Skip to content

chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 4 updates #15

wants to merge 1 commit into from
+24 −23

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Oct 21, 2025 •
edited
Loading

Bumps the dev-dependencies group with 4 updates in the /frontend directory: @sveltejs/kit, @types/dompurify, svelte and vite.

Updates @sveltejs/kit from 2.47.0 to 2.47.2

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.47.2

Patch Changes

  • fix: streamed promise not resolving when another load function returns a fast resolving promise (#14753)

  • chore: allow to run preflight validation only (#14744)

  • fix: update overload to set invalid type to schema input (#14748)

@​sveltejs/kit@​2.47.1

Patch Changes

  • fix: allow read to be used at the top-level of remote function files (#14672)

  • fix: more robust remote files generation (#14682)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.47.2

Patch Changes

  • fix: streamed promise not resolving when another load function returns a fast resolving promise (#14753)

  • chore: allow to run preflight validation only (#14744)

  • fix: update overload to set invalid type to schema input (#14748)

2.47.1

Patch Changes

  • fix: allow read to be used at the top-level of remote function files (#14672)

  • fix: more robust remote files generation (#14682)

Commits

Updates @types/dompurify from 3.0.5 to 3.2.0

Commits

Updates svelte from 5.40.1 to 5.41.1

Release notes

Sourced from svelte's releases.

svelte@5.41.1

Patch Changes

  • fix: place let: declarations before {@const} declarations (#16985)

  • fix: improve each_key_without_as error (#16983)

  • chore: centralise branch management (#16977)

svelte@5.41.0

Minor Changes

  • feat: add $state.eager(value) rune (#16849)

Patch Changes

  • fix: preserve <select> state while focused (#16958)

  • chore: run boundary async effects in the context of the current batch (#16968)

  • fix: error if each block has key but no as clause (#16966)

svelte@5.40.2

Patch Changes

  • fix: add hydration markers in pending branch of SSR boundary (#16965)
Changelog

Sourced from svelte's changelog.

5.41.1

Patch Changes

  • fix: place let: declarations before {@const} declarations (#16985)

  • fix: improve each_key_without_as error (#16983)

  • chore: centralise branch management (#16977)

5.41.0

Minor Changes

  • feat: add $state.eager(value) rune (#16849)

Patch Changes

  • fix: preserve <select> state while focused (#16958)

  • chore: run boundary async effects in the context of the current batch (#16968)

  • fix: error if each block has key but no as clause (#16966)

5.40.2

Patch Changes

  • fix: add hydration markers in pending branch of SSR boundary (#16965)
Commits

Updates vite from 7.1.10 to 7.1.11

Release notes

Sourced from vite's releases.

v7.1.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.1.11 (2025-10-20)

Bug Fixes

  • dev: trim trailing slash before server.fs.deny check (#20968) (f479cc5)

Miscellaneous Chores

Code Refactoring

  • use subpath imports for types module reference (#20921) (d0094af)

Build System

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps-dev): bump the dev-dependencies group across 1 direc…
d045e2f 
…tory with 4 updates

Bumps the dev-dependencies group with 4 updates in the /frontend directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit), [@types/dompurify](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/dompurify), [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@sveltejs/kit` from 2.47.0 to 2.47.2
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.47.2/packages/kit)

Updates `@types/dompurify` from 3.0.5 to 3.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/dompurify)

Updates `svelte` from 5.40.1 to 5.41.1
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.41.1/packages/svelte)

Updates `vite` from 7.1.10 to 7.1.11
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.1.11/packages/vite)

---
updated-dependencies:
- dependency-name: "@sveltejs/kit"
  dependency-version: 2.47.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
- dependency-name: "@types/dompurify"
  dependency-version: 3.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: svelte
  dependency-version: 5.41.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dev-dependencies
- dependency-name: vite
  dependency-version: 7.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dev-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 21, 2025

Labels

The following labels could not be found: frontend. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Oct 21, 2025
@claude
Copy link

claude bot commented Oct 21, 2025

PR Review: Dependency Updates (dev-dependencies group)

Summary

This PR updates 4 frontend dev dependencies via Dependabot. All updates are patch or minor version bumps with no breaking changes expected.

Changes Overview

Package From To Type
@sveltejs/kit 2.47.0 → 2.47.2 Patch
@types/dompurify 3.0.5 → 3.2.0 Minor
svelte 5.40.1 → 5.41.1 Minor
vite 7.1.10 → 7.1.11 Patch

Code Quality Assessment: ✅ GOOD

Positive Points:

  1. Automated dependency management - Dependabot is properly configured
  2. Grouped updates - Related dependencies updated together, reducing PR noise
  3. Dev dependencies only - Zero risk to production runtime
  4. Semantic versioning respected - All updates follow semver conventions

Detailed Analysis

1. @sveltejs/kit (2.47.0 → 2.47.2) ✅

Changes:

  • Fixes streamed promise resolution issues
  • Improves type definitions for form validation
  • More robust remote files generation

Impact: Low risk - Bug fixes and type improvements only.

2. @types/dompurify (3.0.5 → 3.2.0) ⚠️

Notable:

  • Package is now deprecated - DOMPurify provides its own types
  • Dependency changed from @types/trusted-types to dompurify

Recommendation: Consider removing @types/dompurify in a future PR and relying on DOMPurify's built-in types instead.

3. svelte (5.40.1 → 5.41.1) ✅

Changes:

  • NEW: $state.eager(value) rune added (minor feature)
  • Fixes <select> state preservation while focused
  • Improved error messages for each blocks

Impact: Low risk - Backward compatible improvements. The new $state.eager() rune is optional.

4. vite (7.1.10 → 7.1.11) ✅

Changes:

  • Security fix: Trims trailing slash before server.fs.deny check
  • Build improvements (removed hash from filenames, CJS cleanup)

Impact: Low risk - Bug fixes and build optimizations.

Security Considerations: ✅ SECURE

  1. Vite security fix - The trailing slash fix prevents potential directory traversal edge cases
  2. No known vulnerabilities in any updated packages
  3. Dev dependencies only - Not shipped to production

Performance Considerations: ✅ NEUTRAL

  • No performance regressions expected
  • Vite build improvements may slightly improve build times
  • Svelte runtime improvements are minor optimizations

Testing Recommendations: ✅

Before merging, verify:

# Install updated dependencies
cd frontend && npm install

# Run type checking
npm run check

# Build the project
npm run build

# Run dev server and spot check
npm run dev

Expected: All checks should pass. The application should build and run without issues.

Potential Issues: ⚠️ MINOR

  1. @types/dompurify deprecation - Not urgent, but consider cleanup
  2. Lock file changes - 47 lines changed in package-lock.json (normal for dependency updates)

Overall Recommendation: ✅ APPROVE & MERGE

Confidence Level: HIGH

Rationale:

  • All updates are minor/patch versions following semver
  • Changes are well-documented in upstream changelogs
  • Dev dependencies pose minimal risk
  • Updates include bug fixes and improvements
  • No breaking changes detected

Action Items:

  • ✅ Merge this PR
  • 📋 Create follow-up issue to remove @types/dompurify dependency (not urgent)

Review completed by Claude Code

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 17, 2025

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 24, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Nov 24, 2025
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/frontend/dev-dependencies-f974c74867 branch November 24, 2025 07:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant