chore(deps-dev): bump dev-dependencies group (4 updates) — take-over of #689

[coderdan]

Maintainer take-over of Dependabot #689 so the bump runs under the normal Actions CI context.

Why re-author instead of merging #689

Dependabot PRs execute under the Dependabot secret store — a separate, narrower set than the Actions secrets. It carries CS_* but not the identity suites' CLERK_MACHINE_TOKEN, so the lock-context integration suite (deliberately fail-not-skip) throws and the live jobs go red on something the bot can't fix. Re-authoring the same commit on a maintainer branch lets the live suites run with the full secret set.

What's here

Byte-identical to #689's diff, re-based onto current main (the lockfile auto-merged cleanly and pnpm install --frozen-lockfile is green):

• js-yaml 4.2.0 → 4.3.0 (semver-minor)
• @supabase/supabase-js 2.110.1 → 2.110.2 (patch)
• @supabase/postgrest-js 2.110.1 → 2.110.2 (patch)
• @clerk/backend 3.11.2 → 3.11.3 (patch)

Dev-dependency-only; no published surface changes, so no changeset.

Closes #689.

https://claude.ai/code/session_01MxTTPaPP16m6br7Hoab94w

Summary by CodeRabbit

• Chores
  • Updated development tooling to newer Supabase client and PostgREST versions.
  • Updated Clerk backend tooling to the latest patch release.
  • Improved build and test compatibility across related packages.

[changeset-bot]

⚠️ No Changeset found

Latest commit: e12886d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b46289f7-706a-4068-a565-989a967ff886

📥 Commits

Reviewing files that changed from the base of the PR and between a2f80ea and e12886d.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• packages/protect/package.json
• packages/stack-supabase/package.json
• packages/stack/package.json
• packages/test-kit/package.json

---

📝 Walkthrough

Walkthrough

Development dependency versions for Supabase and Clerk are updated across four package manifests.

Changes

Development dependency updates

Layer / File(s)	Summary
Align development dependency versions packages/protect/package.json, packages/stack-supabase/package.json, packages/stack/package.json, packages/test-kit/package.json	Supabase dependencies are updated to 2.110.2, and @clerk/backend is updated to 3.11.3 where configured.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: calvinbrewer

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The reviewed changes update Supabase and Clerk deps, but the required js-yaml bump and lockfile refresh are not evidenced in the reviewed files.	Add the root js-yaml 4.2.0→4.3.0 update and include the refreshed pnpm-lock.yaml in the PR review scope.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the dev-dependency bump and is specific enough, even with the take-over note.
Out of Scope Changes check	✅ Passed	All visible edits are dependency version bumps tied to the stated dev-dependency update, with no unrelated changes shown.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dev-deps-bump-2026-07

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderdan]

Dependabot takeover PR.