Skip to content

chore(deps-dev): bump the npm group in /web with 11 updates - #131

Merged
jolars merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/npm-22ffae7ea3
Nov 5, 2026
Merged

chore(deps-dev): bump the npm group in /web with 11 updates#131
jolars merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/npm-22ffae7ea3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm group in /web with 11 updates:

Package From To
@iconify-json/lucide 1.2.147 1.2.150
@iconify-json/simple-icons 1.2.100 1.2.101
@sveltejs/adapter-static 4.0.0 4.0.1
@sveltejs/kit 3.1.0 3.1.1
@types/node 26.6.5 26.6.6
parse5 8.0.1 8.1.0
shiki 4.5.0 4.6.0
svelte 5.57.2 5.57.3
svelte-check 4.7.7 4.7.8
tslib 2.8.1 2.9.1
wrangler 4.152.0 4.156.1

Updates @iconify-json/lucide from 1.2.147 to 1.2.150

Commits

Updates @iconify-json/simple-icons from 1.2.100 to 1.2.101

Commits

Updates @sveltejs/adapter-static from 4.0.0 to 4.0.1

Release notes

Sourced from @​sveltejs/adapter-static's releases.

@​sveltejs/adapter-static@​4.0.1

Patch Changes

  • fix: escape prerendered paths used in Vercel route patterns (8a81718)
  • Updated dependencies:
    • @​sveltejs/kit@​3.1.1
Changelog

Sourced from @​sveltejs/adapter-static's changelog.

4.0.1

Patch Changes

  • fix: escape prerendered paths used in Vercel route patterns (8a81718)
  • Updated dependencies:
    • @​sveltejs/kit@​3.1.1
Commits
  • 3d85a7a Version Packages
  • 8a81718 fix: escape prerendered paths used in Vercel route patterns
  • 242149e chore: install kit and the adapter into the adapter test apps like a real pro...
  • See full diff in compare view

Updates @sveltejs/kit from 3.1.0 to 3.1.1

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​3.1.1

Patch Changes

  • fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

  • fix: restore function snapshots on reload when SSR is disabled (#17477)

  • fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

  • fix: reuse the original fetch across dev server reloads (#17548)

  • fix: avoid adding a file watcher while loading src/env (#17502)

  • fix: parse remote form submissions in linear time (d593e7e)

  • fix: prevent server-side route resolution from loading code from another origin for pathnames starting with // (dd63fd1)

  • fix: preserve service worker sourcemaps when injecting env (#17566)

  • fix: prevent server-only modules from being imported into browser code via src/params.js (ae07803)

  • fix: avoid injecting a non-serializable TypeScript config callback by default (#17512)

  • fix: report actionable errors for remote modules in server-only locations (#17567)

Changelog

Sourced from @​sveltejs/kit's changelog.

3.1.1

Patch Changes

  • fix: return a 400 response instead of throwing when reroute rewrites a malformed pathname (1d21a3b)

  • fix: restore function snapshots on reload when SSR is disabled (#17477)

  • fix: prevent separate non-exported query.batch functions from sharing a batch (3529813)

  • fix: reuse the original fetch across dev server reloads (#17548)

  • fix: avoid adding a file watcher while loading src/env (#17502)

  • fix: parse remote form submissions in linear time (d593e7e)

  • fix: prevent server-side route resolution from loading code from another origin for pathnames starting with // (dd63fd1)

  • fix: preserve service worker sourcemaps when injecting env (#17566)

  • fix: prevent server-only modules from being imported into browser code via src/params.js (ae07803)

  • fix: avoid injecting a non-serializable TypeScript config callback by default (#17512)

  • fix: report actionable errors for remote modules in server-only locations (#17567)

Commits
  • 3d85a7a Version Packages
  • 9ed55b4 only treat params as a client entrypoint with client-side route resolution
  • ae07803 fix: prevent server-only modules from being imported into browser code via sr...
  • a8f7c1e Merge commit from fork
  • 7993d5e Merge commit from fork
  • 24d8ee4 Merge commit from fork
  • 2c190fe Merge commit from fork
  • 8503225 Merge pull request #17548 from sachinkr7368/fix/dev-fetch-wrapper-leak
  • a2fa1c0 Merge pull request #17566 from CNSeniorious000/fix/service-worker-sourcemap
  • b378468 test: check service worker sourcemaps in options-3
  • Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

Updates parse5 from 8.0.1 to 8.1.0

Release notes

Sourced from parse5's releases.

v8.1.0

What's Changed

... (truncated)

Commits
  • e99029b chore: v8.1.0 (#1909)
  • fc2cae8 fix: end attribute names when missing whitespace (#1908)
  • 8402e10 chore(deps-dev): bump typescript-eslint from 8.72.0 to 8.72.1 (#1907)
  • f228044 chore: add me to funding (#1906)
  • 6899ecc chore: update dependabot workflow (#1905)
  • be16d3e fix(deps): update entities to 9.0.0, which escapes < and > in attribute value...
  • 581da76 chore: use tinybench for benchmarks (#1900)
  • e32b1b0 perf(tokenizer): append attribute values and character runs as slices of the ...
  • 25fe482 chore(deps): bump the codeql group with 2 updates (#1898)
  • f557b5f chore(deps-dev): bump typescript-eslint from 8.71.2 to 8.72.0 (#1896)
  • Additional commits viewable in compare view

Updates shiki from 4.5.0 to 4.6.0

Release notes

Sourced from shiki's releases.

v4.6.0

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub
Commits

Updates svelte from 5.57.2 to 5.57.3

Release notes

Sourced from svelte's releases.

svelte@5.57.3

Patch Changes

  • fix: use the first valid fallback role in role for a11y checks (#19045)

  • chore: remove obsolete code (#19051)

  • fix: keep creating state sources for property checks during component init (#18949)

  • fix: skip redundant attribute writes during hydration (#18869)

  • fix: track missing state property checks in unowned deriveds (#18944)

  • fix: devalue link in hydratable_serialization_failed error (#18999)

Changelog

Sourced from svelte's changelog.

5.57.3

Patch Changes

  • fix: use the first valid fallback role in role for a11y checks (#19045)

  • chore: remove obsolete code (#19051)

  • fix: keep creating state sources for property checks during component init (#18949)

  • fix: skip redundant attribute writes during hydration (#18869)

  • fix: track missing state property checks in unowned deriveds (#18944)

  • fix: devalue link in hydratable_serialization_failed error (#18999)

Commits

Updates svelte-check from 4.7.7 to 4.7.8

Release notes

Sourced from svelte-check's releases.

svelte-check@4.7.8

Patch Changes

  • Preserve TypeScript files listed in tsconfig.json when running with --tsgo. (#3146)

  • fix: update --tsgo-experimental-api for typescript 7.1 (#3168)

  • Report a tsconfig parse error instead of an internal error on --incremental and --tsgo runs when the tsconfig path is not normalized. (#3169)

  • fix: type the exports of src/hooks.server with --tsgo-experimental-api (#3154)

Commits
  • e7826d3 Merge pull request #3148 from sveltejs/changeset-release/master
  • 6a44b38 Version Packages
  • e980054 fix: show inlay hints in scripts that come after other content (#3150)
  • 54ac0c0 fix: type hooks.server exports with --tsgo-experimental-api (#3154)
  • 704ee0c fix: report a tsconfig parse error instead of an internal error with --increm...
  • fda3f39 fix: resolve dts map sources relative to map file (#3173)
  • 55e5410 fix: update --tsgo-experimental-api for typescript 7.1 (#3168)
  • c2a9be7 fix: hide imports from document symbols (#3113)
  • 5682d2a fix: Preserve ts files listed in tsconfig.json with --tsgo (#3146)
  • See full diff in compare view

Updates tslib from 2.8.1 to 2.9.1

Release notes

Sourced from tslib's releases.

tslib 2.9.1

What's Changed

Full Changelog: microsoft/tslib@v2.8.1...v2.9.1

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for tslib since your current version.


Updates wrangler from 4.152.0 to 4.156.1

Release notes

Sourced from wrangler's releases.

wrangler@4.156.1

Patch Changes

  • #16594 effe4ed Thanks @​jaeminbird! - Fix wrangler types --check reporting CRLF types files as out of date

    When worker-configuration.d.ts was checked out with CRLF line endings (for example with Git's core.autocrlf=true, the default on Windows), the runtime header kept a trailing \r and never matched the expected header. wrangler types --check then always failed, wrangler dev always warned that the types might be out of date, and cached runtime types were never reused. Generated types files are now read with either line ending.

  • #16635 76e18a8 Thanks @​dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-01

    Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

  • #16635 76e18a8 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

    The following dependency versions have been updated:

    Dependency From To
    @​cloudflare/workers-types ^5.20261023.1 ^5.20261101.1
    workerd 1.20261023.1 1.20261101.1

  • #16535 5740867 Thanks @​petebacondarwin! - Keep Pages development asset lookups within the configured directory

    Validate resolved asset paths relative to the Pages output directory, preventing neighboring files and directories with a shared name prefix from being served. This also applies to the Vitest Pages ASSETS helper. Assets inside the directory and existing not-found fallbacks retain their behavior.

  • #16366 d174de8 Thanks @​MattieTK! - Deploy the requested directory when wrangler pages deploy <directory> is run as a Workers static-assets deploy

    When wrangler pages deploy <directory> was carried out as a Workers static-assets deploy, the <directory> argument was only used to check for unsupported Pages features and was then dropped. Autoconfig detected an assets directory of its own instead, and when the project root contained an index.html it chose the whole project root, even when a narrower directory such as public had been requested. Source files and configuration outside the requested directory that were not excluded by .assetsignore could then be uploaded as public static assets.

    The requested directory is now validated before files are written and passed through to the deploy. Unconfigured projects are set up for static assets even when framework dependencies are present; existing Workers configs receive an --assets or legacy --site override. Projects configured through the Cloudflare Vite plugin alone keep their configuration and scripts, using the requested directory and an explicit or default compatibility date just for this deploy. Successful deployments without a config file are recorded in the project's .wrangler/deployments directory for that account and Worker, surviving dependency reinstalls. Repeat deploys verify the recorded version still belongs to the target Worker before allowing an update, preserving protection against name collisions and replacements.

  • #16562 aece4df Thanks @​audricbizouarn-dashdoc! - Retry transient failures when starting a Workers assets upload session

    Asset manifest registration now uses the same bounded API retry policy as Worker uploads, including support for Retry-After. Temporary server errors no longer immediately abort an otherwise valid deployment. Persistent failures still surface the original error after the retry limit; this does not repair server-side issues affecting a specific Worker.

  • #16603 2667a9f Thanks @​petebacondarwin! - Fix repeated slashes in URL paths bypassing Pages Functions middleware

    Pages Functions now collapse repeated slashes when looking up middleware, so requests such as //secure/one run the same middleware as /secure/one. The original request URL and function-route matching are preserved. Middleware receives a functionPath prefix from the original URL so imported assets can still resolve their relative paths.

  • #16525 ed7fb41 Thanks @​petebacondarwin! - Validate OAuth error callbacks against the pending login

    All authorization callbacks, including ones without a code or error, now require the matching login state. Unrelated callbacks leave the login running so the authorization page can complete it, and control characters in provider error messages are displayed as escaped text.

  • #16597 f9dbb22 Thanks @​guybedford! - Fix WebAssembly stack frames printing as at [object Object] in source-mapped errors

    WebAssembly frames in source-mapped error stack traces now show their original function and location instead of [object Object].

  • Updated dependencies [76e18a8, 76e18a8, 009ca6e]:

wrangler@4.156.0

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the npm group in /web with 11 updates
c1e2053 
Bumps the npm group in /web with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [@iconify-json/lucide](https://github.com/iconify/icon-sets) | `1.2.147` | `1.2.150` |
| [@iconify-json/simple-icons](https://github.com/iconify/icon-sets) | `1.2.100` | `1.2.101` |
| [@sveltejs/adapter-static](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-static) | `4.0.0` | `4.0.1` |
| [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `3.1.0` | `3.1.1` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.5` | `26.6.6` |
| [parse5](https://github.com/inikulin/parse5) | `8.0.1` | `8.1.0` |
| [shiki](https://github.com/shikijs/shiki/tree/HEAD/packages/shiki) | `4.5.0` | `4.6.0` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.2` | `5.57.3` |
| [svelte-check](https://github.com/sveltejs/language-tools) | `4.7.7` | `4.7.8` |
| [tslib](https://github.com/Microsoft/tslib) | `2.8.1` | `2.9.1` |
| [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.152.0` | `4.156.1` |


Updates `@iconify-json/lucide` from 1.2.147 to 1.2.150
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@iconify-json/simple-icons` from 1.2.100 to 1.2.101
- [Commits](https://github.com/iconify/icon-sets/commits)

Updates `@sveltejs/adapter-static` from 4.0.0 to 4.0.1
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/adapter-static/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/adapter-static@4.0.1/packages/adapter-static)

Updates `@sveltejs/kit` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@3.1.1/packages/kit)

Updates `@types/node` from 26.6.5 to 26.6.6
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `parse5` from 8.0.1 to 8.1.0
- [Release notes](https://github.com/inikulin/parse5/releases)
- [Commits](inikulin/parse5@v8.0.1...v8.1.0)

Updates `shiki` from 4.5.0 to 4.6.0
- [Release notes](https://github.com/shikijs/shiki/releases)
- [Commits](https://github.com/shikijs/shiki/commits/v4.6.0/packages/shiki)

Updates `svelte` from 5.57.2 to 5.57.3
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.3/packages/svelte)

Updates `svelte-check` from 4.7.7 to 4.7.8
- [Release notes](https://github.com/sveltejs/language-tools/releases)
- [Commits](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.7...svelte-check@4.7.8)

Updates `tslib` from 2.8.1 to 2.9.1
- [Release notes](https://github.com/Microsoft/tslib/releases)
- [Commits](microsoft/tslib@v2.8.1...v2.9.1)

Updates `wrangler` from 4.152.0 to 4.156.1
- [Release notes](https://github.com/cloudflare/workers-sdk/releases)
- [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.156.1/packages/wrangler)

---
updated-dependencies:
- dependency-name: "@iconify-json/lucide"
  dependency-version: 1.2.150
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@iconify-json/simple-icons"
  dependency-version: 1.2.101
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@sveltejs/adapter-static"
  dependency-version: 4.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@sveltejs/kit"
  dependency-version: 3.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 26.6.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: parse5
  dependency-version: 8.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: shiki
  dependency-version: 4.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: svelte
  dependency-version: 5.57.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: svelte-check
  dependency-version: 4.7.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: tslib
  dependency-version: 2.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: wrangler
  dependency-version: 4.156.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 5, 2026
@jolars
jolars merged commit abc71dc into main Nov 5, 2026
42 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/web/npm-22ffae7ea3 branch November 5, 2026 05:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jolars