Skip to content

chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates - #955

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-19a5f6a9db
Open

chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates#955
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dev-dependencies-19a5f6a9db

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dev-dependencies group with 3 updates in the / directory: @biomejs/biome, turbo and @clerk/backend.

Updates @biomejs/biome from 2.5.9 to 2.5.10

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.10

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

    <div /* block comment */ class="something"></div>
<Component /* c */ client:load />

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

  • #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

    <div>{/* a note */}</div>
<div class={/* a note */}>x</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

    <div>{/* block comment */ x}</div>
<div>{/* only a comment */}</div>

  • #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

    <>
  <p>a</p>
</>

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

    ---
const a = "</script>";
// </script> in a comment
---

  • #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

    <!-- c -->

... (truncated)

Commits

Updates turbo from 2.10.10 to 2.10.11

Release notes

Sourced from turbo's releases.

Turborepo v2.10.11

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.10...v2.10.11

Turborepo v2.10.11-canary.4

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.11-canary.3...v2.10.11-canary.4

Turborepo v2.10.11-canary.3

What's Changed

Changelog

Full Changelog: vercel/turborepo@v2.10.11-canary.2...v2.10.11-canary.3

Turborepo v2.10.11-canary.2

... (truncated)

Commits

Updates @clerk/backend from 3.16.7 to 3.16.10

Release notes

Sourced from @​clerk/backend's releases.

@​clerk/backend@​3.16.10

Patch Changes

  • Mark the internal createBootstrapSignedOutState as deprecated. It is no longer used by @clerk/nextjs and is kept only for older published SDK versions. (#9493) by @​djgould

  • Updated dependencies [ea8cb05]:

    • @​clerk/shared@​4.29.3

@​clerk/backend@​3.16.9

Patch Changes

  • Reject JWT-template tokens where a session or handshake token is expected. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token in the Authorization header or __session cookie. Tokens with no category tag, and instances configured to omit it, are unaffected. (#9469) by @​dominic-clerk
Changelog

Sourced from @​clerk/backend's changelog.

3.16.10

Patch Changes

  • Mark the internal createBootstrapSignedOutState as deprecated. It is no longer used by @clerk/nextjs and is kept only for older published SDK versions. (#9493) by @​djgould

  • Updated dependencies [ea8cb05]:

    • @​clerk/shared@​4.29.3

3.16.9

Patch Changes

  • Reject JWT-template tokens where a session or handshake token is expected. authenticateRequest() now returns a signed-out state with reason token-type-mismatch for such a token in the Authorization header or __session cookie. Tokens with no category tag, and instances configured to omit it, are unaffected. (#9469) by @​dominic-clerk

3.16.8

Patch Changes

  • Scope the JWKS cache per Clerk instance. The cache was keyed on the JWT kid alone and shared across the whole process, so an application verifying tokens for more than one Clerk instance (for example the Dynamic Keys / multi-tenant pattern) could resolve a signing key that was fetched for a different instance. Keys are now cached separately per secret key and API URL, so a token can only be verified against the instance whose credentials fetched its signing key. (#9394) by @​dominic-clerk

    Networkless verification with jwtKey had the same flaw: the JWK derived from the PEM was cached by kid alone, so a process verifying tokens with different jwtKey values could resolve a key derived from another instance's PEM. The JWK is now always derived from the jwtKey that was passed in.

    The jwk-kid-mismatch error message no longer lists the key IDs currently held in the cache.

Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: supply-chain. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 30, 2026 22:07
@changeset-bot

changeset-bot Bot commented Aug 30, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 8191167

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

freshtonic
freshtonic approved these changes Aug 31, 2026
View reviewed changes

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving the dependency changes; do not merge until the red CI is resolved — the failure is not caused by this PR.

The content is clean: grouped minor/patch bumps only, touching manifests, the lockfile, and (in the production group) catalog version strings in pnpm-workspace.yaml. No onlyBuiltDependencies additions, no overrides changes, no script or .npmrc changes.

The failing Drizzle v3 integration jobs fail identically on this PR and its sibling, at integration/lock-context.integration.test.ts, with:

Integration suite cannot run — missing CLERK_MACHINE_TOKEN … This suite FAILS rather than skips: a green skip would hide a real regression.

That is a secrets-availability condition on Dependabot-actor runs (Dependabot workflows read the separate Dependabot secrets store — the CS_* values are evidently there, since the require-cs-secrets pre-flight passed, but CLERK_MACHINE_TOKEN / CLERK_MACHINE_TOKEN_B are not). A dev-tooling or minor-dep bump cannot remove a Clerk credential from a runner; the same job passed on the 26 Aug Dependabot round, so either the token left the Dependabot store since, or the lock-context suite's deliberate fail-rather-than-skip landed in between and is now correctly surfacing a token that was never in that store.

Fix path: add CLERK_MACHINE_TOKEN (and _B) to the repo's Dependabot secrets (Settings → Secrets → Dependabot), then re-run the failed jobs. If instead the intent is that Dependabot runs skip the Clerk-dependent suite, that's a workflow decision to make explicitly — not a reason to hold these bumps.

@dependabot
chore(deps-dev): bump the dev-dependencies group across 1 directory w…
8191167 
…ith 3 updates

Bumps the dev-dependencies group with 3 updates in the / directory: [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome), [turbo](https://github.com/vercel/turborepo) and [@clerk/backend](https://github.com/clerk/javascript/tree/HEAD/packages/backend).


Updates `@biomejs/biome` from 2.5.9 to 2.5.10
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.5.10/packages/@biomejs/biome)

Updates `turbo` from 2.10.10 to 2.10.11
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.10...v2.10.11)

Updates `@clerk/backend` from 3.16.7 to 3.16.10
- [Release notes](https://github.com/clerk/javascript/releases)
- [Changelog](https://github.com/clerk/javascript/blob/main/packages/backend/CHANGELOG.md)
- [Commits](https://github.com/clerk/javascript/commits/@clerk/backend@3.16.10/packages/backend)

---
updated-dependencies:
- dependency-name: "@biomejs/biome"
  dependency-version: 2.5.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@clerk/backend"
  dependency-version: 3.16.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: turbo
  dependency-version: 2.10.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps-dev): bump the dev-dependencies group with 3 updates chore(deps-dev): bump the dev-dependencies group across 1 directory with 3 updates Aug 31, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/dev-dependencies-19a5f6a9db branch from 34a6123 to 8191167 Compare August 31, 2026 02:34
freshtonic
freshtonic approved these changes Aug 31, 2026
View reviewed changes

@freshtonic freshtonic left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approved after the Dependabot regeneration — same dev-dependency group, same file scope, no supply-chain deltas. The two failing Drizzle jobs are still the known infrastructure issue from my previous review (lock-context suite fail-hard on CLERK_MACHINE_TOKEN missing from the Dependabot secrets store), unrelated to these bumps. Merge once the Clerk tokens are added to Dependabot secrets and the jobs re-run green.

@freshtonic freshtonic mentioned this pull request Aug 31, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@freshtonic freshtonic freshtonic approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@freshtonic