chore(deps): bump the npm-minor-patch group across 1 directory with 64 updates

[dependabot]

Bumps the npm-minor-patch group with 64 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.6	2.5.13
@eslint-sukka/react	9.0.1	9.1.0
@testing-library/react	16.3.2	16.3.3
@testing-library/user-event	14.6.1	14.6.7
eslint	10.9.1	10.10.0
eslint-config-sukka	9.0.1	9.1.0
eslint-formatter-sukka	9.0.1	9.1.0
turbo	2.10.7	2.10.12
better-sqlite3	13.0.2	13.0.3
@better-auth/api-key	1.7.0-rc.2	1.7.4
@better-auth/electron	1.7.0-rc.2	1.7.4
better-auth	1.7.0-rc.2	1.7.4
@electron/asar	4.2.1	4.3.0
@hookform/resolvers	5.5.7	5.9.1
foxact	0.3.10	0.3.11
playwright-core	1.62.0	1.63.0
react-hook-form	7.83.0	7.88.0
yaml	2.9.0	2.9.1
@better-auth/expo	1.7.0-rc.2	1.7.4
heroui-native	1.0.6	1.0.9
lucide-react-native	1.27.0	1.45.0
posthog-react-native	4.60.0	4.71.0
tailwind-merge	3.6.0	3.7.0
tailwind-variants	3.3.0	3.3.1
uniwind	1.10.0	1.12.0
posthog-js	1.407.3	1.430.3
@noble/ed25519	3.0.0	3.2.0
@noble/hashes	2.2.0	2.4.0
smol-toml	1.7.1	1.8.0
p-map	7.0.6	7.0.8
@types/semver	7.7.1	7.8.0
restty	0.2.6	0.3.0
@base-ui/react	1.7.0	1.8.0
@fontsource/noto-emoji	5.3.0	5.3.1
@lexical/react	0.48.0	0.50.0
@lexical/selection	0.48.0	0.50.0
@lexical/utils	0.48.0	0.50.0
@pierre/diffs	1.2.12	1.4.2
@shikijs/core	4.3.1	4.4.3
@shikijs/engine-javascript	4.3.1	4.4.3
@shikijs/langs	4.3.1	4.4.3
@shikijs/themes	4.3.1	4.4.3
dompurify	3.4.12	3.4.15
lexical	0.48.0	0.50.0
lucide-react	1.27.0	1.45.0
pretty-bytes	7.1.1	7.1.3
pretty-ms	9.3.0	9.3.1
remend	1.3.0	1.3.1
streamdown	2.5.0	2.6.0
virtua	0.50.0	0.51.3
@lexical/headless	0.48.0	0.50.0
@iconify-json/material-icon-theme	1.2.69	1.2.70
@iconify-json/simple-icons	1.2.92	1.2.96
@rolldown/plugin-babel	0.2.3	0.2.4
@types/node	26.1.1	26.5.1
@vitejs/plugin-react	6.0.4	6.1.1
react-router	8.3.0	8.3.1
swr	2.4.2	2.5.1
tsx	4.23.1	4.23.13
use-intl	4.13.4	4.14.4
vite	8.1.5	8.3.0
ws	8.21.1	8.21.3
zod	4.4.3	4.6.5
zustand	5.0.14	5.0.15

Updates @biomejs/biome from 2.5.6 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Updates @eslint-sukka/react from 9.0.1 to 9.1.0

Commits

• 943eb32 release: 9.1.0
• 48138d0 chore: housekeeping
• cfc0649 chore: housekeeping
• 01fbfdb chore: housekeeping
• 616ce0c chore: housekeeping
• 99a6b81 refactor: better inline export prefer
• d75f8fc chore: housekeeping
• 6655aff chore: housekeeping
• See full diff in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• See full diff in compare view

Updates @testing-library/user-event from 14.6.1 to 14.6.7

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.7

14.6.7 (2026-09-02)

Bug Fixes

• normalize DataTransfer format aliases (#1326) (1e0020b)
• feature: Add iframe support for user.keyboard typing (#1275) (1e0020b)

v14.6.6

14.6.6 (2026-08-22)

Bug Fixes

• default pointer event pointerType to empty string instead of the string "undefined" (#1325) (71a5475)

v14.6.5

14.6.5 (2026-08-18)

Bug Fixes

• tab retargeting if focus moved during keydown (#1296) (43efda7)

v14.6.4

14.6.4 (2026-08-11)

Bug Fixes

• keyboard event repeat property (#1312) (d7e80e3)

v14.6.3

14.6.3 (2026-08-03)

Bug Fixes

• release: manually release a patch version (#1321) (1d18b1f), closes #1317

v14.6.2

14.6.2 (2026-08-03)

Commits

• 1e0020b fix: normalize DataTransfer format aliases (#1326)
• d4b0593 feature: Add iframe support for user.keyboard typing (#1275)
• 71a5475 fix: default pointer event pointerType to empty string instead of the string ...
• 43efda7 fix: tab retargeting if focus moved during keydown (#1296)
• d7e80e3 fix: keyboard event repeat property (#1312)
• 43d8e6c ci: remove broken npm backfill step (#1322)
• 1d18b1f fix(release): manually release a patch version (#1321)
• 232f3e6 docs: add migration note and clean up README badges (#1320)
• 83e2b22 ci: remove deprecated CodeSandbox CI (#1318)
• e8da819 ci: publish to npm via OIDC trusted publishing (#1317)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/user-event since your current version.

Updates eslint from 10.9.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates eslint-config-sukka from 9.0.1 to 9.1.0

Commits

• 943eb32 release: 9.1.0
• cfc0649 chore: housekeeping
• 01fbfdb chore: housekeeping
• 616ce0c chore: housekeeping
• 99a6b81 refactor: better inline export prefer
• d75f8fc chore: housekeeping
• 6655aff chore: housekeeping
• See full diff in compare view

Updates eslint-formatter-sukka from 9.0.1 to 9.1.0

Commits

• See full diff in compare view

Updates turbo from 2.10.7 to 2.10.12

Release notes

Sourced from turbo's releases.

Turborepo v2.10.12

What's Changed

Changelog

• chore: Release Turborepo 2.10.11 by @​github-actions[bot] in vercel/turborepo#13765
• feat: Refresh documentation social cards by @​christopherkindl in vercel/turborepo#13764
• fix: Preserve showcase logo sizes by @​christopherkindl in vercel/turborepo#13766
• fix: Refine mobile homepage interactions by @​christopherkindl in vercel/turborepo#13767
• fix: Align homepage KPIs to the right by @​christopherkindl in vercel/turborepo#13769
• fix: Prevent homepage KPI overflow by @​christopherkindl in vercel/turborepo#13770
• chore: Update Geistdocs to 1.20.4 by @​molebox in vercel/turborepo#13771
• perf: Skip unused Package Configuration stats by @​vercel-gh-bot-4[bot] in vercel/turborepo#13746
• chore: Update with-solid example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13752
• chore: Update with-tailwind example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13762
• perf: Stream dry-run JSON output by @​vercel-gh-bot-4[bot] in vercel/turborepo#13760
• chore: Update with-ultracite example by @​vercel-gh-bot-5[bot] in vercel/turborepo#13772
• perf: Merge same-prefix tree-wildcard globs into one directory walk by @​vercel-gh-bot-5[bot] in vercel/turborepo#13763
• chore: Update with-svelte example by @​floriansalihovic in vercel/turborepo#13118
• chore: Add unified agent control plane by @​anthonyshew in vercel/turborepo#13757
• fix: Remove incremental task caching by @​anthonyshew in vercel/turborepo#13773
• chore: Rename agents app to factory by @​anthonyshew in vercel/turborepo#13774
• chore: Update oxlint and oxfmt by @​charpeni in vercel/turborepo#13777
• feat: Add security.txt endpoint by @​charpeni in vercel/turborepo#13778
• feat: Redesign factory control plane by @​anthonyshew in vercel/turborepo#13775
• perf: Replace regex captures with hand-written parsers in berry lockfile identifiers by @​vercel-gh-bot-2[bot] in vercel/turborepo#13776
• chore: Upgrade the factory eve agent to 0.39.3 by @​anthonyshew in vercel/turborepo#13783
• chore: Update with-rsbuild-module-federation example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13786
• perf: Index Berry lockfile resolution overrides by dependency name by @​vercel-gh-bot-5[bot] in vercel/turborepo#13787
• chore: Update remote cache action to v1.1.0 by @​anthonyshew in vercel/turborepo#13789
• docs: Fix reference links and validation by @​charpeni in vercel/turborepo#13784
• feat: Add SSH command affordance for factory sandboxes by @​anthonyshew in vercel/turborepo#13779
• fix: Show invalid affected task glob by @​anthonyshew in vercel/turborepo#13793
• perf: Skip unused repository indexing for package listings by @​vercel-gh-bot-4[bot] in vercel/turborepo#13792
• feat: Rebuild the factory image on every merge to main by @​anthonyshew in vercel/turborepo#13781
• chore: Add full-page terminal SSH sessions to Factory sandbox inventory by @​anthonyshew in vercel/turborepo#13780
• chore: Update with-shell-commands example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13791
• chore: Allow SSH terminal for completed-run sandboxes in Factory by @​anthonyshew in vercel/turborepo#13782
• fix: Decouple graceful shutdown tests from the shell commands example by @​anthonyshew in vercel/turborepo#13799
• feat: Start ad-hoc factory work from the operator page by @​anthonyshew in vercel/turborepo#13798
• chore: Update with-solid example by @​vercel-gh-bot-4[bot] in vercel/turborepo#13797
• fix: Rebuild factory images without custom workflows by @​anthonyshew in vercel/turborepo#13801
• feat: Add factory navigation by @​anthonyshew in vercel/turborepo#13802
• refactor: Migrate Factory styles to Tailwind by @​anthonyshew in vercel/turborepo#13803
• feat: Add durable Factory workspaces by @​anthonyshew in vercel/turborepo#13804
• feat: Stream Factory sandbox as terminal by @​anthonyshew in vercel/turborepo#13807
• fix: Restore Factory workspace creation by @​anthonyshew in vercel/turborepo#13812
• fix: Update Factory session network policy by @​anthonyshew in vercel/turborepo#13814
• fix: Improve Factory terminal line spacing by @​anthonyshew in vercel/turborepo#13815
• fix: Install Factory publishing skill by @​anthonyshew in vercel/turborepo#13817

... (truncated)

Commits

• 53752d4 publish 2.10.12 to registry
• 9d2b03b fix: Run pnpm directly on Windows (#13843)
• c97782b feat: Require high confidence for issue fixes (#13842)
• f153cda chore: Alert Slack for low-confidence issues (#13841)
• e1674e4 chore: Add automatic issue handling (#13840)
• 7107f26 fix: Escape ampersands in RSS feed enclosure URLs (#13839)
• a76330b chore: Handle feedback on Factory pull requests (#13836)
• 3787c06 chore: Use geistdocs 1.23.1 (#13834)
• bbe5406 chore: Skip redundant Factory PR approval (#13837)
• 72805d7 fix: Move model selector to workspace creation (#13835)
• Additional commits viewable in compare view

Updates better-sqlite3 from 13.0.2 to 13.0.3

Release notes

Sourced from better-sqlite3's releases.

v13.0.3

What's Changed

• use Ubuntu 22.04-arm by @​neoxpert in WiseLibs/better-sqlite3#1510

Full Changelog: WiseLibs/better-sqlite3@v13.0.2...v13.0.3

Commits

• dbc2ea1 13.0.3
• b872585 use Ubuntu 22.04-arm (#1510)
• See full diff in compare view

Updates @better-auth/api-key from 1.7.0-rc.2 to 1.7.4

Release notes

Sourced from @​better-auth/api-key's releases.

v1.7.4

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
• Added support for additional session fields in testUtils auth helpers. (#11217)
• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore. (#11238)
• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema validation for the Drizzle Relations v2 adapter. (#11213)

For detailed changes, see CHANGELOG

@better-auth/test-utils

Features

• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

Contributors

... (truncated)

Changelog

Sourced from @​better-auth/api-key's changelog.

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.7.0-rc.6

1.7.0-rc.5

1.7.0-rc.4

1.7.0-rc.3

Commits

• 735008f chore: release v1.7.4 (#11216)
• 597d39c chore: release v1.7.3 (#11032)
• c0444dc fix: align OpenAPI required fields with Zod 4.5 (#11066)
• ba12fcd chore: release v1.7.2 (#10870)
• 2344536 chore: release v1.7.1 (#10864)
• f577ec5 chore: exit pre-release mode for v1.7.0
• 69258d1 chore: sync main to next
• e84ec5e chore: release v1.6.30 (#10840)
• bc93b27 chore: release v1.7.0-rc.6 (#10772)
• 58c49eb chore: release v1.6.29 (#10809)
• Additional commits viewable in compare view

Updates @better-auth/electron from 1.7.0-rc.2 to 1.7.4

Release notes

Sourced from @​better-auth/electron's releases.

v1.7.4

better-auth

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)
• Added support for additional session fields in testUtils auth helpers. (#11217)
• Added Vitest 5 support to the testing utilities. (#11205)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added experimental.instrumentation.enabled to disable OpenTelemetry span creation per auth instance. (#11224)

Bug Fixes

• Fixed Metro bundling when the optional OpenTelemetry API is not installed. (#11210)

For detailed changes, see CHANGELOG

@better-auth/expo

Bug Fixes

• Fixed multibyte session data storage in Expo SecureStore. (#11238)
• Fixed stale Expo secure-storage session data and corrupted cookies during concurrent updates. (#11200)

For detailed changes, see CHANGELOG

@better-auth/drizzle-adapter

Bug Fixes

• Improved schema valid...

  Description has been truncated