chore(deps): bump the patch-and-minor group across 1 directory with 4 updates

[dependabot]

Bumps the patch-and-minor group with 4 updates in the / directory: dompurify, joi, stripe and @biomejs/biome.

Updates dompurify from 3.4.13 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates joi from 18.2.3 to 18.2.5

Commits

• 58ce83e 18.2.5
• 120672d Merge pull request #3131 from Hashim1999164/fix/email-allow-underscore
• 5bd73b8 fix: allow allowUnderscore option on string().email()
• 2b4f443 Merge pull request #3138 from hapijs/fix/messages-proto-injection
• 90d0757 fix: prevent messages proto injection
• 82ff29f Merge pull request #3136 from hapijs/chore/improve-unique-documentation
• ad308cc chore: improve unique documentation
• ea3e156 18.2.4
• 262c4f1 Merge pull request #3134 from hapijs/fix/rename-proto
• 162f367 fix: prevent proto on renames
• See full diff in compare view

Updates stripe from 22.4.0 to 22.5.0

Release notes

Sourced from stripe's releases.

v22.5.0

• #2805 Emit Claude Code plugin hint at module load time

  • Emits new Claude Code plugin hint when CLAUDECODE or CLAUDE_CODE_CHILD_SESSION environment variables are detected.

• #2794 add/adjust event parsing helpers

  • Added methods that return their respective Event/EventNotification objects without verifying authenticity. Use them when you've previously verified an event (e.g. you verified, put the event in a queue, and are now processing). Supports events from AWS EventBridge and Azure Event Grid natively.
    • stripe.webhooks.constructEventWithoutVerification(payload)
    • stripe.constructEventWithoutVerification(payload)
    • stripe.parseEventNotificationWithoutVerification(payload)

• #2799 Add stripe.major_api_version constant

See the changelog for more details.

v22.5.0-beta.1

This release changes the pinned API version to 2026-07-29.preview.

• #2772 Update generated code for beta
  • Add support for list and retrieve methods on resource ProductCatalog.TrialOffer
  • Add support for tax_items on ChargeCaptureParams.payment_details.car_rental_data[].total.tax, ChargeCaptureParams.payment_details.flight_data[].total.tax, ChargeCaptureParams.payment_details.lodging_data[].total.tax, ChargeUpdateParams.payment_details.car_rental_data[].total.tax, ChargeUpdateParams.payment_details.flight_data[].total.tax, ChargeUpdateParams.payment_details.lodging_data[].total.tax, PaymentIntent.payment_details.car_rental_data[].total.tax, PaymentIntent.payment_details.flight_data[].total.tax, PaymentIntent.payment_details.lodging_data[].total.tax, PaymentIntentCaptureParams.payment_details.car_rental_data[].total.tax, PaymentIntentCaptureParams.payment_details.flight_data[].total.tax, PaymentIntentCaptureParams.payment_details.lodging_data[].total.tax, PaymentIntentConfirmParams.payment_details.car_rental_data[].total.tax, PaymentIntentConfirmParams.payment_details.flight_data[].total.tax, PaymentIntentConfirmParams.payment_details.lodging_data[].total.tax, PaymentIntentCreateParams.payment_details.car_rental_data[].total.tax, PaymentIntentCreateParams.payment_details.flight_data[].total.tax, PaymentIntentCreateParams.payment_details.lodging_data[].total.tax, PaymentIntentUpdateParams.payment_details.car_rental_data[].total.tax, PaymentIntentUpdateParams.payment_details.flight_data[].total.tax, and PaymentIntentUpdateParams.payment_details.lodging_data[].total.tax
  • ⚠️ Remove support for taxes on ChargeCaptureParams.payment_details.car_rental_data[].total.tax, ChargeCaptureParams.payment_details.flight_data[].total.tax, ChargeCaptureParams.payment_details.lodging_data[].total.tax, ChargeUpdateParams.payment_details.car_rental_data[].total.tax, ChargeUpdateParams.payment_details.flight_data[].total.tax, ChargeUpdateParams.payment_details.lodging_data[].total.tax, PaymentIntent.payment_details.car_rental_data[].total.tax, PaymentIntent.payment_details.flight_data[].total.tax, PaymentIntent.payment_details.lodging_data[].total.tax, PaymentIntentCaptureParams.payment_details.car_rental_data[].total.tax, PaymentIntentCaptureParams.payment_details.flight_data[].total.tax, PaymentIntentCaptureParams.payment_details.lodging_data[].total.tax, PaymentIntentConfirmParams.payment_details.car_rental_data[].total.tax, PaymentIntentConfirmParams.payment_details.flight_data[].total.tax, PaymentIntentConfirmParams.payment_details.lodging_data[].total.tax, PaymentIntentCreateParams.payment_details.car_rental_data[].total.tax, PaymentIntentCreateParams.payment_details.flight_data[].total.tax, PaymentIntentCreateParams.payment_details.lodging_data[].total.tax, PaymentIntentUpdateParams.payment_details.car_rental_data[].total.tax, PaymentIntentUpdateParams.payment_details.flight_data[].total.tax, and PaymentIntentUpdateParams.payment_details.lodging_data[].total.tax
  • Add support for tax_id on Checkout.Session.collected_information
  • ⚠️ Remove support for tax_ids on Checkout.Session.collected_information
  • Add support for new value disabled on enum FinancialConnections.SessionCreateParams.manual_entry.mode
  • Add support for mode on FinancialConnections.Session.manual_entry
  • Add support for name on Issuing.CardholderUpdateParams
  • Add support for new value ic_nif on enums OrderCreateParams.tax_details.tax_ids[].type and OrderUpdateParams.tax_details.tax_ids[].type
  • ⚠️ Add support for new value ic_nif on enums Order.tax_details.tax_ids[].type and QuotePreviewInvoice.customer_tax_ids[].type
  • Add support for new values alipay and mb_way on enum QuotePreviewInvoice.payment_settings.payment_method_types
  • Add support for custom_fields, description, and footer on QuotePreviewSubscriptionSchedule.default_settings.invoice_settings and QuotePreviewSubscriptionSchedule.phases[].invoice_settings
  • Add support for trial on QuotePreviewSubscriptionSchedule.phases[]
  • ⚠️ Remove support for acss_debit, afterpay_clearpay, alipay, alma, amazon_pay, au_becs_debit, bacs_debit, bancontact, billie, bizum, blik, boleto, card_present, cashapp, crypto, customer_balance, eps, fpx, giropay, gopay, grabpay, id_bank_transfer, ideal, interac_present, kakao_pay, konbini, kr_card, mb_way, mobilepay, multibanco, naver_pay, nz_bank_account, oxxo, p24, pay_by_bank, payco, paynow, paypal, paypay, payto, pix, promptpay, qris, rechnung, revolut_pay, samsung_pay, satispay, scalapay, sepa_debit, shopeepay, sofort, stripe_balance, sunbit, swish, twint, upi, us_bank_account, wechat_pay, and zip on SharedPayment.GrantedToken.payment_method_details
  • ⚠️ Remove support for values acss_debit, afterpay_clearpay, alipay, alma, amazon_pay, au_becs_debit, bacs_debit, bancontact, billie, bizum, blik, boleto, card_present, cashapp, crypto, custom, customer_balance, eps, fpx, giropay, gopay, grabpay, id_bank_transfer, ideal, interac_present, kakao_pay, konbini, kr_card, mb_way, mobilepay, multibanco, naver_pay, nz_bank_account, oxxo, p24, pay_by_bank, payco, paynow, paypal, paypay, payto, pix, promptpay, qris, rechnung, revolut_pay, samsung_pay, satispay, scalapay, sepa_debit, shopeepay, sofort, stripe_balance, sunbit, swish, twint, upi, us_bank_account, wechat_pay, and zip from enum SharedPayment.GrantedToken.payment_method_details.type
  • Add support for use_stripe_sdk on SharedPayment.IssuedTokenCreateParams and SharedPayment.IssuedToken
  • Add support for redirect_to_url on SharedPayment.IssuedToken.next_action
  • ⚠️ Change type of SharedPayment.IssuedToken.next_action.type from literal('use_stripe_sdk') to enum('redirect_to_url'|'use_stripe_sdk')
  • Add support for livemode on Tax.Location
  • Add support for source on V2.Iam.ActivityLog.details.user_roles
  • Add support for payout on V2.MoneyManagement.ReceivedCredit.balance_transfer
  • ⚠️ Remove support for payout_v1 on V2.MoneyManagement.ReceivedCredit.balance_transfer
  • Add support for new value payout on enum V2.MoneyManagement.ReceivedCredit.balance_transfer.type
  • ⚠️ Change V2.MoneyManagement.ReceivedDebit.bank_transfer.us_bank_account to be optional
  • Add support for error codes us_bank_account_microdeposits_cannot_be_confirmed and us_bank_account_microdeposits_cannot_be_sent on ControlledByAlternateResourceError

See the changelog for more details.

v22.5.0-alpha.2

• #2797 Update generated code for private-preview
  • Add support for new resource Billing.FeedbackOptions
  • Add support for sequra_payments on Account.capabilities
  • Add support for feedback_options on BillingPortal.Configuration.features.subscription_cancel.cancellation_reason

... (truncated)

Changelog

Sourced from stripe's changelog.

22.5.0 - 2026-08-10

• #2805 Emit Claude Code plugin hint at module load time

  • Emits new Claude Code plugin hint when CLAUDECODE or CLAUDE_CODE_CHILD_SESSION environment variables are detected.

• #2794 add/adjust event parsing helpers

  • Added methods that return their respective Event/EventNotification objects without verifying authenticity. Use them when you've previously verified an event (e.g. you verified, put the event in a queue, and are now processing). Supports events from AWS EventBridge and Azure Event Grid natively.
    • stripe.webhooks.constructEventWithoutVerification(payload)
    • stripe.constructEventWithoutVerification(payload)
    • stripe.parseEventNotificationWithoutVerification(payload)

• #2799 Add stripe.major_api_version constant

Commits

• 65d99a2 Bump version to 22.5.0
• 3616934 add event notif object tests (#2806)
• 8c2584b Bump @​babel/core from 7.19.6 to 7.29.7 (#2759)
• 85e59b8 Implement extensibility platform (#2785)
• 2ca69d8 Emit Claude Code plugin hint at module load time (#2805)
• 09f0f06 add/adjust event parsing helpers (#2794)
• 2fd7147 Add stripe.major_api_version constant (#2799)
• 89b3541 Update changelog with open enum (#2802)
• See full diff in compare view

Updates @biomejs/biome from 2.5.8 to 2.5.9

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.9

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.9

Patch Changes

• #11321 41386f3 Thanks @​dyc3! - Fixed #11315: The CSS parser now recovers at declaration boundaries after bogus declarations, allowing subsequent valid declarations to be parsed.

• #11248 57b197e Thanks @​yanthomasdev! - Expanded the environment variable metadata used by biome rage to include BIOME_BINARY, BIOME_LOG_FILE, and RUST_BACKTRACE as well as reworded explanations for better readability.

• #11377 a8798ea Thanks @​Netail! - Added a new nursery rule useNamedLayer which disallows anonymous cascade layers.

  @layer {
    a {
      color: red;
    }
  }

• #11327 6771cf5 Thanks @​dyc3! - The HTML formatter now preserves meaningful blank lines in HTML, including spacing after elements with trailing spaces and blank lines between comment groups.

   <div>
     <!-- first group -->
  +
     <!-- second group -->
   </div>

• #10312 ba8aa18 Thanks @​dyc3! - Added the nursery rule useTailwindShorthandClasses, which suggests shorter Tailwind utility classes. For example, the rule suggests replacing w-4 h-4 with size-4.

• #11333 715e0cd Thanks @​kkkhs! - Fixed #11328: lint/nursery/useExpect now recognizes Vitest Browser Mode expect.element() calls as assertions.

• #11343 9b98211 Thanks @​johncarmack1984! - Fixed #11311: the CSS parser now accepts Tailwind container-query variant names in @variant, such as @xl and @max-xl. These previously produced a parse error and a noUnknownAtRules diagnostic.

  @variant @xl {
    div {
      background: red;
    }
  }

• #11220 3e8c488 Thanks @​santichausis! - Fixed #9541: noUndeclaredVariables, noUnusedImports, and noUnusedVariables now correctly recognise exported variables and functions declared in one embedded <script> block as usable from a sibling <script> block, in Svelte's <script module>/<script> pair and Vue's non-setup <script> blocks.

  For example, Biome no longer reports greet as undeclared in the following Svelte component:

  <script module>
    export function greet() {
      console.log("Hello!");

... (truncated)

Commits

• 2081460 ci: release (#11309)
• 6559e6c feat: adds the useAstroClientOnlyDirectiveValue rule for .astro files (#11299)
• a8798ea feat: useNamedLayer (#11377)
• 85aac73 feat(lint): add noUnsafeTypeAssertion rule (#11221)
• e65f07e feat(lint): nursery useControlLabel (#11312)
• ba8aa18 feat(lint): add useTailwindShorthandClasses (#10312)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions