Bump the npm_and_yarn group across 1 directory with 7 updates #560

dependabot · 2025-11-14T16:37:04Z

Bumps the npm_and_yarn group with 1 update in the /report directory: astro.

Updates astro from 2.10.15 to 5.15.7

Release notes

[email protected]

Patch Changes

#14765 03fb47c Thanks @florian-lefebvre! - Fixes a case where process.env wouldn't be properly populated during the build

#14690 ae7197d Thanks @fredriknorlin! - Fixes a bug where Astro's i18n fallback system with fallbackType: 'rewrite' would not generate fallback files for pages whose filename started with a locale key.

[email protected]

Patch Changes
#14751 18c55e1 Thanks @delucis! - Fixes hydration of client components when running the dev server and using a barrel file that re-exports both Astro and UI framework components.

#14750 35122c2 Thanks @florian-lefebvre! - Updates the experimental Fonts API to log a warning if families with a conflicting cssVariable are provided

#14737 74c8852 Thanks @Arecsu! - Fixes an error when using transition:persist with components that use declarative Shadow DOM. Astro now avoids re-attaching a shadow root if one already exists, preventing "Unable to re-attach to existing ShadowDOM" navigation errors.
#14750 35122c2 Thanks @florian-lefebvre! - Updates the experimental Fonts API to allow for more granular configuration of remote font families

A font family is defined by a combination of properties such as weights and styles (e.g. weights: [500, 600] and styles: ["normal", "bold"]), but you may want to download only certain combinations of these.

For greater control over which font files are downloaded, you can specify the same font (ie. with the same cssVariable, name, and provider properties) multiple times with different combinations. Astro will merge the results and download only the required files. For example, it is possible to download normal 500 and 600 while downloading only italic 500:
// astro.config.mjs
import { defineConfig, fontProviders } from 'astro/config';
export default defineConfig({
experimental: {
fonts: [
{
name: 'Roboto',
cssVariable: '--roboto',
provider: fontProviders.google(),
weights: [500, 600],
styles: ['normal'],
},
{
name: 'Roboto',
cssVariable: '--roboto',
provider: fontProviders.google(),
weights: [500],
styles: ['italic'],
},
],
},
});
[email protected]

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

5.15.7

Patch Changes

#14765 03fb47c Thanks @florian-lefebvre! - Fixes a case where process.env wouldn't be properly populated during the build

#14690 ae7197d Thanks @fredriknorlin! - Fixes a bug where Astro's i18n fallback system with fallbackType: 'rewrite' would not generate fallback files for pages whose filename started with a locale key.

5.15.6

Patch Changes
#14751 18c55e1 Thanks @delucis! - Fixes hydration of client components when running the dev server and using a barrel file that re-exports both Astro and UI framework components.

#14750 35122c2 Thanks @florian-lefebvre! - Updates the experimental Fonts API to log a warning if families with a conflicting cssVariable are provided

#14737 74c8852 Thanks @Arecsu! - Fixes an error when using transition:persist with components that use declarative Shadow DOM. Astro now avoids re-attaching a shadow root if one already exists, preventing "Unable to re-attach to existing ShadowDOM" navigation errors.
#14750 35122c2 Thanks @florian-lefebvre! - Updates the experimental Fonts API to allow for more granular configuration of remote font families

A font family is defined by a combination of properties such as weights and styles (e.g. weights: [500, 600] and styles: ["normal", "bold"]), but you may want to download only certain combinations of these.

For greater control over which font files are downloaded, you can specify the same font (ie. with the same cssVariable, name, and provider properties) multiple times with different combinations. Astro will merge the results and download only the required files. For example, it is possible to download normal 500 and 600 while downloading only italic 500:
// astro.config.mjs
import { defineConfig, fontProviders } from 'astro/config';
export default defineConfig({
experimental: {
fonts: [
{
name: 'Roboto',
cssVariable: '--roboto',
provider: fontProviders.google(),
weights: [500, 600],
styles: ['normal'],
},
{
name: 'Roboto',
cssVariable: '--roboto',
provider: fontProviders.google(),
weights: [500],
styles: ['italic'],
},
],
},
});

... (truncated)

Commits

ebc4b1c [ci] release (#14764)
03fb47c fix(astro): populate process.env during build (#14765)
ae7197d fix(i18n): generate fallbacks for pages with filenames containing locale keys...
1901061 [ci] release (#14745)
790d942 Merge commit from fork
35122c2 feat(fonts): merge families (#14750)
72381ef chore: upgrade @playwright/test (#14749)
18c55e1 Stub out .astro imports in client modules (#14751)
5bc37fd fix(deps): update astro dependencies (#14739)
74c8852 fix: skip re-attaching shadow roots during view transitions (#14737)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for astro since your current version.

Updates js-yaml from 3.14.1 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

Added replacer option (similar to option in JSON.stringify), #339.

Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

cc482e7 4.1.1 released
50968b8 dist rebuild
d092d86 lint fix
383665f fix prototype pollution in merge (<<)
0d3ca7a README.md: HTTP => HTTPS (#678)
49baadd doc: 'empty' style option for !!null
ba3460e Fix demo link (#618)
2cef47b 4.1.0 released
810b149 dist rebuild
2b5620e Export built-in types, type override now preserves order
Additional commits viewable in compare view

Updates cookie from 0.5.0 to 1.0.2

Release notes

Sourced from cookie's releases.

v1.0.2

Fixed

Loosen cookie name/value validation (#210)

fix: options.priority used incorrect fallback (#207) by @jonchurch

Added

Add import example to README (#190) by @isnifer

jshttp/cookie@v1.0.1...v1.0.2

v1.0.1

Added

Allow case insensitive options (#194) 3bed080

jshttp/cookie@v1.0.0...v1.0.1

v1.0.0

Breaking changes

Use modern JS features, ship TypeScript definition (#175) 1cc64ff

Adds __esModule marker, imports need to use import { parse, serialize } or import * as cookie

Minimum node.js v18

Uses null prototype object for parse return value

Changes strict and priority to match the lower case strings (i.e. low, not LOW or Low)

Require maxAge to be an integer using Number.isInteger check

Delegates decode implementation details to decode option (i.e. error handling and quote parsing is defined by decode)

Delegate quote parsing to decode (#180) c4a2597

Shift try/catch to decode (#179) 93a5b97

Improve arg/option error messages (#162) e206fd5 @MaoShizhong

Other

Remove hasOwnProperty, use undefined check for performance (#183) 8f3ee9e @gurgunday

jshttp/cookie@v0.7.2...v1.0.0

v0.7.2

Fixed

Fix object assignment of hasOwnProperty (#177) bc38ffd

jshttp/cookie@v0.7.1...v0.7.2

0.7.1

Fixed

Allow leading dot for domain (#174)

... (truncated)

Commits

e739f41 1.0.2
8be4b82 Loosen cookie name/value validation (#210)
94ba436 Fix codecov workflow in PRs (#209)
4898ba2 fix: options.priority used incorrect fallback (#207)
408c2b4 Add import example to README (#190)
ba9e677 1.0.1
3bed080 Allow case insensitive options (#194)
bc66a7e Generate cookie outside benchmarks (#187)
c69cef6 1.0.0
42025f7 Use workflow status for badge
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates devalue from 4.3.3 to 5.5.0

Release notes

Sourced from devalue's releases.

v5.5.0

Minor Changes

828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

Changelog

Sourced from devalue's changelog.

5.5.0

Minor Changes

828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

5.2.1

... (truncated)

Commits

f4b37f3 Version Packages (#124)
828fa1c Enable support for custom reducer/reviver for "function" values (#123)
6f4eb8b Version Packages (#119)
5c26c0d fix: allow custom revivers to revive things serialized by buitin reducers (#118)
8b0c28d Version Packages (#117)
ca3c7b6 chore: Remove impossible void type from replacer's uneval (#116)
8fb152e Version Packages (#115)
9306d09 feat: pass uneval to replacer, for handling nested custom types (#114)
2124b5b chore: simplify NullObject (#104)
b617c7c perf: shrink uneval output with null-proto objects (#112)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.

Updates esbuild from 0.17.19 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Updates svelte from 3.59.2 to 5.43.6

Release notes

Sourced from svelte's releases.

[email protected]

Patch Changes

fix: don't deactivate other batches (#17132)

[email protected]

Patch Changes

fix: ensure async static props/attributes are awaited (#17120)

fix: wait on dependencies of async bindings (#17120)

fix: await dependencies of style directives (#17120)

[email protected]

Patch Changes

chore: simplify connection/disconnection logic (#17105)

fix: reconnect deriveds to effect tree when time-travelling (#17105)

[email protected]

Patch Changes

fix: ensure fork always accesses correct values (#17098)

fix: change title only after any pending work has completed (#17061)

fix: preserve symbols when creating derived rest properties (#17096)

[email protected]

Patch Changes

fix: treat each blocks with async dependencies as uncontrolled (#17077)

[email protected]

Patch Changes

fix: transform $bindable after await expressions (#17066)

[email protected]

Minor Changes

feat: out-of-order rendering (#17038)

Patch Changes

fix: settle batch after DOM updates (#17054)

[email protected]

... (truncated)

Changelog

Sourced from svelte's changelog.

svelte

4.2.3

Patch Changes

fix: improve a11y-click-events-have-key-events message (#9358)

fix: more robust hydration of html tag (#9184)

4.2.2

Patch Changes

fix: support camelCase properties on custom elements (#9328)

fix: add missing plaintext-only value to contenteditable type (#9242)

chore: upgrade magic-string to 0.30.4 (#9292)

fix: ignore trailing comments when comparing nodes (#9197)

4.2.1

Patch Changes

fix: update style directive when style attribute is present and is updated via an object prop (#9187)

fix: css sourcemap generation with unicode filenames (#9120)

fix: do not add module declared variables as dependencies (#9122)

fix: handle svelte:element with dynamic this and spread attributes (#9112)

fix: silence false positive reactive component warning (#9094)

fix: head duplication when binding is present (#9124)

fix: take custom attribute name into account when reflecting property (#9140)

fix: add indeterminate to the list of HTMLAttributes (#9180)

fix: recognize option value on spread attribute (#9125)

4.2.0

Minor Changes

feat: move svelteHTML from language-tools into core to load the correct svelte/element types (#9070)

... (truncated)

Commits

e238e66 Version Packages (#17135)
14b0926 fix: don't deactivate other batches (#17132)
554202e Version Packages (#17127)
68d4f9c fix: wait on dependencies of async bindings (#17120)
3a4dc7d Version Packages (#17119)
46e9d2d chore: remove UNOWNED flag (#17105)
7a24354 Version Packages (#17087)
eea8a18 fix: ensure fork always accesses correct values (#17098)
b7625fd fix: do not spread non-enumerable symbols (#17097)
8ebbb3c fix: preserve symbols when creating derived rest properties (#17096)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for svelte since your current version.

Updates vite from 4.5.14 to 6.4.1

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

[email protected]

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.3.0-beta.0

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

7.2.2 (2025-11-07)

Bug Fixes

revert "refactor: use fs.cpSync (#21019)" (#21081) (728c8ee)

7.2.1 (2025-11-06)

Bug Fixes

worker: some worker asset was missing (#21074) (82d2d6c)

Code Refactoring

build: rename indexOfMatchInSlice to findPreloadMarker (#21054) (f83264f)

7.2.0 (2025-11-05)

Bug Fixes

css: fallback to sass when sass-embedded platform binary is missing (#21002) (b1fd616)

module-runner: make getBuiltins response JSON serializable (#21029) (ad5b3bf)

types: add undefined to optional properties for exactOptionalProperties type compatibility (#21040) (2833c55)

Miscellaneous Chores

deps: update rolldown-related dependencies (#21047) (e3a6a83)

7.2.0-beta.1 (2025-10-29)

Bug Fixes

increase stream reset rate limit for HTTP2 (#21024) (4f44f22)

optimizer: externalize virtual modules for html like files (#21001) (e5af352)

Documentation

clarify the values are escaped automatically (#21017) (246df13)

Code Refactoring

use fs.cpSync (#21019) (a2df778)

7.2.0-beta.0 (2025-10-28)

Features

add import.meta.resolve support for ESM config (bundle config loader) (#20962) (f86789a)

add perEnvironmentWatchChangeDuringDev (#20996) (a5e98e6)

add vite client connect events (#20978) (543d87c)

build: emit license (#18546) (b42c3fb)

dev: support HTTP2 even if proxy feature is used (#20869) (fc21af7)

lib: enable minification but keep pure annotations for es output with terser (#20522) (df997d0)

optimizer: add rush lockfile support (#20833) (718ca2d)

utils: support multiple certificates in resolveServerUrls (#20707) (24513e5)

... (truncated)

Commits

a7349ef release: v6.3.1
a152b7c fix: backward compat for internal plugin transform calls (#19878)
35c7f35 fix: avoid using Promise.allSettled in preload function (#19805)
5fdcfe7 release: v6.3.0
d4ee5e8 fix(hmr): avoid infinite loop happening with hot.invalidate in circular dep...
5003434 fix(preview): use host url to open browser (#19836)
bf9728e release: v6.3.0-beta.2
380c10e fix(hmr): run HMR handler sequentially (#19793)
8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
0a0c50a refactor: simplify pluginFilter implementation (#19828)
Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
astro	[>= 5.a, < 6]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 1 update in the /report directory: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro). Updates `astro` from 2.10.15 to 5.15.7 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro) Updates `js-yaml` from 3.14.1 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...4.1.1) Updates `cookie` from 0.5.0 to 1.0.2 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.5.0...v1.0.2) Updates `devalue` from 4.3.3 to 5.5.0 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.5.0) Updates `esbuild` from 0.17.19 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.17.19...v0.25.12) Updates `svelte` from 3.59.2 to 5.43.6 - [Release notes](https://github.com/sveltejs/svelte/releases) - [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG-pre-5.md) - [Commits](https://github.com/sveltejs/svelte/commits/[email protected]/packages/svelte) Updates `vite` from 4.5.14 to 6.4.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/[email protected]/packages/vite) --- updated-dependencies: - dependency-name: astro dependency-version: 5.15.7 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookie dependency-version: 1.0.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: svelte dependency-version: 5.43.6 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.1 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file report Pull requests that update Javascript code (report) labels Nov 14, 2025

dependabot bot had a problem deploying to github-pages November 14, 2025 16:37 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 7 updates #560

Bump the npm_and_yarn group across 1 directory with 7 updates #560

Uh oh!

dependabot bot commented on behalf of github Nov 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 7 updates #560

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 7 updates #560

Uh oh!

Conversation

dependabot bot commented on behalf of github Nov 14, 2025

Patch Changes

Patch Changes

Patch Changes

5.15.7

Patch Changes

5.15.6

Patch Changes

[4.1.1] - 2025-11-12

Security

[4.1.0] - 2021-04-15

Added

Changed

[4.0.0] - 2021-01-03

Changed

Added

Fixed

v1.0.2

v1.0.1

v1.0.0

v0.7.2

0.7.1

v5.5.0

Minor Changes

v5.4.2

Patch Changes

v5.4.1

Patch Changes

v5.4.0

Minor Changes

Patch Changes

v5.3.2

Patch Changes

v5.3.1

Patch Changes

v5.3.0

Minor Changes

5.5.0

Minor Changes

5.4.2

Patch Changes

5.4.1

Patch Changes

5.4.0

Minor Changes

Patch Changes

5.3.2

Patch Changes

5.3.1

Patch Changes

5.3.0

Minor Changes

5.2.1

v0.25.12

Changelog: 2023

0.19.11

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

svelte

4.2.3

Patch Changes

4.2.2

Patch Changes

4.2.1

Patch Changes

4.2.0

Minor Changes

v6.4.1

v6.4.0