Skip to content

Bump the minor-and-patch group with 18 updates - #21

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-f1bc80b543
Closed

Bump the minor-and-patch group with 18 updates#21
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/dev/minor-and-patch-f1bc80b543

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 25, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 18 updates:

Package From To
@tinytars/vault 0.1.36 0.1.37
pdfjs-dist 6.3.289 6.4.299
svelte 5.57.1 5.57.2
svelte-check 4.7.6 4.7.7
vite 8.3.0 8.3.5
vitest 5.0.1 5.0.5
@pablotech/akesi 0.1.58 0.1.70
@pablotech/neuro 0.1.58 0.1.70
@simplewebauthn/server 14.0.2 14.0.3
@axe-core/playwright 4.13.0 4.14.0
@playwright/test 1.63.0 1.64.1
@sveltejs/vite-plugin-svelte 7.3.0 7.3.1
@types/node 26.6.2 26.6.5
@vitest/coverage-v8 5.0.1 5.0.5
jsdom 30.1.0 30.1.3
oxlint 1.83.0 1.89.0
playwright 1.63.0 1.64.1
wrangler 4.135.0 4.151.3

Updates @tinytars/vault from 0.1.36 to 0.1.37

Release notes

Sourced from @​tinytars/vault's releases.

v0.1.37

What's Changed

Full Changelog: tinytars/vault@v0.1.36...v0.1.37

Commits
  • 5042dad chore(release): v0.1.37 [skip ci]
  • 4a29830 Wire the shared commit guards in, since nothing has stopped an oversized blob...
  • See full diff in compare view

Updates pdfjs-dist from 6.3.289 to 6.4.299

Release notes

Sourced from pdfjs-dist's releases.

v6.4.299

This release contains improvements for annotation rendering, font conversion, form handling, pattern rendering, performance, text selection and the viewer.

Changes since v6.3.289

... (truncated)

Commits
  • d0991a0 Merge pull request #22064 from Snuffleupagus/_requestChunks-avoid-pointless-r...
  • d7e7101 Merge pull request #22062 from timvandermeij/updates
  • bcf8943 Avoid creating a pointless requestId in the `ChunkedStreamManager.prototype...
  • d03359c Merge pull request #22061 from Snuffleupagus/SupportedImageMimeTypes-Set
  • 76f6eb6 Fix vulnerability in the fast-uri dependency
  • e987c74 Upgrade eslint-plugin-unicorn to version 77.0.0
  • bf5f6ea Upgrade eslint-plugin-jsdoc to version 65.0.2
  • 7dc3cf0 Update dependencies to the most recent versions
  • e9d1c85 Merge pull request #22041 from calixteman/sampled-fn-arity
  • c67fe15 Check shading function dimensions and bound sampled interpolation
  • Additional commits viewable in compare view

Updates svelte from 5.57.1 to 5.57.2

Release notes

Sourced from svelte's releases.

svelte@5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

  • fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

  • fix: read batch-local array on each-block commit (#18879)

  • fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

  • fix: error when using let: directives on a component with a children snippet (#18873)

  • fix: ignore stale boundary reset callbacks (#18886)

  • fix: handle deferred transitions aborted before initialization (#18776)

  • fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

  • fix: preserve dynamic element connections during hydration (#18855)

Changelog

Sourced from svelte's changelog.

5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

  • fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

  • fix: read batch-local array on each-block commit (#18879)

  • fix: error at compile time when a declaration in a snippet redeclares one of its parameters (#18842)

  • fix: error when using let: directives on a component with a children snippet (#18873)

  • fix: ignore stale boundary reset callbacks (#18886)

  • fix: handle deferred transitions aborted before initialization (#18776)

  • fix: prevent hydration mismatch recovery from being intercepted by error boundaries (#18841)

  • fix: preserve dynamic element connections during hydration (#18855)

Commits
  • 10fdca7 Version Packages (#18858)
  • c580b38 fix: prevent duplicate derived subscriptions on reconnect (#18899)
  • 3f885e3 fix: don't throw state_unsafe_mutation when the focused element is removed wi...
  • fe4fb46 fix: error if {:else} is followed by another {:else} or {:else if ...} ...
  • 179f66b fix: don't create async deriveds for a component destroyed while waiting for ...
  • 79a0c0d fix: attach event handlers that are assigned after a top-level await in pro...
  • 14136f8 fix: print {#await} blocks that only have a pending branch (#18908)
  • 5cbdd34 fix: recover when an unexpected node replaces a nested boundary comment (#18925)
  • 7e83327 fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)
  • 020242d fix: ensure hydration state restoration for custom element attribute updates ...
  • Additional commits viewable in compare view

Updates svelte-check from 4.7.6 to 4.7.7

Release notes

Sourced from svelte-check's releases.

svelte-check@4.7.7

Patch Changes

  • fix: recognise modern CSS properties such as corner-shape by updating vscode-css-languageservice (#3122)

  • fix: recognise the real <script> and <style> start tags when a matching token also appears inside the other tag (#3079)

  • fix: resolve symlinked packages when importing their .svelte files, so their types are not duplicated (#3119)

  • fix: align default tsconfig "include" logic with tsc/tsserver (#3110)

  • fix: report a failed TypeScript compiler process and exit non-zero when a run fails (#3133)

  • fix: ignore the .svelte-check cache directory in --watch with --tsgo / --incremental (#3128)

  • fix: check all files with --tsgo / --incremental when the tsconfig has no include (#3138)

  • fix: disallow --tsgo together with --tsgo-experimental-api (#3128)

  • fix: type elements from Svelte's svelte-html.d.ts with --tsgo / --incremental, like the language server (#3141)

Commits
  • b1ab063 Version Packages (#3107)
  • 3f734db fix: config discovery under dot directories (#3121)
  • 2a80d78 fix: check all files with --tsgo / --incremental when tsconfig has no include...
  • 297b9e0 fix: type elements from svelte-html.d.ts with --tsgo / --incremental (#3141)
  • 2394f19 fix: don't hide $props's type argument error (#3126)
  • e549d19 fix(syntax): don't let comments inside \<template> swallow the file (#3137)
  • af7c6a5 fix: report a failed TypeScript compiler process instead of a clean run (#3133)
  • abaa1ee fix: ignore svelte-check cache directory in watch mode with --tsgo / --increm...
  • 1d367d0 fix: ignore noEmitOnError and isolatedDeclarations in emitDts (#3129)
  • 565abf9 Recognise modern CSS properties in svelte check (#3122)
  • Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

  • build: handle missing chunk import maps (#23777) (8d7623d)
  • build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
  • bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
  • bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
  • bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
  • bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
  • bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
  • bundled-dev: normalize served output files (#23684) (df4e02c)
  • bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
  • css: don't fail on a literal % in url() (#23676) (50b382d)
  • deps: update all non-major dependencies (#23731) (cf80aa5)
  • deps: update all non-major dependencies (#23826) (77d8373)
  • deps: update rolldown-related dependencies (#23733) (43f0d05)
  • deps: update rolldown-related dependencies (#23827) (c2e0418)
  • optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
  • optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
  • optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
  • optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
  • resolve: support subpath imports with multiple # (#23631) (0d86b34)
  • resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
  • server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
  • server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

  • ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

Code Refactoring

  • deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
  • dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
  • dev: separate import resolution from URL conversion (#23791) (6116689)
  • dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
  • dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

  • bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

... (truncated)

Commits
  • 981f07f release: v8.3.5 (#23856)
  • 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
  • 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
  • 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
  • 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
  • 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
  • df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
  • a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
  • 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
  • 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
  • Additional commits viewable in compare view

Updates vitest from 5.0.1 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

@dependabot
Bump the minor-and-patch group with 18 updates
0d41c5b 
Bumps the minor-and-patch group with 18 updates:

| Package | From | To |
| --- | --- | --- |
| [@tinytars/vault](https://github.com/tinytars/vault) | `0.1.36` | `0.1.37` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `6.3.289` | `6.4.299` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.1` | `5.57.2` |
| [svelte-check](https://github.com/sveltejs/language-tools) | `4.7.6` | `4.7.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.5` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` |
| [@pablotech/akesi](https://github.com/pablo-tech/pilos/tree/HEAD/akesi-pil) | `0.1.58` | `0.1.70` |
| [@pablotech/neuro](https://github.com/pablo-tech/pilos/tree/HEAD/neuro-pil) | `0.1.58` | `0.1.70` |
| [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `14.0.2` | `14.0.3` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) | `7.3.0` | `7.3.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.2` | `26.6.5` |
| [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `5.0.1` | `5.0.5` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.1.0` | `30.1.3` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.83.0` | `1.89.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.135.0` | `4.151.3` |


Updates `@tinytars/vault` from 0.1.36 to 0.1.37
- [Release notes](https://github.com/tinytars/vault/releases)
- [Changelog](https://github.com/tinytars/vault/blob/main/CHANGELOG.md)
- [Commits](tinytars/vault@v0.1.36...v0.1.37)

Updates `pdfjs-dist` from 6.3.289 to 6.4.299
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v6.3.289...v6.4.299)

Updates `svelte` from 5.57.1 to 5.57.2
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.2/packages/svelte)

Updates `svelte-check` from 4.7.6 to 4.7.7
- [Release notes](https://github.com/sveltejs/language-tools/releases)
- [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.6...svelte-check@4.7.7)

Updates `vite` from 8.3.0 to 8.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.5/packages/vite)

Updates `vitest` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

Updates `@pablotech/akesi` from 0.1.58 to 0.1.70
- [Release notes](https://github.com/pablo-tech/pilos/releases)
- [Changelog](https://github.com/pablo-tech/pilos/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pablo-tech/pilos/commits/v0.1.70/akesi-pil)

Updates `@pablotech/neuro` from 0.1.58 to 0.1.70
- [Release notes](https://github.com/pablo-tech/pilos/releases)
- [Changelog](https://github.com/pablo-tech/pilos/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pablo-tech/pilos/commits/v0.1.70/neuro-pil)

Updates `@simplewebauthn/server` from 14.0.2 to 14.0.3
- [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases)
- [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md)
- [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v14.0.3/packages/server)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@sveltejs/vite-plugin-svelte` from 7.3.0 to 7.3.1
- [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases)
- [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@7.3.1/packages/vite-plugin-svelte)

Updates `@types/node` from 26.6.2 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@vitest/coverage-v8` from 5.0.1 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `jsdom` from 30.1.0 to 30.1.3
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.1.0...v30.1.3)

Updates `oxlint` from 1.83.0 to 1.89.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint)

Updates `playwright` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `wrangler` from 4.135.0 to 4.151.3
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.151.3/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@tinytars/vault"
  dependency-version: 0.1.37
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pdfjs-dist
  dependency-version: 6.4.299
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: svelte
  dependency-version: 5.57.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: svelte-check
  dependency-version: 4.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@pablotech/akesi"
  dependency-version: 0.1.70
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@pablotech/neuro"
  dependency-version: 0.1.70
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@simplewebauthn/server"
  dependency-version: 14.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@sveltejs/vite-plugin-svelte"
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: jsdom
  dependency-version: 30.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.89.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: wrangler
  dependency-version: 4.151.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot requested a review from pablo-tech as a code owner October 25, 2026 01:15
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying health-dash-dev with  Cloudflare Pages  Cloudflare Pages

Latest commit: 0d41c5b
Status: ✅  Deploy successful!
Preview URL: https://1d2443ea.health-dash-aex.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-dev-vvvg.health-dash-aex.pages.dev

View logs

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 25, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 25, 2026

Copy link
Copy Markdown

Deploying health-dash-main with  Cloudflare Pages  Cloudflare Pages

Latest commit: 0d41c5b
Status: ✅  Deploy successful!
Preview URL: https://53780099.health-dash-prod.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-dev-o678.health-dash-prod.pages.dev

View logs

@pedalion-ci

pedalion-ci Bot commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Autopilot could not repair this bump (NEEDS-HUMAN). The agent ran out of turns before reaching a verdict.

@pablo-tech pablo-tech mentioned this pull request Oct 25, 2026
Merged
@pablo-tech

pablo-tech commented Oct 25, 2026

Copy link
Copy Markdown
Contributor

Superseded by #24, which takes this batch together with #22. Neither could land alone: this one passed test but failed the app's type-check in twenty places, and #22 failed npm ci at install. #24 carries all of this branch's bumps plus the three breaking migrations they imply, with svelte-check deliberately held at ^4.4.8 — no published version accepts this repo's TypeScript ~7.0.2.

@pablo-tech pablo-tech closed this Oct 25, 2026
@pablo-tech pablo-tech mentioned this pull request Oct 25, 2026
Closed
pedalion-ci Bot pushed a commit that referenced this pull request Oct 25, 2026
@pablo-tech Pablo Rodriguez @claude
Take #21 and #22 together, through three breaking migrations (#24)
dd43056 
* Take #21 and #22 together, through three breaking migrations

Dependabot opened the SDK major and the minor-and-patch batch as two pull
requests, and neither could land on its own: #22 failed `npm ci` at install
because its lockfile predates the override this change removes, and #21 passed
`test` while failing the app's type-check in twenty places. Both are the same
work seen twice, so they are taken as one.

Three migrations are bundled inside them, each established from the installed
packages rather than inferred:

@anthropic-ai/sdk 0.127.0 -> 1.3.0 admitted a system-role turn into
`MessageParam`, made `Usage`'s counts optional, and removed `temperature` and
`top_p` outright. akesi 0.1.70 moved the domain-free half of its benchmark
harness out to @promontory-studio/dokimasia and declares no SDK peer at all.

So the app names akesi's port where it talks to the port, which it already did
in three files and now does in nine. `src/lib/model-port.ts` is the one home
for the two statements this app makes beyond what the port states: a request's
turns are user and assistant only, which is narrowing to what is actually sent
rather than widening the port — `validateMessages` refuses a system turn from
the browser and the system prompt rides in the request's own `system` field —
and a stream event's text delta, read in one place by both the streaming route
and the adapter test.

The nullable token counts collapse to `tokenUsage` in `functions/_lib/log.ts`,
beside the non-nullable type it feeds and following that file's own rule about
`latencyMs`: an omitted count is honest, a 0 is a measurement that never
happened. `leaf-regen-anthropic.ts` is the one exception and says why — an
accumulator cannot omit, so it adds nothing and that is what the provider
reported.

Three dependency decisions, none of them a bump:

- The root `overrides` pin on @anthropic-ai/sdk is removed. `tsconfig.app.json`
  recorded why it existed — to satisfy akesi's optional SDK peer range, which
  made npm lay down a second copy that TS treats as a distinct nominal type —
  and akesi 0.1.70 declares no such peer, so the accommodation has no subject.
  Measured after removal: one copy, at 1.3.0. Both tsconfigs' `paths` entries
  existed only to undo it and go with it.
- @promontory-studio/dokimasia ^0.3.4 is added as a devDependency of
  apps/lexitar, because akesi moved the probe loop, the budget, the scoring and
  the statistics there and consumes it as an optional peer.
- svelte-check is held at ^4.4.8 rather than bumped to 4.7.7. No published
  version accepts this repo's TypeScript: 4.4.8 declares `typescript >=5.0.0`,
  4.7.7 declares `^5.0.0 || ^6.0.0`, and the repo pins ~7.0.2.

Gates: `check` clean on both halves, 4310 tests green under Miniflare and again
under the filesystem backend, `lint` clean, and packages/frame's own typecheck
and 87 tests green.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Declare the coverage provider at the root, where vitest can resolve it

The lexitar job failed on `npm run coverage` with

  Cannot find package '@vitest/coverage-v8' imported from
  node_modules/vitest/dist/chunks/coverage.cTDc4uSS.js

and the cause is a placement, not a version. vitest loads the provider by a
dynamic import from its own installed location, so Node walks up from
node_modules/vitest/ — and a copy at apps/lexitar/node_modules/ is not on that
path however the command is invoked. Running it from the workspace directory
makes no difference, which is why this reproduced locally with the same message.

coverage-v8 5.0.1 happened to hoist because its obug range matched what
@sveltejs/vite-plugin-svelte already pulled to the root; 5.0.5 needs obug 3 and
so takes a private copy, which drags the provider down with it. Declaring the
provider where its consumer lives decides the placement outright instead of
leaving it to a transitive range — the app still has no direct import of it, and
`vitest run --coverage` in the workspace resolves it from the root as designed.

Measured on a clean install: 348 files / 4310 tests pass under coverage, and the
same suite passes on both backends; svelte-check reads 0 errors over 1719 files
and packages/frame 0 over 436.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(lexitar): name the chart toggle for what it expands, and record axe 4.14's new rule

The dependency bumps moved axe-core 4.13.0 -> 4.14.0, and the markers view went
from 1 violation to 2 on markup this branch does not touch. An A/B on one
unchanged tree settles that: 4.13.0 reads color-contrast x48 and nothing else,
4.14.0 reads color-contrast x41 plus label-content-name-mismatch x7.

The seven nodes are the .mc-figure-toggle buttons, and chasing the rule found a
real defect underneath it that no engine reported. The button's bare aria-label
REPLACED the inner <svg role="img">'s own for name computation, so the marker's
latest value, status and date were announced nowhere: a screen-reader user on
the Markers page heard "Expand details for ApoB, button" and no reading.
chartLabel is now part of the button's name, which is the fix worth having.

It does not clear the rule, and nothing written there could. A live DOM read of
the first toggle returns the plot's axis ticks - "Jan", "Apr", "60.0", "90.0" -
as the button's visible text, with axe still reporting the mismatch even under
role="presentation" aria-hidden="true", so WCAG 2.5.3 as 4.14 implements it
asks a chart-inside-a-button's accessible name to contain its tick marks.
Marking the svg presentational was measured (still 7) and reverted, having
bought nothing. So the markers notch goes 1 -> 2 with that measurement written
beside it, which is the escape the spec's own docblock provides and the same
posture it already takes toward color-contrast x41.

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Signed-off-by: Pablo Rodriguez <contact@promontory.studio>
Co-authored-by: Pablo Rodriguez <contact@promontory.studio>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pablo-tech pablo-tech Awaiting requested review from pablo-tech pablo-tech is a code owner

Assignees

No one assigned

Labels

autopilot:needs-human dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pablo-tech