chore(deps): bump the bun-minor-patch group across 1 directory with 4 updates

[dependabot]

Bumps the bun-minor-patch group with 4 updates in the / directory: @anthropic-ai/claude-agent-sdk, @biomejs/biome, knip and marked.

Updates @anthropic-ai/claude-agent-sdk from 0.3.220 to 0.3.236

Release notes

Sourced from @​anthropic-ai/claude-agent-sdk's releases.

v0.3.236

What's changed

• PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.236
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.236
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.236
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.236

v0.3.235

What's changed

• Updated to parity with Claude Code v2.1.235

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.235
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.235
# or
pnpm add @anthropic-ai/claude-agent-sdk@0.3.235
# or
bun add @anthropic-ai/claude-agent-sdk@0.3.235

v0.3.234

What's changed

• Removed unused bypass_permissions_disabled from ExitReason type; the value was never emitted — TypeScript consumers with an explicit case branch get a compile error on upgrade (runtime unaffected)
• Updated the ApiKeySource type to include the values system/init actually reports (ANTHROPIC_API_KEY, apiKeyHelper, /login managed key, none)
• vcs_state_changed events report the directory the shell finished in (an inner cd is reflected)
• A peer origin injected by the host may declare the sending session's permission class (fromMode) so a same-class message is delivered to a recipient that runs without asking
• SDKSystemMessage (system/init) gains an optional effort field: the session's applied effort level, or null when none is sent. Set on Remote Control bridge init frames

Update

npm install @anthropic-ai/claude-agent-sdk@0.3.234
# or
yarn add @anthropic-ai/claude-agent-sdk@0.3.234
# or
</tr></table> 

... (truncated)

Changelog

Sourced from @​anthropic-ai/claude-agent-sdk's changelog.

0.3.236

• PostToolUse hooks can return hookSpecificOutput.classifierContext, a short host-asserted note about a tool call's result that the auto mode permission classifier reads alongside that result

0.3.235

• Updated to parity with Claude Code v2.1.235

0.3.234

• Removed unused bypass_permissions_disabled from ExitReason type; the value was never emitted — TypeScript consumers with an explicit case branch get a compile error on upgrade (runtime unaffected)
• Updated the ApiKeySource type to include the values system/init actually reports (ANTHROPIC_API_KEY, apiKeyHelper, /login managed key, none)
• vcs_state_changed events report the directory the shell finished in (an inner cd is reflected)
• A peer origin injected by the host may declare the sending session's permission class (fromMode) so a same-class message is delivered to a recipient that runs without asking
• SDKSystemMessage (system/init) gains an optional effort field: the session's applied effort level, or null when none is sent. Set on Remote Control bridge init frames

0.3.233

• Notification hooks now fire for pending permission prompts on the SDK path, matching the interactive REPL behavior
• Todo/task-tracking tools (TaskCreate/TaskGet/TaskUpdate/TaskList, TodoWrite) are no longer in the default tool surface on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models; name them in the tools option or reference them in allowedTools (or set CLAUDE_CODE_ENABLE_TODO_TOOLS=1) to keep them

0.3.232

• Subagent MCP tool_result frames whose result carries _meta now emit tool_use_result as { content, _meta } (matching main-loop frames) instead of a bare value
• /context result messages now carry a structured context_usage payload (new SDKContextUsage type), so consumers can render the context-usage card without parsing the markdown table
• vcs_state_changed events now populate the branch field for push operations, sourced from the pushed ref

0.3.231

• Updated to parity with Claude Code v2.1.231

0.3.230

• Updated to parity with Claude Code v2.1.230

0.3.229

• Added terminal_slash_commands to the system init message so Remote Control clients can hide terminal-oriented commands
• Changed conversations whose messages alone exceed the API's 32 MB limit to end the turn with terminal_reason "api_error" instead of "image_error"; StopFailure error_details is "request_body_over_limit: …"

0.3.228

• Agent tool results (AgentOutput): usage.output_tokens_details is now carried through

0.3.227

• Updated to parity with Claude Code v2.1.227

0.3.226

... (truncated)

Commits

• d933c99 chore: Update CHANGELOG.md
• 076593f chore: Update CHANGELOG.md
• a616205 chore: Update CHANGELOG.md
• 73a28ab chore: Update CHANGELOG.md
• 8716a39 chore: Update CHANGELOG.md
• b5321a4 chore: Update CHANGELOG.md
• 71dfabb chore: Update CHANGELOG.md
• 0a2639d chore: Update CHANGELOG.md
• 2284706 chore: Update CHANGELOG.md
• d13c50c chore: Update CHANGELOG.md
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.1 to 2.5.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.10

Patch Changes

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro rejecting JavaScript comments between attributes.

  <div /* block comment */ class="something"></div>
  <Component /* c */ client:load />

• #11403 8f7786f Thanks @​Princesseuh! - Fixed a bare < in Astro text being treated as the start of a tag, such as <p>5 < 6 and 7 > 6</p>. As in HTML, a < that cannot open a tag is text and needs no escaping.

• #11438 3133ffa Thanks @​Princesseuh! - Fixed #8294: an Astro expression holding only a comment is no longer reported as a parse error, which also stopped the whole file from being formatted.

  <div>{/* a note */}</div>
  <div class={/* a note */}>x</div>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed #9165: an empty Astro expression such as <div>{}</div> no longer fails to parse. Astro renders {} as nothing.

• #11403 8f7786f Thanks @​Princesseuh! - Fixed Astro expressions containing a comment failing to parse.

  <div>{/* block comment */ x}</div>
  <div>{/* only a comment */}</div>

• #11403 8f7786f Thanks @​Princesseuh! - Added support for Astro's fragment shorthand.

  <>
    <p>a</p>
  </>

• #11403 8f7786f Thanks @​Princesseuh! - Fixed an Astro frontmatter block being cut short by a closing tag inside a string or comment.

  ---
  const a = "</script>";
  // </script> in a comment
  ---

• #11403 8f7786f Thanks @​Princesseuh! - Fixed --- being read as an Astro frontmatter fence when markup precedes it. Astro only recognizes frontmatter at the very start of a file, so a file opening with a comment now has no frontmatter, and its --- lines are content.

  <!-- c -->

... (truncated)

Commits

• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• Additional commits viewable in compare view

Updates knip from 6.29.0 to 6.32.2

Release notes

Sourced from knip's releases.

Release 6.32.2

• Support oxfmt.config.mts (#1933) (795900191dc75eec8d1e717b866bf57e1e2912cc) - thanks @​joealden!
• Support oxlint.config.mts (#1934) (531e2dc7c1d8bf31babea0068c34391182ec2d50) - thanks @​joealden!
• Fix Supported lint-staged Configs (#1935) (f9c755e414ed10baa4d01af8ddac6d04cb8d5617) - thanks @​joealden!
• Update dependencies (95f7c529f918dd9e1a84f92c68d064738977b825)
• Update sentry snapshot (ea7929fcbd6b323c8bdd9252ac57017feeb29ecf)

Release 6.32.1

• Handle referenced config files in their own plugin (resolve #1931, close #1932) (982c1d8e28cc62d3cba5ecde6dd8df2740c7c329)
• Fix type-check against typescript@5.0.4 (2febefe44a8b39f74158916a2bc73933b4c281ae)
• Update sentry snapshot (0397bddbf809e2b24fe59a4bea8c0258526bb565)

Release 6.32.0

• fix: attribute wildcard subpath-import aliases as dependency usage (#1918) (4890a2ad5317b9e3f0ab844631ad0f0592802c3e) - thanks @​jsmecham!
• Add Borp plugin (5eb9ad4cfb2ccb7770eac49f6109459d30590211)
• Add tsd plugin (bd4ae7041f3fc6aef27b027644f80daefc432aca)
• Resolve Rollup --config argument as plugin configuration (8111f97981406f4327d5e6a655c13308a9dc4426)
• Resolve babel-jest configFile from Jest transform options (24794ccecb80fdaecfe4d46a26faff46c30d9015)
• Add pre-commit plugin (ac726b0918cb931a6d538797e342484812a6752e)
• Thread script words through resolvers to preserve quoting (89f9ada6ca81229bf8f7293439998acc5f87d457)
• Resolve entries from Mocha script arguments (353f860f8e32f05f7c87dc5501071befc0e5a293)
• Detect Node test runner through c8 (fa44be722aa35c6e8b441cd8cd0f4cf644027c22)
• Update dependencies (non-major) (#1922) (6b1e6f3cbb1749776e3798f46eb2b99cd95ed56a) - thanks @​renovate[bot]!
• fix(playwright): match config files with .cjs, .cts and .mts extensions (#1919) (1c1073a1817fdb3bcd3dc00eda2b1d858e444156) - thanks @​davidpavlovschi!
• Restart VS Code language server process (resolve #1923) (d48eac5a2447567a33e835ce3e1648bf3f4ffb2b)
• Classify built-ins from module specifiers (resolve #1925) (3528c5d0f808b7b2155f69a1f98493ee0e3e06c1)
• Don't turn absolute-path script tokens into entries (resolve #1928) (e5608e77b434145c8dd5c2c2872bfb90ae622ce7)
• Update sponsors data (025884bb53eede041732723197ac0415a1a50f71)
• Update dependencies (d2c0a07c09cea70ab2cae5f97d12da272a6e43e6)

Release 6.31.0

• feat: Add basic support for Marko 6 and 5 (#1914) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks @​caseycarroll!
• Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)
• Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)
• Downgrade @​types/vscode to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)

Release 6.30.0

• docs: migrate to Starlight Blog plugin (#1854) (c89e3e3c9) - thanks @​trueberryless!
• Include workspace dependencies in scoped runs (resolve #1901) (a75309eda)
• Simplify workspace assembly (b3ac16411)
• Document export declaration safety (ef98a7682)
• Read object jsPlugin specifiers from Vite+ config (#1879) (3ea6a92d4) - thanks @​matchai!
• Compile gitignore negations once (6884cdb20)
• Cache Node test script detection (d970f67d8)
• Track only enabled workspace plugins (67d48268a)
• Skip unsupported Vite config command (545bb2d36)
• Add SARIF reporter (ce11cf5d4)
• Track catalog refs in pnpm dlx scripts (resolve #1885, close #1886) (102189a1a)
• Report unresolved catalog references (b2b86c3e5)
• Track catalog references across scoped runs (resolve #1905) (f0365bae0)

... (truncated)

Commits

• 196a11a Release knip@6.32.2
• 95f7c52 Update dependencies
• f9c755e Fix Supported lint-staged Configs (#1935)
• 531e2dc Support oxlint.config.mts (#1934)
• 7959001 Support oxfmt.config.mts (#1933)
• 437b608 Release knip@6.32.1
• 2febefe Fix type-check against typescript@5.0.4
• 982c1d8 Handle referenced config files in their own plugin (resolve #1931, close #1932)
• f21bcbb Release knip@6.32.0
• d2c0a07 Update dependencies
• Additional commits viewable in compare view

Updates marked from 18.0.7 to 18.0.10

Release notes

Sourced from marked's releases.

v18.0.10

18.0.10 (2026-08-18)

Bug Fixes

• keep the em/strong mask the same length as the source (#4044) (681373c)
• parse EOF backtick fences after paragraphs (#4039) (81bd750)
• place task checkboxes after list loose is finalized (#4046) (b8cf7dc), closes #4045

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

Commits

• 8698d35 chore(release): 18.0.10 [skip ci]
• 58367a5 chore(deps-dev): bump eslint from 10.8.0 to 10.8.1 (#4055)
• a426c4d chore(deps-dev): bump esbuild from 0.28.1 to 0.28.2 (#4056)
• a5cf277 chore(deps-dev): bump highlight.js from 11.11.1 to 11.12.0 (#4057)
• ca00e95 docs: replace nonexistent test:all script with npm test (#4054)
• b8cf7dc fix: place task checkboxes after list loose is finalized (#4046)
• 9552b6b chore(deps-dev): bump semantic-release from 25.0.8 to 25.0.9 (#4049)
• 681373c fix: keep the em/strong mask the same length as the source (#4044)
• 81bd750 fix: parse EOF backtick fences after paragraphs (#4039)
• 2e21cd3 docs: move theme button to menu (#4043)
• Additional commits viewable in compare view

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / unit

The overall line coverage in commit a16c54a in the dependabot/bun/bun-m... branch remains at 87%, unchanged from commit d1b6030 in the main branch.

---

_{Updated August 22, 2026 22:05 UTC}