build(deps-dev): bump the npm-development-minor-patch group with 4 updates by dependabot[bot] · Pull Request #492 · chhoumann/PodNotes

dependabot · 2026-10-15T12:23:35Z

Bumps the npm-development-minor-patch group with 4 updates: acorn, svelte, vite and yaml.

Updates acorn from 8.18.0 to 8.19.0

Commits

0e0ece7 Mark version 8.19.0
c912cf2 Disallow additional subscripts before arrow in async arrow functions
f180fd7 Add Unicode v18 support (#1458)
ab47d42 Update test case for unexpected identifier character (#1456)
f53ee5f Add a contributing.md file
5bd50cd Compare expression end instead of identity in parseSubscripts
efd7a21 Delete trailing space
e79ec9e Adjust dubious handling of doubleProto tracking in parseMaybeAssign
93e8b90 Upgrade some dependencies with known issues
f065b20 Upgrade github actions to get rid of warning
Additional commits viewable in compare view

Updates svelte from 5.57.1 to 5.57.2

Release notes

svelte@5.57.2

Patch Changes

fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

fix: restore hydration state when custom element attribute updates throw (#18467)

fix: attach event handlers that are assigned after a top-level await in production (#18933)

fix: flush anything pending before invoking flushSync callback function (#18878)

fix: preserve location information for await wrappers (#18859)

fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

fix: print {#await} blocks that only have a pending branch (#18908)

fix: don't warn about a redundant link role on <area> elements without an href (#18872)

fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

fix: read batch-local array on each-block commit (#18879)

fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

fix: error when using let: directives on a component with a children snippet (#18873)

fix: ignore stale boundary reset callbacks (#18886)

fix: handle deferred transitions aborted before initialization (#18776)

fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

fix: preserve dynamic element connections during hydration (#18855)

Changelog

Sourced from svelte's changelog.

5.57.2

Patch Changes

fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

fix: restore hydration state when custom element attribute updates throw (#18467)

fix: attach event handlers that are assigned after a top-level await in production (#18933)

fix: flush anything pending before invoking flushSync callback function (#18878)

fix: preserve location information for await wrappers (#18859)

fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

fix: print {#await} blocks that only have a pending branch (#18908)

fix: don't warn about a redundant link role on <area> elements without an href (#18872)

fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

fix: read batch-local array on each-block commit (#18879)

fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

fix: error when using let: directives on a component with a children snippet (#18873)

fix: ignore stale boundary reset callbacks (#18886)

fix: handle deferred transitions aborted before initialization (#18776)

fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

fix: preserve dynamic element connections during hydration (#18855)

Commits

10fdca7 Version Packages (#18858)
c580b38 fix: prevent duplicate derived subscriptions on reconnect (#18899)
3f885e3 fix: don't throw state_unsafe_mutation when the focused element is removed wi...
fe4fb46 fix: error if {:else} is followed by another {:else} or {:else if ...} ...
179f66b fix: don't create async deriveds for a component destroyed while waiting for ...
79a0c0d fix: attach event handlers that are assigned after a top-level await in pro...
14136f8 fix: print {#await} blocks that only have a pending branch (#18908)
5cbdd34 fix: recover when an unexpected node replaces a nested boundary comment (#18925)
7e83327 fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)
020242d fix: ensure hydration state restoration for custom element attribute updates ...
Additional commits viewable in compare view

Updates vite from 8.3.2 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Commits

b6c20f6 release: v8.3.4 (#23702)
b28db28 fix(server): match static aliases on path boundaries (#23643)
bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
facc2fb fix: remove input option unescaping for now (#23694)
70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
Additional commits viewable in compare view

Updates yaml from 2.8.4 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

Limit recursive merge aliases (#685, #713)

Simplify line unfolding during quoted string parsing (#714)

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

fix: Avoid calling Array.prototype.push.apply() with large source array

fix(lexer): Avoid recursive calls that may exhaust the call stack

Commits

1440ecd 2.9.1
c699bc5 fix: Simplify line unfolding during quoted string parsing (#714)
d11ce77 fix: Limit recursive merge aliases (#713)
c5f49f4 chore: Update docs-slate
ddb21b0 2.9.0
167365b docs: Clarify that not all errors can be avoided
6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the npm-development-minor-patch group with 4 updates: [acorn](https://github.com/acornjs/acorn), [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte), [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) and [yaml](https://github.com/eemeli/yaml). Updates `acorn` from 8.18.0 to 8.19.0 - [Commits](acornjs/acorn@8.18.0...8.19.0) Updates `svelte` from 5.57.1 to 5.57.2 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.2/packages/svelte) Updates `vite` from 8.3.2 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `yaml` from 2.8.4 to 2.9.1 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.4...v2.9.1) --- updated-dependencies: - dependency-name: acorn dependency-version: 8.19.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-development-minor-patch - dependency-name: svelte dependency-version: 5.57.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-development-minor-patch - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-development-minor-patch - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-development-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-10-15T12:23:38Z

Deploying podnotes with Cloudflare Pages

Latest commit:	`2784fa5`
Status:	✅ Deploy successful!
Preview URL:	https://4f2a48a9.podnotes.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-npm-1qrp.podnotes.pages.dev

View logs

cursor

Approved. This is a scoped build(deps-dev) group bump (package.json + lockfile only) and will not cut a plugin release.

Updates

acorn 8.18.0 → 8.19.0 — used only by scripts/syntax-floor.ts (parse at ecmaVersion: 2020). Unicode 18 and async-arrow subscript fixes do not change that floor.
svelte 5.57.1 → 5.57.2 — compile/runtime patch fixes. New compile errors ({:else} after {:else}, snippet parameter redeclaration, let: on a component with a children snippet) do not fire here; svelte-check is clean.
vite 8.3.2 → 8.3.4 — patch HMR/dev/preload/CSS fixes. Production build still emits one CJS main.js.
yaml 2.8.4 → 2.9.1 — used only by the Obsidian test mock (parse(text, {})). 2.9.0 documents that parseDocument/parseAllDocuments may throw on malicious input; 2.9.1 limits recursive merge aliases. Neither affects this mock surface.

Verification (Node 22.23.3, npm ci)

Lockfile not rewritten; npm audit and npm audit --omit=dev are both 0
lint, format:check, typecheck, build, check:a11y, test:unit (126 files / 2757 tests), test:tooling (35 tests) passed
Bundle size: 320617 raw / 102843 gzip level 9 (157 bytes under the 103000 budget)
GitHub required checks: Test, Docs, Validate PR title, Dependency Review green; CodeQL neutral/skip. macOS Platforms passed. Cloudflare Pages green.

No runtime plugin API change. Squash-merging.

_{Sent by Cursor Automation: Dependabot PRs}

dependabot Bot requested a review from chhoumann as a code owner October 15, 2026 12:23

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 15, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Oct 15, 2026

cursor Bot approved these changes Oct 15, 2026

View reviewed changes

cursor Bot merged commit 36f8a91 into master Oct 15, 2026
13 checks passed

cursor Bot deleted the dependabot/npm_and_yarn/npm-development-minor-patch-64f9c2f054 branch October 15, 2026 12:26

chhoumann mentioned this pull request Oct 15, 2026

fix(capture): end a detached table cell before writing #494

Merged

Navigation Menu

Repository navigation

build(deps-dev): bump the npm-development-minor-patch group with 4 updates - #492

build(deps-dev): bump the npm-development-minor-patch group with 4 updates#492
cursor[bot] merged 1 commit into
masterfrom
dependabot/npm_and_yarn/npm-development-minor-patch-64f9c2f054

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026

svelte@5.57.2

Patch Changes

5.57.2

Patch Changes

v8.3.4

Features

Bug Fixes

Performance Improvements

Code Refactoring

v8.3.3

Bug Fixes

8.3.4 (2026-10-08)

Features

Bug Fixes

Performance Improvements

Code Refactoring

8.3.3 (2026-10-06)

Bug Fixes

v2.9.1

v2.9.0

Uh oh!

cloudflare-workers-and-pages Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying podnotes with Cloudflare Pages

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

cloudflare-workers-and-pages Bot commented Oct 15, 2026 •

edited

Loading