[dependabot]

Bumps the dev-dependencies group with 7 updates in the / directory:

Package	From	To
@biomejs/biome	2.5.15	2.6.2
@modelcontextprotocol/client	2.3.0	2.3.1
@modelcontextprotocol/server	2.3.0	2.3.1
@types/bun	1.4.2	1.4.3
@types/node	26.6.4	26.6.5
lefthook	2.1.16	2.2.2
typescript	6.0.3	7.0.2

Updates @biomejs/biome from 2.5.15 to 2.6.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.6.2

Patch Changes

• #12494 3f40430 Thanks @​ematipico! - Fix another patch

2.6.1

Patch Changes

• #12492 edaa1db Thanks @​ematipico! - Fixes a problem with npm publishing

2.6.0

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },

... (truncated)

Commits

• 0d9aef6 ci: release (#12495)
• 30ffad1 ci: release (#12493)
• 8c814e1 ci: release (#12065)
• e51cec2 chore: update sponsors (#12428)
• cb88f07 feat(lint): add noSvelteClassDirective (#12254)
• 774b5b5 feat: sorted GraphQL documents (#12318)
• 914dca7 feat(lint/js): add noUselessCall (#12082)
• a3fa0d6 feat(graphql_analyze): implement useSortedArguments (#12282)
• 5f8ea6c feat(lint): add noVueLifecycleAfterAwait (#12229)
• b92638b feat(lint): add noVueShadowNativeEvents (#12136)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/client from 2.3.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/client's releases.

@​modelcontextprotocol/client@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• See full diff in compare view

Updates @modelcontextprotocol/server from 2.3.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

• #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

• Updated dependencies []:

  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• See full diff in compare view

Updates @types/bun from 1.4.2 to 1.4.3

Commits

• See full diff in compare view

Updates @types/node from 26.6.4 to 26.6.5

Commits

• See full diff in compare view

Updates lefthook from 2.1.16 to 2.2.2

Release notes

Sourced from lefthook's releases.

v2.2.2

Changelog

• 4aeffd72a6e3ea846c2054cffd6294c943fd7fbb fix: cleanup only current stash hash (#1597)
• db62412c82ddac71cf536e60e50edb2826624870 packaging: add support for android (#1591)
• e3fa81b1f01881829ef95e37211da7923a4fd6df refactor(filter): simplify mimetype matching (#1596)

v2.2.1

Changelog

• 6dd11f61f54595935746f9e0814c16844fc6d31b feat: support php composer (#1583)
• c702ccf154bb180107ba5f790518c161d9ce111d fix: generate different patch names when in a worktree (#1582)
• 486fdd317d29f815821ce2450d42e3a49b066eb0 refactor: cache paths in wrapper (#1570)

v2.2.0

Changelog

• 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
• 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
• 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)

v2.1.17

Changelog

• 8d8073d427fac49cc982919f5280b295645d196d fix: diff push files against the merge base with the default branch (#1565)
• c12bccd193f43a8419038787bd83b12fe3a4470c fix: don't hash submodules when checking fail_on_changes (#1566)
• 03225efde40226b14459e901707fbd988d62fcc0 refactor: naming of helpers (#1568)
• 66746ace996c72ac31b3cb4a70af85607568baf4 refactor: working with git (#1564)

Changelog

Sourced from lefthook's changelog.

2.2.2

• fix: cleanup only current stash hash (#1597) by @​mrexox
• refactor: simplify mimetype matching (#1596) by @​scop
• packaging: add support for android (#1591) by @​mrexox

2.2.1

• feat: support php composer (#1583) by @​mrexox
• fix: generate different patch names when in a worktree (#1582) by @​mrexox
• refactor: cache paths in wrapper (#1570) by @​mrexox

2.2.0

• fix: don't write an install-time lefthook path into AI hook configs (#1544) by @​anandghegde
• docs: publish JSON schema at lefthook.dev/schema.json (#1579) by @​BUTTERFINGERS7498
• fix: pass --output path to git diff as a single argument (#1581) by @​cpruijsen
• fix: ignore trailing NUL in --files-from-stdin (#1574) by @​jasonwbarnett
• deps: October 2026 (#1571) by @​mrexox

2.1.7

• fix: don't hash submodules when checking fail_on_changes (#1566) by @​tiagovilasboas
• refactor: naming of helpers (#1568) by @​mrexox
• fix: diff push files against the merge base with the default branch (#1565) by @​mrexox
• refactor: working with git (#1564) by @​mrexox
• docs: add protect-branch example to docs (#1563) by @​vim89

Commits

• eb4e504 2.2.2: keep backups for worktree flows and release android NPM package
• 4aeffd7 fix: cleanup only current stash hash (#1597)
• e3fa81b refactor(filter): simplify mimetype matching (#1596)
• db62412 packaging: add support for android (#1591)
• 60c1ddd 2.2.1: support concurrent work in worktrees and release PHP package
• 6dd11f6 feat: support php composer (#1583)
• c702ccf fix: generate different patch names when in a worktree (#1582)
• 486fdd3 refactor: cache paths in wrapper (#1570)
• 125cd28 2.2.0: new Go version and git worktree fixes
• 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions