deps(deps): bump the all-minor-patch group with 2 updates

[dependabot]

Bumps the all-minor-patch group with 2 updates: @anthropic-ai/sdk and @biomejs/biome.

Updates @anthropic-ai/sdk from 0.117.1 to 0.122.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.122.0

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

sdk: v0.121.0

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

Bug Fixes

• tools: keep the tool runner going on pause_turn (#288) (f040dc9)
• types: don't reference NodeJS.ProcessEnv from published types (#367) (fd38dfd)

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.122.0 (2026-08-27)

Full Changelog: sdk-v0.121.0...sdk-v0.122.0

Features

• api: beta files/skills namespaces use GA shapes; drop dated beta header pins (45d693a)

Bug Fixes

• client: classify cross-realm DOMException abort/timeout errors correctly (1bd6395)
• client: use configured logger for SSE parse errors (80eeaf7)
• sessions: make event accumulator forward-compatible with new event types (#410) (2d084fd)
• tools: let read return a view_range of a file over the size cap (#427) (56b3260)
• uploads: default bare Blob filename on skills endpoints (#422) (e111649)
• webhooks: require headers to be passed to unwrap() (3230804)

Chores

• internal: codegen related update (c2f327a)

Documentation

• api: clarify pagination on the organization rate-limit list endpoints (d6015b9)
• document TypeScript 5.0 as the minimum supported version (788e721)

0.121.0 (2026-08-26)

Full Changelog: sdk-v0.120.0...sdk-v0.121.0

Features

• api: add updates thinking display mode (beta) (22274ea)
• api: add missing anthropic-beta values (0779f02)
• api: add support for Organization API endpoints (8b61e7a)
• helpers: support Standard Schema for structured outputs and tools (7880078)

Bug Fixes

• tools: keep the tool runner going on pause_turn (#288) (f040dc9)
• types: don't reference NodeJS.ProcessEnv from published types (#367) (fd38dfd)

Chores

• docs: clarify skill version latest support and memory version retention (7405a69)

... (truncated)

Commits

• 7f3898c chore: release main
• 956ccb5 docs(api): clarify pagination on the organization rate-limit list endpoints
• 2131d80 fix(tools): let read return a view_range of a file over the size cap (#427)
• f830c8f fix(aws,bedrock): prefer env credentials over AWS_PROFILE (#436)
• 4d50ddf test(ecosystem): expect cross-realm timeout errors to classify correctly
• acdd669 fix(client): classify cross-realm DOMException abort/timeout errors correctly
• 0a14622 test(tools): pin that read, edit and the memory tool preserve CRLF and CR lin...
• 17035de docs: document TypeScript 5.0 as the minimum supported version
• 2f95d8a fix(client): use configured logger for SSE parse errors
• 33f5103 feat(api): beta files/skills namespaces use GA shapes; drop dated beta header...
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.9 to 2.5.11

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.11

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.11

Patch Changes

• #11499 9743d0c Thanks @​scs0209! - Fixed #11496: useValidAnchor now treats Astro JSX shorthand attributes like <a {href}> as a valid href.

• #11437 88f805e Thanks @​Princesseuh! - Fixed #9944: adjacent elements inside an Astro expression now parse as an implicit fragment instead of raising an error.

  {options.map(() =>
    <div />
    <div />
  )}

• #11437 88f805e Thanks @​Princesseuh! - Fixed Astro templates rejecting unclosed HTML void elements, such as {cond && <br>}.

• #11507 e2fc036 Thanks @​dyc3! - Fixed #11157: noUnusedVariables no longer reports Vue <script setup> bindings used by CSS v-bind() as unused.

• #11398 afc4615 Thanks @​dyc3! - Fixed #11389: Files passed through --stdin-file-path now use full HTML support for Astro, Svelte, and Vue when it is enabled.

• #11526 372cd68 Thanks @​dyc3! - Fixed noVueRefAsOperand to track Vue refs through declaration aliases and toRefs() properties, and to recognize useTemplateRef() results. The rule no longer reports false positives such as plain ref transfers, plain toRefs() property access, defineModel() modifiers, or the supported .effect member as operands.

  The refactor enabling these fixes also improves the performance of the rule.

• #11458 a7cd286 Thanks @​dyc3! - Fixed #11436: GritQL snippets such as export { $specifiers } from $source now match named re-exports with aliases, inline type modifiers, and multiple specifiers.

• #11515 382b15d Thanks @​dyc3! - Fixed #11390, where noFloatingPromises performed expensive full type inference for calls to non-Promise methods declared on third-party TypeScript classes. The rule now classifies those calls using targeted type information.

• #11516 6f40e82 Thanks @​levrik! - Fixed noVueRefAsOperand so it no longer reports a callback parameter (e.g. from .find(), .map()) as an unwrapped ref value just because it's nested inside a ref(), computed(), or similar call.

  const result = computed(() => list.find((item) => item.label === "a"));

  Previously, item here was incorrectly treated as a ref value because the rule attributed it to the outer computed() call.

• #11495 496268d Thanks @​Netail! - Fixed useGraphqlNamingConvention so it no longer reports GraphQL enum value definitions with comments & descriptions and now displays a more accurate diagnostic range.

• #11407 6ef52b0 Thanks @​1678092075! - Fixed #11214: noUnusedVariables no longer reports type parameters declared by non-default function overload signatures that have an implementation.

• #11322 5c353e6 Thanks @​jp-knj! - Added a new nursery rule noAstroSetHtmlDirective, which disallows Astro's set:html directive because untrusted content can introduce cross-site scripting vulnerabilities.

  For example, the following snippet triggers the rule:

  <div set:html={content} />

• #11462 18883b7 Thanks @​dyc3! - Fixed #10776: useVueHyphenatedAttributes no longer reports lowercase attribute names containing punctuation, such as pt:header:data-test-id and some_attr.

... (truncated)

Commits

• 4d9c1d5 ci: release (#11457)
• 18883b7 fix(html): ignore punctuation in Vue attribute casing (#11462)
• 5c353e6 feat: adds the noAstroSetHtmlDirective rule for .astro (#11322)
• 3e5367f feat(lint): rule noUndeclaredCustomProperties (#11191)
• 05797b1 ci: release (#11450)
• 5f1ed34 chore: add CodSpeed and Cloudflare to sponsors (#11410)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.