[dependabot]

Bumps the all-minor-patch group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.125.0	0.137.0
@contentauth/c2pa-node	0.9.4	0.9.10
cborg	6.1.2	6.1.4
@biomejs/biome	2.5.13	2.6.2
@types/node	22.20.2	22.20.5

Updates @anthropic-ai/sdk from 0.125.0 to 0.137.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v0.137.0

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner
• tests: make credential tests independent of the caller's environment

sdk-v0.136.0

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• tools: accept every tool definition field in the tool helpers

Bug Fixes

• client: treat x-amz-security-token as a sensitive header
• tools: keep $ sequences literal in memory tool str_replace

Chores

• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions
• internal: bump playwright-core in the browser ecosystem tests
• tests: cover OpenTelemetry failures, propagation and environment variables

sdk-v0.135.0

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

• client: close streams dropped without being read to the end
• client: keep an unread JSONL response open while it is held

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.137.0 (2026-10-20)

Features

• api: add org webhook endpoints and user profile enforcement events

Chores

• ci: run the changelog check on a standard runner
• tests: make credential tests independent of the caller's environment

0.136.0 (2026-10-20)

Features

• api: add data_refreshed_at and has_more to analytics report pages
• api: add workspace rate-limit updates to the Admin API
• api: make User Profiles generally available
• client: yield server-sent events with unrecognized event names
• tools: accept every tool definition field in the tool helpers

Bug Fixes

• client: treat x-amz-security-token as a sensitive header
• tools: keep $ sequences literal in memory tool str_replace

Chores

• ci: skip the changelog check on draft pull requests
• docs: add credential expiry descriptions to the Managed Agents API reference
• docs: add Messages API request descriptions
• docs: correct plugin manifest_version and reach descriptions
• docs: improve Managed Agents memory store descriptions
• docs: improve Managed Agents vault and credential descriptions
• internal: bump playwright-core in the browser ecosystem tests
• tests: cover OpenTelemetry failures, propagation and environment variables

0.135.0 (2026-10-15)

Features

• api: add between_tools to thinking types in model capabilities
• api: add the speed parameter and usage.speed to Messages
• api: return a Console organization's usage-tier spend cap as a read-only spend limit

Bug Fixes

... (truncated)

Commits

• 9c65624 release: 0.137.0
• 04151db Merge pull request #970 from anthropics/synced/published
• 5aae8ce feat(api): add org webhook endpoints and user profile enforcement events
• 261ead0 codegen metadata
• 20d7c14 codegen metadata
• a7736e6 chore(ci): run the changelog check on a standard runner
• 48ecaa4 Merge branch 'main'
• accbdd8 release: packages/aws-sdk 0.9.0, packages/bedrock-sdk 0.36.0, packages/vertex...
• b00aefc Merge pull request #968 from anthropics/synced/published
• 521ffc1 Merge branch 'main'
• Additional commits viewable in compare view

Updates @contentauth/c2pa-node from 0.9.4 to 0.9.10

Changelog

Sourced from @​contentauth/c2pa-node's changelog.

0.9.10

Patch Changes

• 29520c7: Update to c2pa-rs v0.91.3.
• Updated dependencies [29520c7]
  • @​contentauth/c2pa-utilities@​0.3.2
  • @​contentauth/c2pa-types@​0.7.6

0.9.9

Patch Changes

• e29811b: Add ability to modify assertions
• a0057f8: Update to Trustmark version 0.4.0.
• b862120: Bump Trustmark crate dependency to v0.3.0 for c2pa-node.

0.9.8

Patch Changes

• e454a78: Update to c2pa-rs v0.91.0.
• abe6b75: Support optional (empty) mime types for Readers. Prefer supplying the mime type explicitly whenever it's known — omitting it falls back to slower, less reliable byte-based format detection in the native library.
• f5141d9: Fix typings errors and avoid potential udnerflow
• Updated dependencies [e454a78]
  • @​contentauth/c2pa-utilities@​0.3.1
  • @​contentauth/c2pa-types@​0.7.5

0.9.7

Patch Changes

• c0aa55c: Add credential holder for CAWG to c2pa-web. Swap c2pa_cbor for ciborium in c2pa-node.

0.9.6

Patch Changes

• 4aa0a07: Use Context as the new way to construct and configure Reader and Builder objects. Deprecate Settings-based workflows.
• Updated dependencies [92a1619]
  • @​contentauth/c2pa-utilities@​0.3.0

0.9.5

Patch Changes

• 8d8536f: c2pa-rs version bump to v0.90.22

Commits

• 20531aa chore: version packages (#241)
• edb68d8 chore: version packages (#232)
• a0057f8 fix: Switch to Trustmark v0.4.0 (#233)
• e29811b feat: Add assertion updates to Node and Web (#229)
• b862120 chore(c2pa-node): Bump Trustmark dependency to v0.3.0 (#231)
• 598bd8c chore: version packages (#226)
• e454a78 Bump c2pa-rs to 0.91.0 (#217)
• abe6b75 feat: Add support for optional (empty) MIME types for Readers (#227)
• f5141d9 fix: Add missing types/bindings/override in identity flows (#225)
• 38cf9cd chore: version packages (#221)
• Additional commits viewable in compare view

Updates cborg from 6.1.2 to 6.1.4

Release notes

Sourced from cborg's releases.

v6.1.4

6.1.4 (2026-10-19)

Trivial Changes

• deps: bump actions/setup-node from 7.0.0 to 7.1.0 (#204) (e9dc43f)

v6.1.3

6.1.3 (2026-10-01)

Trivial Changes

• deps-dev: bump mocha from 11.8.0 to 12.0.2 (#200) (1f0925d)

Changelog

Sourced from cborg's changelog.

6.1.4 (2026-10-19)

Trivial Changes

• deps: bump actions/setup-node from 7.0.0 to 7.1.0 (#204) (e9dc43f)

6.1.3 (2026-10-01)

Trivial Changes

• deps-dev: bump mocha from 11.8.0 to 12.0.2 (#200) (1f0925d)

Commits

• b09b2a6 chore(release): 6.1.4 [skip ci]
• e9dc43f chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 (#204)
• 863741d chore(release): 6.1.3 [skip ci]
• 1f0925d chore(deps-dev): bump mocha from 11.8.0 to 12.0.2 (#200)
• See full diff in compare view

Updates @biomejs/biome from 2.5.13 to 2.6.2

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.2

2.6.2

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },
      { "path": "local-plugin.grit" }
    ]
  }

  Use resolutionKind: "config" to resolve the plugin from the configuration file that declares it. Use resolutionKind: "project" to resolve the plugin from the consuming project. When omitted, resolutionKind defaults to project. This only affects plugin resolution; includes still apply to end-user project files as usual.

• #11432 4befd08 Thanks @​ematipico! - Added biome inspect config to show resolved configuration values and their origins as human-readable diagnostics, including matching overrides.

  Configuration files can also extend other configurations up to ten levels deep. Repeated references to the same resolved file are ignored with an information diagnostic, while resolving multiple versions of one extended package produces an error.

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.6.2

Patch Changes

• #12494 3f40430 Thanks @​ematipico! - Fix another patch

2.6.1

Patch Changes

• #12492 edaa1db Thanks @​ematipico! - Fixes a problem with npm publishing

2.6.0

Minor Changes

• #11479 5c60ba8 Thanks @​nhedger! - Added a --git flag to biome init. The flag enables Git VCS integration and sets vcs.useIgnoreFile to true in the generated configuration, even when the command runs outside a Git repository.

• #11742 3a1356d Thanks @​Netail! - Added the biome migrate stylelint command. It imports a Stylelint configuration and its ignore settings into your Biome configuration, mapping Stylelint rules to their Biome equivalents. Pass --write to apply the changes, and --include-inspired or --include-nursery to migrate additional rules.

• #12318 774b5b5 Thanks @​Netail! - Added the new assist action useGraphqlSortedDefinitions, which sorts the named definitions of a GraphQL document, such as types, type extensions, directives, fragments, and operations.

  Invalid:

  type User {
    id: ID!
  }
  enum Role {
  ADMIN
  USER
  }
  directive @​auth on FIELD_DEFINITION

• #6886 3479d15 Thanks @​christymcgrory! - biome rage now shows the resolved files.includes and files.ignoreUnknown configuration.

• #11102 0874b7f Thanks @​gameroman! - Added support for useTailwindSortedClasses rule in HTML-ish files.

• #10711 40de5a0 Thanks @​soconnor-seeq! - Adds a new resolutionKind option for object-syntax plugin entries.

  This allows shared Biome configs in monorepos to load local Grit plugins from the package that declares them instead of resolving plugin paths from the consuming project.

  {
    "plugins": [
      { "path": "./grit/no-debugger.grit", "resolutionKind": "config" },
      { "path": "local-plugin.grit", "resolutionKind": "project" },

... (truncated)

Commits

• 0d9aef6 ci: release (#12495)
• 30ffad1 ci: release (#12493)
• 8c814e1 ci: release (#12065)
• e51cec2 chore: update sponsors (#12428)
• cb88f07 feat(lint): add noSvelteClassDirective (#12254)
• 774b5b5 feat: sorted GraphQL documents (#12318)
• 914dca7 feat(lint/js): add noUselessCall (#12082)
• a3fa0d6 feat(graphql_analyze): implement useSortedArguments (#12282)
• 5f8ea6c feat(lint): add noVueLifecycleAfterAwait (#12229)
• b92638b feat(lint): add noVueShadowNativeEvents (#12136)
• Additional commits viewable in compare view

Updates @types/node from 22.20.2 to 22.20.5

Commits

• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: automated, dependencies, javascript. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.