deps(npm): bump the npm-minor-patch group with 3 updates

[dependabot]

Bumps the npm-minor-patch group with 3 updates: @sinclair/typebox, @biomejs/biome and openclaw.

Updates @sinclair/typebox from 0.34.51 to 0.34.52

Commits

• a6f7d52 Merge commit from fork
• efa1be6 Security
• See full diff in compare view

Updates @biomejs/biome from 2.5.3 to 2.5.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.4

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

What's Changed

• feat(yml/fmt): basic block properties by @​ematipico in biomejs/biome#10873
• feat(useSortedClasses): sort important-suffix classes in sort_v4 by @​johncarmack1984 in biomejs/biome#10880
• fix(format/js): wrap curried test each calls by @​dyc3 in biomejs/biome#10886
• fix(markdown): parse whitespace after list markers by @​tidefield in biomejs/biome#10869
• fix(inference): use correct function when cloning data by @​ematipico in biomejs/biome#10891
• docs(noDuplicateProperties): note that @​keyframes declarations are ignored by @​dfedoryshchev in biomejs/biome#10893
• fix(lint): prevent noCommentText fix from looping forever by @​JamBalaya56562 in biomejs/biome#10842
• fix(core): cleanup old sockets in Unix by @​ematipico in biomejs/biome#10895
• feat(inference): inference engine via salsa by @​ematipico in biomejs/biome#10888
• chore(deps): update dependency @​types/node to v24.13.3 by @​renovate[bot] in biomejs/biome#10920
• chore(deps): update github-actions by @​renovate[bot] in biomejs/biome#10921

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.4

Patch Changes

• #10665 55ff995 Thanks @​dyc3! - Improved the performance of the HTML parser slightly in our synthetic benchmarks.

• #10894 f4fb10e Thanks @​ematipico! - Fixed #6392: On-type formatting no longer moves comments before an if statement into its body.

• #10939 f2799db Thanks @​Netail! - Fixed #10930: noLabelWithoutControl now correctly detects text interpolation in Astro, Svelte & Vue as valid accessible content.

• #10945 ae15d98 Thanks @​Netail! - Fixed #10942: Svelte directives don't throw an accidental debug log anymore.

• #10842 5e1abfe Thanks @​JamBalaya56562! - Fixed #9196: biome check --write --unsafe no longer hangs forever when applying the noCommentText code fix.

  The rule's fix now wraps the comment in a real JSX expression container ({/* comment */}) instead of re-inserting the braces as plain JSX text, so the fixed code is no longer reported again by the same rule.

• #10891 ecca79e Thanks @​ematipico! - Fixed [#10885](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/10885): prevented a module-inference regression introduced by a housekeeping change.

• #10886 60c8043 Thanks @​dyc3! - Fixed #10727: Biome now breaks the arguments of curried test.each, it.each, describe.each, and test.for calls when they exceed the configured line width.

  - test.each([[1, 2]])("a description that is long enough to push the hugged opening line beyond the print width", (a, b) => {
  -   expect(a).toBe(b);
  - });
  + test.each([[1, 2]])(
  +   "a description that is long enough to push the hugged opening line beyond the print width",
  +   (a, b) => {
  +     expect(a).toBe(b);
  +   },
  + );

• #10895 01a85f0 Thanks @​ematipico! - Biome will now remove stale Unix daemon sockets from older Biome versions when starting a newer daemon.

Commits

• bfc3f3d ci: release (#10887)
• See full diff in compare view

Updates openclaw from 2026.6.11 to 2026.7.1

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1

2026.7.1

OpenClaw v2026.7.1 brings major Control UI and onboarding overhauls, major updates to the official iOS, Android, and macOS apps, expanded model and provider support including GPT-5.6 compatibility, Tencent Hy3, and Meta Muse Spark 1.1, and stronger Codex and connected coding-agent workflows. Telegram, Slack, Discord, and Apple Messages each receive substantial updates, while Gateway crash loops, scheduled work, remote browser control, workspace terminals, sessions, and goals also improve. There are also many general fixes and refinements throughout OpenClaw.

Read the full release notes

This release brings together 3,063 contributions from 532 contributors.

Highlights

• Control UI overhaul: conversations are easier to organize and work with side by side, with live Tasks, clearer chat controls, better usage and cost views, files, downloads, pairing, approvals, and Gateway health kept close to the conversation.
• Easier setup from install to first chat: guided setup provides clearer steps toward a working first chat, checks connections before saving them, and preserves earlier choices when setup is interrupted.
• Official app updates: iOS and iPadOS, Android, and macOS received substantial work across setup, navigation, chat, voice, permissions, localization, files, scheduled work, offline reading, queued sends, connection recovery, and native session controls.
• Models and providers: GPT-5.6 compatibility improves across supported OpenAI and Codex routes, Tencent Hy3 gains a complete setup path, Meta Model API adds Muse Spark 1.1, and broader Claude, Ollama, ClawRouter, LongCat, and provider work expands choice and reliability.
• Codex and connected coding agents: openclaw attach gives Claude Code temporary access to a selected session, Codex delegation and native subagents return tracked results more reliably, Copilot gains broader provider choices, and long-running sessions and goals are easier to resume.
• Telegram: live progress, photos and documents, topics, commands, retries, account routing, setup, and delivery all received substantial work.
• Slack: threads, cards, progress, identity, reactions, and duplicate prevention improve, while longer conversations avoid more unnecessary waits.
• Discord: replies, attachments, voice sessions, progress, reconnects, and multi-account behavior improve, with better unread cues and recovery from repeated session-resume failures.
• Apple Messages: replies, typing, media, routing, setup guidance, and chat continuity improve across supported bridge setups.
• Gateway crashes stop restarting forever: repeatedly failing Gateways now leave a stable repair path instead of restarting indefinitely.
• Scheduled work, remote browser control, and workspace terminals: scheduled work can wake only when something changes, selected signed-in browser tabs can pair remotely and save completed downloads safely, and guarded terminals are available across web, iOS, and Android.

Changes

• Channels and messaging: expanded native capabilities, clearer progress and delivery behavior, stronger media handling, and broader controls across Telegram, Slack, Discord, Signal, WhatsApp, Apple Messages, Teams, Matrix, Feishu, and other channels.
• Models and providers: more models can be discovered, selected, authenticated, and used across cloud, managed, and local routes, with clearer reasoning controls and provider-specific setup.
• Memory, sessions, and state: session groups, titles, unread state, checkpoints, context handling, goals, and recovery paths are more consistent across web, mobile, CLI, and connected agents.
• Tools and automation: browser control, downloads, cron jobs, terminals, files, search, fetch, MCP, and background task workflows gain new capabilities and clearer controls.
• Account, device, and data protection: passwords and tokens stay out of more logs, sensitive controls remain limited to approved users, device pairing is clearer, and unsafe downloads, files, and network requests are blocked earlier.
• Plugins and packaging: bundled and external plugins gain improved installation, discovery, updates, compatibility, diagnostics, and distribution behavior.
• CLI, setup, and administration: onboarding, Doctor, updates, configuration, status, diagnostics, node management, backup, and deployment workflows are easier to inspect and recover.

Fixes

• Chat delivery and replies: messages, progress updates, quoted replies, media, and final results stay tied to the intended conversation more reliably across reconnects, restarts, retries, and channel-specific limits.
• Control UI and native apps: fixes cover session state, stale completions, responsive layouts, scrolling, focus, accessibility, localization, pairing, voice, offline chat, and mobile recovery.
• Gateway and provider reliability: startup, restart, migration, authentication, fallback, streaming, model discovery, and oversized-response failures now stop or recover more cleanly.
• Sessions and memory: transcript, compaction, checkpoint, cache, rotation, search, and persistence fixes reduce lost state, stale views, and cross-session confusion.
• Browser, tools, and automation: browser actions, downloads, fetches, searches, scheduled jobs, terminals, subprocesses, and MCP calls now handle cancellation, malformed input, timeouts, and broken streams more safely.
• Setup, updates, and packaging: installers, containers, plugin updates, runtime checks, temporary files, and platform-specific launch paths receive recovery and compatibility fixes.
• Security and credentials: additional hardening protects tokens, secrets, approval scopes, local paths, network destinations, attachments, archives, and untrusted provider or plugin responses.

Pull requests

The expandable groups below list all 2,018 public and credited pull requests represented in these release notes. Direct commits and detailed contributor credits remain available in the full release notes.

... (truncated)

Commits

• 2d2ddc4 fix(codex): update managed app-server to 0.144.3 [AI] (#106098)
• 2b4232e docs(changelog): refresh 2026.7.1 notes
• e0ce125 test(installer): dedupe cleanup coverage
• 5bbf27e fix(installer): clean temporary files on failure (#103725)
• b2569f9 test(daemon): remove stale release mocks
• d57704f docs(changelog): finalize SQLite runtime safety
• 28db140 fix(installer): validate upgraded Windows SQLite runtime
• c86285f fix(sqlite): reject runtimes vulnerable to WAL corruption (#106065)
• 3010140 docs(changelog): finalize 2026.7.1 stable notes
• 970bbc7 chore(release): prepare 2026.7.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates dependency versions in package.json to pick up the latest tooling and runtime library patches.

Changes:

• Bump @biomejs/biome from ^2.5.3 to ^2.5.4
• Bump openclaw from 2026.6.11 to 2026.7.1
• Bump @sinclair/typebox from ^0.34.51 to ^0.34.52

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jeremy]

@dependabot recreate

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.