chore(deps): update dependency svelte to v5.45.8

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
svelte (source)	5.45.7 -> 5.45.8

---

Release Notes

sveltejs/svelte (svelte)

v5.45.8

Patch Changes

• fix: set AST root.start to 0 and root.end to template.length (#​17125)

• fix: prevent erroneous state_referenced_locally warnings on prop fallbacks (#​17329)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[claude]

Code Review: Svelte Dependency Update (v5.45.7 → v5.45.8)

Summary

This is a standard Renovate-managed patch version update of Svelte from v5.45.7 to v5.45.8. The changes are confined to lock files (package-lock.json and yarn.lock) with no source code modifications.

Review Assessment: ✅ APPROVED

---

Code Quality & Best Practices: ✅ Excellent

Positive aspects:

• Clean dependency update with no breaking changes (patch version)
• Both lock files properly updated (npm and yarn)
• Follows semantic versioning correctly
• Automated via Renovate with automerge enabled

Package manager note:

• The project appears to maintain both package-lock.json (npm) and yarn.lock files
• This is generally not recommended as it can lead to inconsistencies
• Recommendation: Choose one package manager (the CI uses bun, which reads yarn.lock). Consider removing package-lock.json if yarn is the preferred lock file, or standardize on one approach.

---

Potential Bugs/Issues: ✅ None Identified

The Svelte 5.45.8 release includes two bug fixes:

1. AST fix: Sets root.start to 0 and root.end to template.length (#17125)
2. Warning fix: Prevents erroneous state_referenced_locally warnings on prop fallbacks (#17329)

These are bug fixes with no known regressions. The second fix actually resolves a warning issue that may have affected this codebase.

---

Performance Considerations: ✅ Neutral to Positive

• Patch releases typically don't introduce performance regressions
• Bug fixes may improve compile-time performance (fewer erroneous warnings)
• No bundle size changes expected
• Lock file changes show only version bumps with no transitive dependency changes

---

Security Concerns: ✅ None

• No CVEs or security advisories associated with this release
• Svelte is a compile-time framework (minimal runtime), reducing attack surface
• This is a patch release from a trusted source (Svelte official team)

---

Test Coverage: ✅ Adequate

Existing CI coverage:

• The .github/workflows/ci.yml includes a frontend job that:
  • Generates TypeScript types from Rust code
  • Runs bun install (will use the updated lock file)
  • Runs bun run lint
  • Runs bun run build

Assessment:

• CI will validate that the new Svelte version compiles correctly
• Lint checks will catch any new warnings/errors
• Build process validates compatibility with SvelteKit and other dependencies

Note: No explicit frontend unit/integration tests detected in CI. This is acceptable for a patch update but consider adding component tests for future resilience.

---

Additional Observations

Lock file diff analysis:

1. Registry inconsistencies: Some packages switched between registry.npmjs.org and registry.yarnpkg.com - this is cosmetic and doesn't affect functionality
2. Transitive dependency updates:
   • devalue: 5.5.0 → 5.6.0 (expected with Svelte updates)
   • zimmerframe: 1.1.2 → 1.1.4 (Svelte's internal parser/AST library)
   • set-cookie-parser: 2.7.2 → 2.7.1 (downgrade - likely lock file cleanup)
   • sirv: 3.0.2 → 3.0.1 (downgrade - likely lock file cleanup)
3. The minor downgrades in dependencies are likely lock file canonicalization and don't indicate issues

---

Recommendations

1. Immediate: ✅ Approve and merge - this is a safe patch update with bug fixes
2. Short-term: Consider removing package-lock.json since CI uses bun/yarn
3. Long-term: Add frontend component tests to increase confidence in dependency updates

---

Conclusion

This is a low-risk, beneficial update that fixes bugs and maintains compatibility. The automated testing in CI provides adequate coverage for a patch release. Recommend merging once CI passes.

Reviewed by: Claude Code
Review date: 2025-12-08