deps(deps): bump the all-minor-patch group across 1 directory with 5 updates

[dependabot]

Bumps the all-minor-patch group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.122.0	0.125.0
@contentauth/c2pa-node	0.9.1	0.9.4
cborg	6.1.1	6.1.2
@biomejs/biome	2.5.11	2.5.13
@types/node	22.20.1	22.20.2

Updates @anthropic-ai/sdk from 0.122.0 to 0.125.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.125.0

0.125.0 (2026-09-10)

Full Changelog: sdk-v0.124.0...sdk-v0.125.0

Features

• api: add auto mode tool permissions for Managed Agents (7f5e2c6)
• api: add content_too_large web_fetch tool error code (f06416e)
• api: add the user-profiles-2026-09-04 beta value and external_user_details to user profiles (318d42d)
• api: support mounting public GitHub repositories without an authorization_token in Managed Agents sessions (9e2d945)

Chores

• client: clean up the unused idempotency request option (4ce2772)
• docs: correct the environment scope field description (835c677)
• internal: restore package version (b43a7f6)
• internal: stop stamping the package version into generated files (80ace5e)
• tests: restore empty test package marker files (4f27519)

sdk: v0.124.0

0.124.0 (2026-09-04)

Full Changelog: sdk-v0.123.0...sdk-v0.124.0

Features

• api: add Claude Tag category and user breakdowns to usage reports (669ff22)
• api: add named types for organization compliance settings state (54be8da)
• api: add support for sending a workspace ID on more endpoints (a11e6f1)

Bug Fixes

• repair custom-code merge in messages resources (#455) (7ac43b9)
• tools: create agent-toolset files and directories owner-only (#485) (a9c2298)

Chores

• internal: bundle the mock server spec and update breaking-change detection (8752d02)
• internal: codegen related update (a63afbc)
• tests: reword the skip reason on the path-level query param tests (999bee5)

Documentation

• api: update a few doc strings (2ef3d59)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.125.0 (2026-09-10)

Full Changelog: sdk-v0.124.0...sdk-v0.125.0

Features

• api: add auto mode tool permissions for Managed Agents (7f5e2c6)
• api: add content_too_large web_fetch tool error code (f06416e)
• api: add the user-profiles-2026-09-04 beta value and external_user_details to user profiles (318d42d)
• api: support mounting public GitHub repositories without an authorization_token in Managed Agents sessions (9e2d945)

Chores

• client: clean up the unused idempotency request option (4ce2772)
• docs: correct the environment scope field description (835c677)
• internal: restore package version (b43a7f6)
• internal: stop stamping the package version into generated files (80ace5e)
• tests: restore empty test package marker files (4f27519)

0.124.0 (2026-09-04)

Full Changelog: sdk-v0.123.0...sdk-v0.124.0

Features

• api: add Claude Tag category and user breakdowns to usage reports (669ff22)
• api: add named types for organization compliance settings state (54be8da)
• api: add support for sending a workspace ID on more endpoints (a11e6f1)

Bug Fixes

• repair custom-code merge in messages resources (#455) (7ac43b9)
• tools: create agent-toolset files and directories owner-only (#485) (a9c2298)

Chores

• internal: bundle the mock server spec and update breaking-change detection (8752d02)
• internal: codegen related update (a63afbc)
• tests: reword the skip reason on the path-level query param tests (999bee5)

Documentation

• api: update a few doc strings (2ef3d59)

0.123.0 (2026-09-01)

... (truncated)

Commits

• 135f71e Merge pull request #1184 from anthropics/release-please--branches--main--chan...
• 415537b chore: release main
• 7f5e2c6 feat(api): add auto mode tool permissions for Managed Agents
• 9e2d945 feat(api): support mounting public GitHub repositories without an authorizati...
• 96ecb87 environments: the worker runs on the work item's session token alone when one...
• 318d42d feat(api): add the user-profiles-2026-09-04 beta value and external_user_deta...
• 835c677 chore(docs): correct the environment scope field description
• 4ce2772 chore(client): clean up the unused idempotency request option
• f06416e feat(api): add content_too_large web_fetch tool error code
• b43a7f6 chore(internal): restore package version
• Additional commits viewable in compare view

Updates @contentauth/c2pa-node from 0.9.1 to 0.9.4

Changelog

Sourced from @​contentauth/c2pa-node's changelog.

0.9.4

Patch Changes

• 843c2d0: c2pa-rs version bump to v0.90.20

0.9.3

Patch Changes

• 4abe0a1: Switch fs-extra import from namespace import to default import.

0.9.2

Patch Changes

• afccc92: Update c2pa-rs from 0.90.15->0.90.16
• f9553a7: Remove redundant archive-metadata assertion filtering
• Updated dependencies [afccc92]
  • @​contentauth/c2pa-types@​0.7.4
  • @​contentauth/c2pa-utilities@​0.2.2

Commits

• 2a0d1da chore: version packages (#212)
• a6c835d chore: version packages (#209)
• 4abe0a1 fix(c2pa-node): Switch fs-extra to default import from namespace import (#208)
• 29549b7 chore: version packages (#206)
• f9553a7 fix: Remove redundant archive-metadata assertion filtering (#205)
• See full diff in compare view

Updates cborg from 6.1.1 to 6.1.2

Release notes

Sourced from cborg's releases.

v6.1.2

6.1.2 (2026-08-31)

Bug Fixes

• decode: preserve proto map keys as own properties (#185) (a45b66f)

Changelog

Sourced from cborg's changelog.

6.1.2 (2026-08-31)

Bug Fixes

• decode: preserve proto map keys as own properties (#185) (a45b66f)

Commits

• f4d378b chore(release): 6.1.2 [skip ci]
• a45b66f fix(decode): preserve proto map keys as own properties (#185)
• See full diff in compare view

Updates @biomejs/biome from 2.5.11 to 2.5.13

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.13

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.13

Patch Changes

• #11379 07a0073 Thanks @​Netail! - Added the nursery rule useLayeredStyles, which enforces that style rules are defined within a cascade layer and import rules to import its styles into a cascade layer.

  /* Invalid */
  @import 'foo.css';
  .my-style {
  color: red;
  }
  /* Valid */
  @​import 'foo.css' layer(base);
  @​layer base {
  .my-style {
  color: red;
  }
  }

• #11667 e997900 Thanks @​devtechedge! - Added the nursery rule useBetterDomTraversing, which prefers .firstChild, .firstElementChild, .closest(), and merged .querySelector() calls over positional DOM traversal.

  element.childNodes[0];
  element.children[0];
  element.parentElement.parentElement;
  element.querySelector("a").querySelector("b");

• #11620 20e513a Thanks @​jakeleventhal! - Fixed #11610, #11611, #11612, #11615, and #11616: Biome no longer fully infers an imported generic declaration just to apply its type arguments, restoring type-aware lint performance for large libraries such as Zod. This improves useRegexpExec, noFloatingPromises, noMisusedPromises, useNullishCoalescing, and noUnsafePlusOperands.

• #11657 e322040 Thanks @​ematipico! - Fixed #7495: noUselessConstructor now ignores TypeScript constructors that forward at least one argument to super, preserving constructors that narrow the subclass's accepted parameter types. The exemption also applies when the parent and child signatures are identical; JavaScript and zero-argument forwarding behavior are unchanged.

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7076: useAriaPropsForRole and useFocusableInteractive no longer report non-focusable elements with role="separator". A separator with an explicit tabIndex or tabindex still requires aria-valuenow.

• #11627 23aad6d Thanks @​ematipico! - Fixed #6571 so Grit plugins can capture and inspect multiple named import specifiers.

• #11631 00dbd3a Thanks @​ematipico! - Reduced unnecessary type inference when type-aware lint rules inspect members of namespace imports from libraries such as Zod. Fixed type inference so blanket re-exports do not expose default exports.

• #11628 a2f8ff7 Thanks @​dyc3! - Added the nursery rule noXorAsExponentiation, which reports the bitwise XOR operator ^ between two decimal integer literals, where the exponentiation operator ** was likely intended.

  const kibibyte = 2 ^ 10; // 8, not 1024

• #11670 4969ee1 Thanks @​ematipico! - Fixed #7192: noUnusedPrivateClassMembers now considers compound assignments such as ??= to read and use private class members.

... (truncated)

Commits

• 810ea56 ci: release (#11614)
• e997900 feat(linter): add useBetterDomTraversing nursery rule (#11667)
• de0528f feat(lint/html/svelte): add noSvelteAtHtmlTags (#11606)
• 07a0073 feat(css_analyze): implement useLayeredStyles (#11379)
• c23e4c7 feat: noUnsafeIframeSandbox (#11622)
• a2f8ff7 feat(lint/js): add noXorAsExponentiation (#11628)
• a64d757 feat(lint/js/vue): add useVueBaseImport (#11595)
• 611767f chore: update depot logo (#11602)
• 0a31d7c ci: release (#11530)
• a20f44a feat: noBunModules (#11597)
• Additional commits viewable in compare view

Updates @types/node from 22.20.1 to 22.20.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: automated, dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.