Bump the npm group across 1 directory with 7 updates #15

dependabot · 2025-12-01T21:13:12Z

Bumps the npm group with 7 updates in the / directory:

Package	From	To
js-yaml	`4.1.0`	`4.1.1`
@sveltejs/adapter-auto	`6.1.1`	`7.0.0`
@sveltejs/kit	`2.46.4`	`2.49.0`
prettier	`3.6.2`	`3.7.3`
svelte	`5.39.11`	`5.45.3`
svelte-check	`4.3.3`	`4.3.4`
vite	`7.1.9`	`7.2.6`

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
See full diff in compare view

Updates @sveltejs/adapter-auto from 6.1.1 to 7.0.0

Release notes

Sourced from @sveltejs/adapter-auto's releases.

@sveltejs/adapter-auto@7.0.0

Major Changes

feat: update adapter-vercel to version 6 (#14737)

Changelog

Sourced from @sveltejs/adapter-auto's changelog.

7.0.0

Major Changes

feat: update adapter-vercel to version 6 (#14737)

Commits

6f13d2b Version Packages (#14738)
c710a39 breaking: update to adapter-vercel to version 6 (#14737)
See full diff in compare view

Updates @sveltejs/kit from 2.46.4 to 2.49.0

Release notes

Sourced from @sveltejs/kit's releases.

@sveltejs/kit@2.49.0

Minor Changes

feat: stream file uploads inside form remote functions allowing form data to be accessed before large files finish uploading (#14775)

@sveltejs/kit@2.48.8

Patch Changes

breaking: invalid now must be imported from @sveltejs/kit (#14768)

breaking: remove submitter option from experimental form validate() method, always provide default submitter (#14762)

@sveltejs/kit@2.48.7

Patch Changes

fix: allow multiple server-timing headers (#14700)

fix: allow access to root-level issues in schema-less forms (#14893)

fix: allow hosting hash-based apps from non-index.html files (#14825)

@sveltejs/kit@2.48.6

Patch Changes

fix: clear issues upon passing validation (#14683)

fix: don't use fork of unrelated route (#14947)

fix: prevent type errors when optional @opentelemetry/api dependency isn't installed (#14949)

fix: preserve this when invoking standard validator (#14943)

fix: treat client/universal hooks as entrypoints for illegal server import detection (#14876)

fix: correct query .set and .refresh behavior in commands (#14877)

fix: improved the accuracy of the types of the output of field.as('...') (#14908)

@sveltejs/kit@2.48.5

Patch Changes

... (truncated)

Changelog

Sourced from @sveltejs/kit's changelog.

2.49.0

Minor Changes

feat: stream file uploads inside form remote functions allowing form data to be accessed before large files finish uploading (#14775)

2.48.8

Patch Changes

breaking: invalid now must be imported from @sveltejs/kit (#14768)

breaking: remove submitter option from experimental form validate() method, always provide default submitter (#14762)

2.48.7

Patch Changes

fix: allow multiple server-timing headers (#14700)

fix: allow access to root-level issues in schema-less forms (#14893)

fix: allow hosting hash-based apps from non-index.html files (#14825)

2.48.6

Patch Changes

fix: clear issues upon passing validation (#14683)

fix: don't use fork of unrelated route (#14947)

fix: prevent type errors when optional @opentelemetry/api dependency isn't installed (#14949)

fix: preserve this when invoking standard validator (#14943)

fix: treat client/universal hooks as entrypoints for illegal server import detection (#14876)

fix: correct query .set and .refresh behavior in commands (#14877)

fix: improved the accuracy of the types of the output of field.as('...') (#14908)

... (truncated)

Commits

ab37849 Version Packages (#14959)
d07ddcf feat: Streaming file uploads (#14775)
dfb41e1 Version Packages (#14958)
b9635ab breaking: remove submitter option from experimental form validate(…) meth...
bd55128 breaking: invalid now must be imported from @sveltejs/kit (#14768)
9f55c85 Version Packages (#14954)
5b30755 fix: allow hosting hash apps from other html files (#14825)
2ff3951 fix: allow access to root-level issues in schema-less forms (#14893)
0889a2a fix: append server-timing header value if key exist when using setHeaders...
f316be0 Version Packages (#14948)
Additional commits viewable in compare view

Updates prettier from 3.6.2 to 3.7.3

Release notes

Sourced from prettier's releases.

3.7.3

What's Changed

Fix prettier.getFileInfo() change that breaks VSCode extension by @fisker in prettier/prettier#18375

🔗 Changelog

3.7.2

What's Changed

Fix string print when switching quotes by @fisker in prettier/prettier#18351

Preserve quote for embedded HTML attribute values by @kovsu in prettier/prettier#18352

Fix comment in empty type literal by @fisker in prettier/prettier#18364

🔗 Changelog

3.7.1

Fix performance regression in doc printer (#18342 by @fisker)

🔗 Changelog

3.7.0

diff

🔗 Release note

Changelog

Sourced from prettier's changelog.

3.7.3

diff

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#18375 by @fisker)

An internal refactor accidentally broke the VSCode extension plugin loading.

3.7.2

diff

JavaScript: Fix string print when switching quotes (#18351 by @fisker)
// Input
console.log("A descriptor\\'s .kind must be \"method\" or \"field\".")
// Prettier 3.7.1
console.log('A descriptor\'s .kind must be "method" or "field".');
// Prettier 3.7.2
console.log('A descriptor\'s .kind must be "method" or "field".');
JavaScript: Preserve quote for embedded HTML attribute values (#18352 by @kovsu)
// Input
const html = /* HTML */ ` <div class="${styles.banner}"></div> `;
// Prettier 3.7.1
const html = /* HTML */ &lt;div class=${styles.banner}&gt;&lt;/div&gt;;
// Prettier 3.7.2
const html = /* HTML */ &lt;div class=&quot;${styles.banner}&quot;&gt;&lt;/div&gt;;
TypeScript: Fix comment in empty type literal (#18364 by @fisker)
// Input
export type XXX = {
  // tbd
};
// Prettier 3.7.1
</tr></table>

... (truncated)

Commits

fdfa670 Release 3.7.3
2dce3ec Fix typo
27d6c64 Revert previous change to getFileInfo (#18375)
f4a7afa Add types for config related functions (#18376)
9266e3e Add resolved test cases (#18358)
3bfc014 Bump Prettier dependency to 3.7.2
081b846 Clean changelog_unreleased
03384c9 Release 3.7.2
514e51a Release @prettier/plugin-hermes & @prettier/plugin-oxc v0.1.2
29a11ae Fix comment in empty type literal (#18364)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for prettier since your current version.

Updates svelte from 5.39.11 to 5.45.3

Release notes

Sourced from svelte's releases.

[email protected]

Patch Changes

add props to state_referenced_locally (#17266)

fix: preserve node locations for better sourcemaps (#17269)

fix: handle cross-realm Promises in hydratable (#17284)

[email protected]

Patch Changes

fix: array destructuring after await (#17254)

fix: throw on invalid {@tag}s (#17256)

[email protected]

Patch Changes

fix: link offscreen items and last effect in each block correctly (#17240)

[email protected]

Minor Changes

feat: add print(...) function (#16188)

[email protected]

Patch Changes

fix: await blockers before initialising const (#17226)

fix: link offscreen items and last effect in each block correctly (#17244)

fix: generate correct code for simple destructurings (#17237)

fix: ensure each block animations don't mess with transitions (#17238)

[email protected]

Minor Changes

feat: hydratable API (#17154)

[email protected]

Patch Changes

fix: don't execute attachments and attribute effects eagerly (#17208)

chore: lift "flushSync cannot be called in effects" restriction (#17139)

fix: store forked derived values (#17212)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.45.3

Patch Changes

add props to state_referenced_locally (#17266)

fix: preserve node locations for better sourcemaps (#17269)

fix: handle cross-realm Promises in hydratable (#17284)

5.45.2

Patch Changes

fix: array destructuring after await (#17254)

fix: throw on invalid {@tag}s (#17256)

5.45.1

Patch Changes

fix: link offscreen items and last effect in each block correctly (#17240)

5.45.0

Minor Changes

feat: add print(...) function (#16188)

5.44.1

Patch Changes

fix: await blockers before initialising const (#17226)

fix: link offscreen items and last effect in each block correctly (#17244)

fix: generate correct code for simple destructurings (#17237)

fix: ensure each block animations don't mess with transitions (#17238)

5.44.0

Minor Changes

feat: hydratable API (#17154)

5.43.15

... (truncated)

Commits

f8287b0 Version Packages (#17268)
649d857 fix: handle cross-realm Promises in hydratable (#17284)
617e179 fix: preserve node locations for better sourcemaps (#17269)
6d696be chore: update parser snapshots (#17267)
570f649 fix: add props to state_referenced_locally (#17266)
a72167b chore: more effect debug helpers (#17259)
b4b580a Version Packages (#17257)
bec7ca7 fix: throw on invalid {@tag}s (#17256)
ae60046 fix: array destructuring after await (#17254)
5c821c1 Version Packages (#17253)
Additional commits viewable in compare view

Updates svelte-check from 4.3.3 to 4.3.4

Release notes

Sourced from svelte-check's releases.

[email protected]

Patch Changes

chore: use machine format when run by Claude Code (#2870)

Commits

253b872 Version Packages (#2869)
6f08d66 fix: support experimental feature in "Show compiled Code" (#2884)
6546923 feat: quick fix for adding lang="ts" (#2882)
ba9185b feat: support hierarchical document symbols (#2817)
574c34d chore: turn changeset into patch
16d8454 feat: use machine format when run by Claude Code (#2870)
6a8ef1a fix: use moustache for svelte5 onhandler completion (#2883)
2a31d04 chore: slight optimize
04d52b7 fix: treat a script tag as top-level if it's the first tag in file (#2886)
d085830 docs: update command for setting up TailwindCSS (#2880)
Additional commits viewable in compare view

Updates vite from 7.1.9 to 7.2.6

Release notes

Sourced from vite's releases.

v7.2.6

Please refer to CHANGELOG.md for details.

v7.2.5

Please refer to CHANGELOG.md for details.

Note: 7.2.5 failed to publish so it is skipped on npm

v7.2.4

Please refer to CHANGELOG.md for details.

v7.2.3

Please refer to CHANGELOG.md for details.

v7.2.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.2.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v7.2.0

Please refer to CHANGELOG.md for details.

v7.2.0-beta.1

Please refer to CHANGELOG.md for details.

v7.2.0-beta.0

Please refer to CHANGELOG.md for details.

v7.1.12

Please refer to CHANGELOG.md for details.

v7.1.11

Please refer to CHANGELOG.md for details.

v7.1.10

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

config: handle shebang properly (#21158) (df5a30d)

deps: update all non-major dependencies (#21146) (a3cd262)

deps: update all non-major dependencies (#21175) (72e398a)

fix external: true merging (#21164) (5ef557a)

shortcuts not rebound after server restart (#21166) (3765f7b)

Performance Improvements

deps: replace debug with obug (#21137) (203a551)

Documentation

clarify manifest.json imports field is JS chunks only (#21136) (46d3077)

Miscellaneous Chores

deps: update rolldown-related dependencies (#21174) (74559c9)

7.2.4 (2025-11-20)

Bug Fixes

revert "perf(deps): replace debug with obug (#21107)" (2d66b7b)

7.2.3 (2025-11-20)

Bug Fixes

allow multiple bindCLIShortcuts calls with shortcut merging (#21103) (5909efd)

deps: update all non-major dependencies (#21096) (6a34ac3)

deps: update all non-major dependencies (#21128) (4f8171e)

Performance Improvements

deps: replace debug with obug (#21107) (acfe939)

Miscellaneous Chores

deps: update dependency @rollup/plugin-commonjs to v29 (#21099) (02ceaec)

deps: update rolldown-related dependencies (#21095) (39a0a15)

deps: update rolldown-related dependencies (#21127) (5029720)

7.2.2 (2025-11-07)

Bug Fixes

revert "refactor: use fs.cpSync (#21019)" (#21081) (728c8ee)

7.2.1 (2025-11-06)

... (truncated)

Commits

bda5dbb release: v7.2.6
3aa7527 release: v7.2.5
72e398a fix(deps): update all non-major dependencies (#21175)
3765f7b fix: shortcuts not rebound after server restart (#21166)
5ef557a fix: fix external: true merging (#21164)
74559c9 chore(deps): update rolldown-related dependencies (#21174)
df5a30d fix(config): handle shebang properly (#21158)
a3cd262 fix(deps): update all non-major dependencies (#21146)
46d3077 docs: clarify manifest.json imports field is JS chunks only (#21136)
203a551 perf(deps): replace debug with obug (#21137)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.1.1` | | [@sveltejs/adapter-auto](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-auto) | `6.1.1` | `7.0.0` | | [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.46.4` | `2.49.0` | | [prettier](https://github.com/prettier/prettier) | `3.6.2` | `3.7.3` | | [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.39.11` | `5.45.3` | | [svelte-check](https://github.com/sveltejs/language-tools) | `4.3.3` | `4.3.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.1.9` | `7.2.6` | Updates `js-yaml` from 4.1.0 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) Updates `@sveltejs/adapter-auto` from 6.1.1 to 7.0.0 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/adapter-auto/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/adapter-auto) Updates `@sveltejs/kit` from 2.46.4 to 2.49.0 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/[email protected]/packages/kit) Updates `prettier` from 3.6.2 to 3.7.3 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.6.2...3.7.3) Updates `svelte` from 5.39.11 to 5.45.3 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `svelte-check` from 4.3.3 to 4.3.4 - [Release notes](https://github.com/sveltejs/language-tools/releases) - [Commits](https://github.com/sveltejs/language-tools/compare/[email protected]@4.3.4) Updates `vite` from 7.1.9 to 7.2.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.2.6/packages/vite) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm - dependency-name: "@sveltejs/adapter-auto" dependency-version: 7.0.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm - dependency-name: "@sveltejs/kit" dependency-version: 2.49.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: prettier dependency-version: 3.7.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: svelte dependency-version: 5.45.3 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm - dependency-name: svelte-check dependency-version: 4.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm - dependency-name: vite dependency-version: 7.2.6 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Dec 1, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm group across 1 directory with 7 updates #15

Bump the npm group across 1 directory with 7 updates #15

Uh oh!

dependabot bot commented on behalf of github Dec 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm group across 1 directory with 7 updates #15

Are you sure you want to change the base?

Bump the npm group across 1 directory with 7 updates #15

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 1, 2025

[4.1.1] - 2025-11-12

Security

@​sveltejs/adapter-auto@​7.0.0

Major Changes

7.0.0

Major Changes

@​sveltejs/kit@​2.49.0

Minor Changes

@​sveltejs/kit@​2.48.8

Patch Changes

@​sveltejs/kit@​2.48.7

Patch Changes

@​sveltejs/kit@​2.48.6

Patch Changes

@​sveltejs/kit@​2.48.5

Patch Changes

2.49.0

Minor Changes

2.48.8

Patch Changes

2.48.7

Patch Changes

2.48.6

Patch Changes

3.7.3

What's Changed

3.7.2

What's Changed

3.7.1

3.7.0

3.7.3

API: Fix prettier.getFileInfo() change that breaks VSCode extension (#18375 by @​fisker)

3.7.2

JavaScript: Fix string print when switching quotes (#18351 by @​fisker)

JavaScript: Preserve quote for embedded HTML attribute values (#18352 by @​kovsu)

TypeScript: Fix comment in empty type literal (#18364 by @​fisker)

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Minor Changes

Patch Changes

5.45.3

Patch Changes

5.45.2

Patch Changes

5.45.1

Patch Changes

5.45.0

Minor Changes

5.44.1

Patch Changes

5.44.0

Minor Changes

5.43.15

Patch Changes

v7.2.6

v7.2.5

v7.2.4

v7.2.3

v7.2.2

v7.2.1

v7.2.0

v7.2.0-beta.1

v7.2.0-beta.0

v7.1.12

v7.1.11

v7.1.10

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

Performance Improvements

Documentation

`@sveltejs/adapter-auto@7`.0.0

`@sveltejs/kit@2`.49.0

`@sveltejs/kit@2`.48.8

`@sveltejs/kit@2`.48.7

`@sveltejs/kit@2`.48.6

`@sveltejs/kit@2`.48.5

API: Fix `prettier.getFileInfo()` change that breaks VSCode extension (#18375 by `@fisker`)

JavaScript: Fix string print when switching quotes (#18351 by `@fisker`)

JavaScript: Preserve quote for embedded HTML attribute values (#18352 by `@kovsu`)

TypeScript: Fix comment in empty type literal (#18364 by `@fisker`)