chore(deps-dev): bump the npm-minor-patch group with 2 updates

[dependabot]

Bumps the npm-minor-patch group with 2 updates: @anthropic-ai/claude-code and @biomejs/biome.

Updates @anthropic-ai/claude-code from 2.1.220 to 2.1.221

Release notes

Sourced from @​anthropic-ai/claude-code's releases.

v2.1.221

What's changed

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
• Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions
• Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
• Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
• Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
• Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
• Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete
• Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
• Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
• Changed plugins to accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed /status to show the session kind: interactive, or a background job that is attached or unattended
• Changed emoji autocomplete to accept common alternate shortcodes like :thumbsup:, :thumbsdown:, and :love:
• Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
• Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
• Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
• Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
• Changed the Gateway model field validation: non-string values are rejected with a 400 instead of being forwarded
• Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

Changelog

Sourced from @​anthropic-ai/claude-code's changelog.

2.1.221

• [VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
• Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
• Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
• Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
• Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
• Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
• Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
• Fixed @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
• Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
• Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
• Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
• Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume; falsy values are now honored
• Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
• Fixed renaming a session from Claude Code Desktop or claude.ai not updating the CLI's session name; session names from every rename surface are now sanitized
• Fixed plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions
• Fixed the "Plugins changed" notification lingering after plugins were reloaded instead of clearing
• Fixed Vim mode: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied
• Fixed Vim mode: undoing back to an empty prompt now arms the "press ← again" confirm before returning to the agent view
• Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
• Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
• Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
• Improved /ultrareview error messages when a repo shares no history with its base: a checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete
• Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
• Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
• Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
• Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
• Changed plugins to accept "." as a skills path, and the root-level SKILL.md validation error now suggests using the plugin root
• Changed /status to show the session kind: interactive, or a background job that is attached or unattended
• Changed emoji autocomplete to accept common alternate shortcodes like :thumbsup:, :thumbsdown:, and :love:
• Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
• Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
• Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
• Changed Monitor: a watch that exits without producing any output now says so instead of reporting "stream ended"
• Changed the Gateway model field validation: non-string values are rejected with a 400 instead of being forwarded
• Removed the repeated "Permission mode changed while the auto-mode classifier call was queued" notice from approval prompts

Commits

• dd79613 chore: Update CHANGELOG.md and feed.xml
• See full diff in compare view

Updates @biomejs/biome from 2.5.5 to 2.5.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.6

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.6

Patch Changes

• #11035 0e4b03b Thanks @​ematipico! - Fixed a performance regression in noMisusedPromises that caused type inference to run repeatedly while linting a file.

• #11043 22ec076 Thanks @​denbezrukov! - Fixed CSS formatting for multiline function arguments preceded by comments:

   .example {
     value: outer(
       1,
       /* comment */
       nested(
  -      first,
  -      second
  -    )
  +        first,
  +        second
  +      )
     );
   }

• #11007 c9acb25 Thanks @​BTF-Kabir-2020! - Fixed #9195: useHookAtTopLevel no longer reports hooks in named forwardRef components that receive a ref parameter.

• #10152 50a9bd8 Thanks @​Zelys-DFKH! - Fixed #10131: Biome now correctly parses curried arrow functions in ternary consequents when the inner arrow's parameters use a destructuring pattern, e.g. cond ? (x) => ({ a, b }) => body : alt.

• #11105 8ffe2b9 Thanks @​dadavidtseng! - Fixed #11092: The noUselessTernary quick fix now preserves operator spacing when simplifying or inverting boolean ternary expressions.

• #10533 5809875 Thanks @​Mokto! - Fixed #10515: biome check --write was not idempotent on Svelte files — multi-line template literals in <script> blocks and block comments in <style> blocks gained an extra indent level on every run.

• #11040 0abb620 Thanks @​Mokto! - Fixed an issue where the HTML formatter would duplicate a comment placed directly before a Svelte {@const ...} or {@debug ...} block. The duplication compounded on every subsequent --write, causing the file to grow exponentially.

• #10858 6d18204 Thanks @​ruidosujeira! - Fixed #10839: Svelte {#each} array destructuring no longer includes spaces inside square brackets, and multiline bind function expressions now indent their getter, setter, and function body correctly.

• #11009 2c36626 Thanks @​ematipico! - Improved the accuracy of type-aware lint rules by resolving more inferred types. For example, noFloatingPromises now detects floating Promises returned by aliased callbacks and arrays of Promises created by async mapping callbacks.

  The following statements are now reported:

  type AsyncCallback = () => Promise<void>;
  declare const callback: AsyncCallback;
  callback();
  [1, 2, 3].map(async (value) => value);

• #10973 9cb044c Thanks @​ematipico! - Fixed false positives in noMisleadingReturnType when generic-constraint, normalization, substitution, or structural return-type comparison cannot complete. The rule now suppresses diagnostics rather than suggesting a return type derived from partial information. For example, this unresolved return type is no longer reported:

... (truncated)

Commits

• 1139f1c ci: release (#11022)
• 781d68d feat(lint/js): add noRestrictedProperties (#9806)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions