>let x = {a: 1};</script>}

  • #11440 b88f1ea Thanks @​Princesseuh! - Added support for template literal attribute values inside an Astro expression, such as {x && <C data-x=`t${x}` />}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed unquoted attribute values being rejected inside an Astro expression, such as {x && <a class=foo maxlength=255 href=/about>go</a>}.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a template literal nested inside ${} breaking the rest of an Astro file, such as const href = `/blog${page === 0 ? '' : `/${page + 1}`}`;.

  • #11440 b88f1ea Thanks @​Princesseuh! - Fixed a quote inside a regex character class breaking the rest of an Astro file, such as const unsafe = /[/"]/;.

  • #11508 54f3a2e Thanks @​dyc3! - Added the nursery rule useFlatMathMinMax. Because Math.min() and Math.max() accept any number of arguments, the rule reports unnecessary nested calls to the same method:

    Math.max(Math.max(a, b), c);

    The fix flattens this expression to Math.max(a, b, c).

  • #11585 c5c8315 Thanks @​Netail! - Fixed #11475: noUnresolvedImports no longer reports Bun runtime built-in modules (bun, bun:bundle, bun:ffi, bun:jsc, bun:sqlite, bun:test).

... (truncated)

Commits

@dependabot dependabot Bot added the dependencies Dependency updates (Dependabot / Renovate). label Sep 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-1e931744ab branch from 422c170 to 3bb6a65 Compare September 11, 2026 09:56
@dependabot
build(deps-dev): bump the npm-minor-patch group across 1 directory wi…
a281846 
…th 2 updates

Bumps the npm-minor-patch group with 2 updates in the / directory: [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) and [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome).


Updates `@anthropic-ai/claude-code` from 2.1.263 to 2.1.268
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Changelog](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md)
- [Commits](anthropics/claude-code@v2.1.263...v2.1.268)

Updates `@biomejs/biome` from 2.5.11 to 2.5.12
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.12/packages/@biomejs/biome)

---
updated-dependencies:
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.267
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-minor-patch-1e931744ab branch from 3bb6a65 to a281846 Compare September 11, 2026 16:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates (Dependabot / Renovate).

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants