Skip to content

chore(deps): update sveltekit, vite, vitest 5, sentry 11, and 18 others - #4

Merged
tommyp merged 3 commits into
mainfrom
deps/update-2026-10-01
Oct 1, 2026
Merged

chore(deps): update sveltekit, vite, vitest 5, sentry 11, and 18 others#4
tommyp merged 3 commits into
mainfrom
deps/update-2026-10-01

Conversation

@tommyp

@tommyp tommyp commented Oct 1, 2026

Copy link
Copy Markdown
Owner

Summary

Updates all 22 outdated dependencies to latest, except TypeScript, which is held at 6.x (see Notes). pnpm audit goes from 100 advisories (1 critical, 33 high, 52 moderate, 14 low) to 2 low. Majors taken: @sentry/sveltekit 11, vitest 5, jsdom 30, @testing-library/jest-dom 7 and prettier-plugin-svelte 4. None of them needed code changes.

This PR also:

  • migrates to pnpm 11: the build-script allowlist moves from package.json (pnpm.onlyBuiltDependencies, which pnpm 11 ignores) to allowBuilds in a new pnpm-workspace.yaml. The previous behaviour is kept: only esbuild runs its build script, and the rest are listed explicitly as false.
  • bumps Node in .tool-versions from 25.7.0 to 26.10.0, because jsdom 30 and vitest 5 declare ^22 || ^24 || >=26, which excludes Node 25. All installed packages' engines allow 26.10.0.
  • runs Prettier over 5 files that had drifted from the repo's formatting, in a separate commit, so prettier --check passes.

Verification

  • pnpm check: 0 errors, 0 warnings
  • vitest run: 20/20, same count as main, with both client (jsdom) and server projects running
  • pnpm build: clean
  • pnpm test:e2e: 1/1
  • prettier --check: clean
  • eslint .: 7 errors, the same 7 already on main (unused vars in Controls.svelte, svelte/no-navigation-without-resolve ×2, svelte/require-each-key). They were left alone because fixing them means app-code changes.
  • pnpm peers check: no issues

Security

  • protobufjs / @protobufjs/utf8 (critical, high): removed from the tree. posthog-js no longer pulls in the OTLP exporter.
  • @sveltejs/kit, svelte, vite, vitest (high, moderate): fixed by the direct updates.
  • undici, ws, sharp, devalue, dompurify, postcss, nanoid, brace-expansion, browserslist, esbuild and others (high, moderate, low): fixed by their parents updating; see Transitive dependencies.
  • @babel/core 7.29.0 (low): unresolved. Pulled in by @sentry/bundler-plugins (range ^7.18.5; a fixed 7.29.7 exists), but pnpm keeps the locked 7.29.0. It's a build-time dependency of a Sentry Vite plugin this app doesn't load, so no override was added.
  • cookie 0.6.0 (low): unresolved. @sveltejs/kit 2.x pins cookie ^0.6.0; the fix only ships in Kit 3.0.0, which was released today and is out of scope here.

Notes

  • TypeScript held at ^6.0.3. TypeScript 7 is outside the supported peer range of @sveltejs/kit (^5.3.3 || ^6.0.0), svelte-check (^5 || ^6) and typescript-eslint (<6.1.0), and svelte-check refuses to run against it.
  • @sentry/sveltekit isn't imported anywhere in src or the configs, so the v11 breaking changes don't affect the app. It may be worth removing as a follow-up.
  • miniflare 5.x -alpha: wrangler 4.145.0 pins an exact miniflare@5.20260930.0-alpha, and Cloudflare publishes those builds under latest.
  • @sveltejs/kit 3.0.0 was published today and is a separate upgrade.

Direct dependencies

@sentry/sveltekit 10.47.0 → 11.1.0
diff · changelog

posthog-js 1.364.4 → 1.435.3
diff · changelog

svelte-check 4.4.6 → 4.7.6
diff · changelog

typescript 6.0.2 → 6.0.3
diff · changelog

  • Release notes only link to the 6.0 announcement blog post and the fixed-issues query for TypeScript 6.0.3 (Stable); no itemised changes

@sveltejs/kit 2.55.0 → 2.70.3
diff · changelog

  • 2.70.2: fix: prevent quadratic backtracking in Accept header content negotiation
  • 2.70.0: fix: enable CSRF protection in builds with a non-production NODE_ENV value
  • 2.70.0: feat: move defineEnvVars to @sveltejs/kit/env
  • 2.69.1: fix: prevent prototype pollution when deleting file inputs
  • 2.65.2: fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches
  • 2.57.1: fix: enforce BODY_SIZE_LIMIT on chunked requests; fix: better validation for redirect inputs
  • 2.63.0 / 2.62.0: feat: explicit env vars; feat: support passing Svelte(Kit) config via Vite plugin
  • 2.61.0: breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead
  • 2.56.0: feat: support TypeScript 6.0
  • …plus many remote-function (query, form, command) additions and fixes across 2.56–2.69

@sveltejs/vite-plugin-svelte 7.0.0 → 7.3.1
diff · changelog

  • 7.3.1: fix: inject the inspector into the client under Vite+ on pnpm, where the realpathed client module has no vite/ segment before dist/
  • 7.3.0: feat: pass environment to dynamicCompileOptions
  • 7.3.0: fix: don't log inline config when encountering unexpected options
  • 7.2.0: feat(inspector): add a context menu with current component stack
  • 7.1.2: fix: correctly resolve compiled CSS on the server for dependencies with Svelte files
  • 7.1.1: fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup
  • 7.1.0: feat: enable optimizer for server environments during dev

@sveltejs/adapter-cloudflare 7.2.8 → 7.2.9
diff · changelog

svelte 5.55.1 → 5.57.1
diff · changelog

  • 5.55.7: fix: prevent XSS on hydratable from user contents
  • 5.55.7: fix: disallow empty attribute names during SSR; fix: harden regex
  • 5.56.0: feat: allow declarations in the template
  • 5.57.0: feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server
  • 5.57.0: feat: add has function to createContext; feat: support defaultValue on <select>; feat: add getOrInsert/getOrInsertComputed to SvelteMap
  • 5.56.10: fix: strip comments from inline style values in linear time
  • 5.57.1: fix: serialize input default values during server rendering; fix: preserve global CSS in components without scopable elements
  • …plus many async/batching, SSR and compiler fixes across 5.55.2–5.57.1

vite 8.0.3 → 8.3.1
diff · changelog

  • 8.0.5: apply server.fs check to env transport; avoid path traversal with optimize deps sourcemap handler; check server.fs after stripping query as well; disallow referencing files outside the package from sourcemap
  • 8.0.16: reject windows alternate paths; reject UNC paths for launch-editor-middleware
  • 8.1.0: extend server.fs.deny list with common files
  • 8.1.0: feat: import.meta.glob support caseSensitive option; feat: direct .wasm imports (WASM ESM Integration)
  • 8.1.0: feat: rename server.hmr options to server.ws options
  • 8.2.0: feat: add input to server.fs.allow; feat: add input option
  • 8.3.0: feat: add top-level tsconfig option; feat: add closeServer and closePreviewServer hooks
  • 8.3.1: fix: handle server.ws: false in mergeConfig; fix: merge build.rolldownOptions.output.comments correctly
  • …plus Rolldown bumps (1.0.0 stable in 8.0.12, 1.1.x in 8.1.0) and many fixes

wrangler 4.79.0 → 4.145.0
diff · changelog

  • 4.143.1: Resolve the affected Undici dependency in new Wrangler and Vite plugin installs (Undici 7.29.1 fixes GHSA-3wwx-pv8p-q78v)
  • 4.131.0: Bump shell-quote to 1.9.0+ to pick up two disclosed advisories (ReDoS in parse(), CVE-2026-13311)
  • 4.102.0: Bump ws from 8.20.1 to 8.21.0 to address GHSA-96hv-2xvq-fx4p (remote memory-exhaustion DoS)
  • 4.122.0: Detect Node.js compatibility from the compatibility date; as of compatibility date 2026-08-04, workerd enables the nodejs_compat and nodejs_compat_v2 compatibility flags by default
  • 4.111.0: Remove support for service environments and the legacy_env configuration field
  • 4.118.0: Enable local observability capture by default in dev
  • 4.101.0: Graduate autoconfig from experimental to stable
  • 4.116.0: Graduate wrangler check startup from alpha and show bundle size
  • 4.107.0: Add opt-in OS keychain storage for OAuth credentials
  • …plus many new binding/command additions (Containers, Workflows, Previews, Pipelines, createTestHarness())

@playwright/test 1.58.2 → 1.63.0
diff · changelog

  • 1.63: Test locks: tests that share a lock name never run concurrently, across files, workers and projects
  • 1.63: New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class
  • 1.63: New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config
  • 1.63: Ubuntu 20.04 is not supported anymore; Chromium 153.0.8010.12, Firefox 155.0, WebKit 26.6
  • 1.62: Most operations and web-first assertions now accept a signal option that takes an AbortSignal
  • 1.62: toHaveScreenshot() and page.screenshot() support WebP; new testConfig.retryStrategy ('isolated' runs retries at the end in a single worker)
  • 1.62: Debian 11 is not supported anymore
  • 1.60: Removed long-deprecated APIs: Locator.ariaRef(), handle option on exposeBinding, logger option on connect/connectOverCDP, context options videosPath / videoSize
  • 1.59: Removed macOS 14 support for WebKit; removed @playwright/experimental-ct-svelte package; junit reporter now differentiates errors from failures

vitest 4.1.2 → 5.0.3
diff · changelog · v5.0.0 breaking changes

  • Breaking: Require Node.js 22 and Vite 6.4
  • Breaking: Clear mocks by default before each test
  • Breaking: Fail the test when an asynchronous assertion is not awaited
  • Breaking: Fail expect.poll when function didn't resolve in time
  • Breaking: Remove sequential test/suite options in favor of concurrent
  • Breaking: Replace loupe.inspect with pretty-format; remove quotes from string values in test.for/each title $ variable
  • Breaking: Allow mutating happy-dom/jsdom window object; toHaveTextContent is strict, add toMatchTextContent as alternative
  • Breaking: Don't lookup config file from ancestor directories; inline projects extend the root config by default; reporters/attachments now default to the .vitest directory
  • Features: vi.when(), --repeats CLI option, TypeScript build mode support, mocking Temporal
  • 5.0.1–5.0.3 fixes: "Support Blob on jsdom 30.1", "Fix Request with Blob body on jsdom 28+", "Fix toMatchObject with asymmetric matchers"

@testing-library/jest-dom 6.9.1 → 7.0.1
diff · changelog

@testing-library/svelte 5.3.1 → 5.4.2
diff · changelog

jsdom 29.0.1 → 30.1.1
diff · changelog

  • Breaking (30.0.0): "Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0."
  • 30.0.0: Added CSS.escape() and CSS.supports() functions
  • 30.0.0: Fixed getComputedStyle() to convert length values into pixels
  • 30.1.0: Added named access to elements on document, such as document.myForm for <form name="myForm">
  • 30.1.0: Added QuotaExceededError
  • 30.1.0: Improved performance of DOM construction, tree mutations, range operations, live collection access, getComputedStyle(), and event dispatch
  • 30.1.0: "Changed window.close() to preserve access to the document and its DOM through retained references."
  • 30.1.1: Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0

eslint 10.1.0 → 10.11.0
diff · changelog

@eslint/compat 2.0.3 → 2.1.1
diff · changelog

eslint-plugin-svelte 3.16.0 → 3.23.0
diff · changelog

  • 3.23.0: feat: add prefer-attribute-interpolation rule
  • 3.22.0: feat: add no-conflicting-module-names rule
  • 3.21.0: feat: add no-bind-value-on-checkable-inputs rule
  • 3.20.0: feat: add svelte/no-at-const-tags rule
  • 3.20.0: fix(valid-prop-names-in-kit-pages): drop errors from allowed page props in Svelte 5 to follow SvelteKit
  • 3.19.0: feat: support Svelte 5 declaration tags; update svelte-eslint-parser to 1.7.0
  • 3.18.0: feat: add no-nested-style-tag and prefer-derived-over-derived-by rules
  • 3.17.x: no-navigation-without-resolve now supports ternary expressions and ResolvedPathname types

typescript-eslint 8.58.0 → 8.71.0
diff · changelog

globals 17.4.0 → 17.12.0
diff · changelog

prettier 3.8.1 → 3.9.9
diff · changelog

prettier-plugin-svelte 3.5.1 → 4.1.1
diff · changelog

Transitive dependencies

devalue 5.6.4 → 5.9.4 — diff · changelog — Clears high/moderate/low advisories. 5.9.3 rejects non-string null-prototype keys in parse/unflatten (__proto__ check bypass); 5.9.2 rejects out-of-bounds indices.

dompurify 3.3.3 → 3.4.16 — diff · changelog — Clears moderate/low (14 advisories). 3.4.0 fixes FORBID_TAGS bypasses, USE_PROFILES/CUSTOM_ELEMENT_HANDLING prototype pollution, mXSS via re-contextualization.

undici 7.24.4, 7.24.6 → 7.29.1, 8.11.2 — diff · changelog — Clears high/moderate/low (21 advisories); 8.x new via jsdom 30. 7.29.1 fixes BalancedPool dropping TLS callbacks and WebSocket subprotocol crash; 8.11.2 fixes HTTP/2 WebSocket handshake close.

ws 8.18.0 → 8.21.0 — diff · changelog — Clears high/moderate. 8.21.0 fixes remote memory-exhaustion DoS from tiny fragments; adds maxBufferedChunks/maxFragments options.

sharp 0.34.5 → 0.35.4 — diff · changelog — Clears high. 0.35.0 breaking: Node >=20.9, no install script; 0.35.4 bounds resize/composite coordinates, libvips 8.18.6.

postcss 8.5.8 → 8.5.28 — diff · changelog — Clears high/moderate. 8.5.28 fixes types regression; 8.5.26 tracks symlinks in source map path protection; many parser fixes.

nanoid 3.3.11 → 3.3.19 — diff · changelog — Clears high. Fixes infinite loops on zero/negative size and big ID requests; 3.3.19 fixes crash on huge user-supplied size.

brace-expansion 5.0.5 → 5.0.12 — diff — Clears high/moderate. no changelog found.

browserslist 4.28.2 → 4.29.3 — diff · changelog — Clears high. 4.29.1 hardens config name loading on Windows; 4.29.0 adds query continuations across lines; 4.29.3 updates Firefox ESR.

baseline-browser-mapping 2.10.13 → 2.11.26 — diff · changelog — Clears moderate. Link is the 2.11.0 release (no notes for 2.11.26): adds getTimeline(), throws instead of process.exit().

esbuild 0.27.3 → 0.28.1 — diff · changelog — Clears low. 0.28.1 blocks backslash in dev-server requests (Windows traversal), adds Deno API integrity checks; 0.28.0 adds with { type: 'text' } imports.

fflate 0.4.8 → 0.4.9 — diff — Clears moderate. no changelog found.

postcss-selector-parser 7.1.1 → 7.1.6 — diff · changelog — Clears low. 7.1.6 parses flat selectors in linear time (CPU exhaustion, GHSA-rj75-hqrm-r3gf); 7.1.2 fixes CVE-2026-9358.

@humanfs/node 0.16.7 → 0.16.8 — diff · changelog — Clears moderate. Copies symlinks as symlinks in copy()/copyAll(); includes type dependencies at runtime.

@vitest/mocker 4.1.2 → 5.0.3 — diff · changelog — Clears moderate. Moved with Vitest 5; 5.0.3 checks mock path boundaries in browser mode.

miniflare 4.20260329.0 → 5.20260930.0-alpha — diff · changelog — Major; wrangler 4.145.0 pins this exact version (alpha published as latest). Adds native Analytics SQL binding and beta K2 producer bindings.

Sentry SDK internals (@sentry/browser, @sentry/cloudflare, @sentry/core, @sentry/node, @sentry/opentelemetry, @sentry/svelte) 10.47.0 → 11.1.0 — diff · changelog — moved with @sentry/sveltekit; 11.0.0 breaking: Node >=20.19, renamed http.*/net.* span attributes, enableOpenTelemetrySetup.

@vitest/spy 4.1.2 → 5.0.3 — diff · changelog — Moved with Vitest 5; 5.0.0 breaking: mocks cleared before each test by default, Node 22 and Vite 6.4 required.

@asamuzakjp/css-color 5.1.1 → 7.1.2 — diff · changelog — 6.0.0 drops Node 20 and unused functions; 7.0.0 updates Node range; 7.1.2 copies options.

@asamuzakjp/dom-selector 7.0.4 → 9.2.2 — diff · changelog — 9.0.0 fixes case-insensitive attribute selectors; 9.2.2 filters camelCase SVG selectors, startup perf.

dotenv 16.6.1 → 17.4.2 — diff · changelog — 17.0.0 defaults quiet to false (logs on load; config({ quiet: true }) to suppress); 17.4.x log text and docs tweaks.

entities 6.0.1 → 8.1.0 — diff · changelog — 8.0.0 breaking: ESM-only, Node >=20.19, deprecated functions removed; 8.1.0 faster decode/escape.

file-entry-cache 8.0.0 → 11.1.5 — diff · changelog — 11.1.5 restores v8 reconcile and change-detection semantics; intermediate majors not itemised in release notes.

flat-cache 4.0.1 → 6.1.23 — diff · changelog — 6.1.23 migrates build from tsup to tsdown (internal); intermediate majors not itemised in release notes.

html-encoding-sniffer 6.0.0 → 7.0.0 — diff · changelog — Drops Node 20, sniffs XML encoding declarations, adds maxPrescanBytes option.

keyv 4.5.4 → 5.6.0 — diff · changelog — Link is the release covering 5.6.0 (2026-01-20): Bun support validated, generic iterator for KeyvGenericStore. No v5 major notes found.

magic-string 0.30.21 → 0.30.21, 1.4.2 — diff · changelog — 1.x added alongside 0.30.21; 1.4.2 keeps outro when splitting a removed chunk, faster removed-content lookup.

supports-color 10.2.2 → 10.2.2, 8.1.1 — changelog — 8.x added alongside 10.2.2; 8.1.1 fixes FORCE_COLOR check.

tinybench 2.9.0 → 6.2.0 — diff · changelog — 6.2.0 adds overriddenIterationCost; majors: 4.0.0 ESM-only, 5.0.0 drops Node 18, 6.0.0 removes deprecated TaskResult statistics fields.

w3c-xmlserializer 5.0.0 → 6.0.0 — diff · changelog — Requires Node ^22.22.2 || ^24.15.0 || >=26; fixes invalid-character rejection and namespace prefix leaking.

web-vitals 5.2.0 → 6.2.1, 6.2.2 — diff · changelog — 6.0.0 adds Soft Navigation support; 6.2.2 caps pending LoAFs (memory leak); 6.2.1 fixes negative inputDelay.

whatwg-url 16.0.1, 5.0.0 → 16.0.1, 17.1.2 — diff · changelog — 17.0.0 requires Node ^22.14 || >=24; 17.1.2 fixes parsing of constructor: scheme URLs; 5.0.0 no longer present.

why-is-node-running 2.3.0 → 3.2.1 — diff · changelog — 3.0.0 breaking: ESM-only, Node >=20.11, use --import; 3.2.1 omits untraceable stacks.

328 other transitive updates
  • @adobe/css-tools 4.4.4 → 4.5.0
  • @asamuzakjp/nwsapi removed 2.3.9
  • @babel/code-frame 7.29.0 → 7.29.7
  • @babel/compat-data 7.29.0 → 7.29.7
  • @babel/generator 7.29.1 → 7.29.8
  • @babel/helper-compilation-targets 7.28.6 → 7.29.7
  • @babel/helper-globals 7.28.0 → 7.29.7
  • @babel/helper-module-imports 7.28.6 → 7.29.7
  • @babel/helper-module-transforms 7.28.6 → 7.29.7
  • @babel/helper-string-parser 7.27.1 → 7.29.7
  • @babel/helper-validator-identifier 7.28.5 → 7.29.7
  • @babel/helper-validator-option 7.27.1 → 7.29.7
  • @babel/helpers 7.29.2 → 7.29.7
  • @babel/parser 7.29.2 → 7.29.9
  • @babel/runtime 7.29.2 → 7.29.7
  • @babel/template 7.28.6 → 7.29.7
  • @babel/traverse 7.29.0 → 7.29.8
  • @babel/types 7.29.0 → 7.29.8
  • @cacheable/memory added 2.2.0
  • @cacheable/utils added 2.5.0
  • @cloudflare/kv-asset-handler 0.4.2 → 0.5.0
  • @cloudflare/unenv-preset 2.16.0 → 2.16.2
  • @cloudflare/workerd-darwin-64 1.20260329.1 → 1.20260930.2
  • @cloudflare/workerd-darwin-arm64 1.20260329.1 → 1.20260930.2
  • @cloudflare/workerd-linux-64 1.20260329.1 → 1.20260930.2
  • @cloudflare/workerd-linux-arm64 1.20260329.1 → 1.20260930.2
  • @cloudflare/workerd-windows-64 1.20260329.1 → 1.20260930.2
  • @cloudflare/workers-types 4.20260331.1 → 4.20260702.1
  • @csstools/color-helpers 6.0.2 → 6.1.2
  • @csstools/css-calc 3.1.1 → 3.4.1
  • @csstools/css-color-parser 4.0.2 → 4.2.4
  • @csstools/css-parser-algorithms 4.0.0 → 4.0.1
  • @csstools/css-syntax-patches-for-csstree 1.1.2 → 1.1.14
  • @csstools/css-tokenizer 4.0.0 → 4.0.2
  • @emnapi/core removed 1.9.1
  • @emnapi/runtime 1.9.1 → 1.11.3
  • @emnapi/wasi-threads removed 1.2.0
  • @esbuild/aix-ppc64 0.27.3 → 0.28.1
  • @esbuild/android-arm 0.27.3 → 0.28.1
  • @esbuild/android-arm64 0.27.3 → 0.28.1
  • @esbuild/android-x64 0.27.3 → 0.28.1
  • @esbuild/darwin-arm64 0.27.3 → 0.28.1
  • @esbuild/darwin-x64 0.27.3 → 0.28.1
  • @esbuild/freebsd-arm64 0.27.3 → 0.28.1
  • @esbuild/freebsd-x64 0.27.3 → 0.28.1
  • @esbuild/linux-arm 0.27.3 → 0.28.1
  • @esbuild/linux-arm64 0.27.3 → 0.28.1
  • @esbuild/linux-ia32 0.27.3 → 0.28.1
  • @esbuild/linux-loong64 0.27.3 → 0.28.1
  • @esbuild/linux-mips64el 0.27.3 → 0.28.1
  • @esbuild/linux-ppc64 0.27.3 → 0.28.1
  • @esbuild/linux-riscv64 0.27.3 → 0.28.1
  • @esbuild/linux-s390x 0.27.3 → 0.28.1
  • @esbuild/linux-x64 0.27.3 → 0.28.1
  • @esbuild/netbsd-arm64 0.27.3 → 0.28.1
  • @esbuild/netbsd-x64 0.27.3 → 0.28.1
  • @esbuild/openbsd-arm64 0.27.3 → 0.28.1
  • @esbuild/openbsd-x64 0.27.3 → 0.28.1
  • @esbuild/openharmony-arm64 0.27.3 → 0.28.1
  • @esbuild/sunos-x64 0.27.3 → 0.28.1
  • @esbuild/win32-arm64 0.27.3 → 0.28.1
  • @esbuild/win32-ia32 0.27.3 → 0.28.1
  • @esbuild/win32-x64 0.27.3 → 0.28.1
  • @eslint-community/eslint-utils 4.9.1 → 4.10.1
  • @eslint/config-array 0.23.3 → 0.23.5
  • @eslint/config-helpers 0.5.3 → 0.7.0
  • @eslint/core 1.1.1 → 1.2.1
  • @eslint/object-schema 3.0.3 → 3.0.5
  • @eslint/plugin-kit 0.6.1 → 0.7.3
  • @exodus/bytes 1.15.0 → 1.16.0
  • @fastify/otel removed 0.18.0
  • @humanfs/core 0.19.1 → 0.19.2
  • @humanfs/types added 0.15.0
  • @img/sharp-darwin-arm64 0.34.5 → 0.35.4
  • @img/sharp-darwin-x64 0.34.5 → 0.35.4
  • @img/sharp-freebsd-wasm32 added 0.35.4
  • @img/sharp-libvips-darwin-arm64 1.2.4 → 1.3.3
  • @img/sharp-libvips-darwin-x64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-arm 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-arm64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-ppc64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-riscv64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-s390x 1.2.4 → 1.3.3
  • @img/sharp-libvips-linux-x64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linuxmusl-arm64 1.2.4 → 1.3.3
  • @img/sharp-libvips-linuxmusl-x64 1.2.4 → 1.3.3
  • @img/sharp-linux-arm 0.34.5 → 0.35.4
  • @img/sharp-linux-arm64 0.34.5 → 0.35.4
  • @img/sharp-linux-ppc64 0.34.5 → 0.35.4
  • @img/sharp-linux-riscv64 0.34.5 → 0.35.4
  • @img/sharp-linux-s390x 0.34.5 → 0.35.4
  • @img/sharp-linux-x64 0.34.5 → 0.35.4
  • @img/sharp-linuxmusl-arm64 0.34.5 → 0.35.4
  • @img/sharp-linuxmusl-x64 0.34.5 → 0.35.4
  • @img/sharp-wasm32 0.34.5 → 0.35.4
  • @img/sharp-webcontainers-wasm32 added 0.35.4
  • @img/sharp-win32-arm64 0.34.5 → 0.35.4
  • @img/sharp-win32-ia32 0.34.5 → 0.35.4
  • @img/sharp-win32-x64 0.34.5 → 0.35.4
  • @jridgewell/sourcemap-codec 1.5.5 → 1.6.0
  • @keyv/bigmap added 1.3.1
  • @keyv/serialize added 1.1.1
  • @napi-rs/wasm-runtime removed 1.1.2
  • @opentelemetry/api-logs removed 0.207.0, 0.208.0, 0.212.0, 0.214.0
  • @opentelemetry/context-async-hooks removed 2.6.1
  • @opentelemetry/core removed 2.2.0, 2.6.1
  • @opentelemetry/exporter-logs-otlp-http removed 0.208.0
  • @opentelemetry/instrumentation removed 0.207.0, 0.212.0, 0.214.0
  • @opentelemetry/instrumentation-amqplib removed 0.61.0
  • @opentelemetry/instrumentation-connect removed 0.57.0
  • @opentelemetry/instrumentation-dataloader removed 0.31.0
  • @opentelemetry/instrumentation-express removed 0.62.0
  • @opentelemetry/instrumentation-fs removed 0.33.0
  • @opentelemetry/instrumentation-generic-pool removed 0.57.0
  • @opentelemetry/instrumentation-graphql removed 0.62.0
  • @opentelemetry/instrumentation-hapi removed 0.60.0
  • @opentelemetry/instrumentation-http removed 0.214.0
  • @opentelemetry/instrumentation-ioredis removed 0.62.0
  • @opentelemetry/instrumentation-kafkajs removed 0.23.0
  • @opentelemetry/instrumentation-knex removed 0.58.0
  • @opentelemetry/instrumentation-koa removed 0.62.0
  • @opentelemetry/instrumentation-lru-memoizer removed 0.58.0
  • @opentelemetry/instrumentation-mongodb removed 0.67.0
  • @opentelemetry/instrumentation-mongoose removed 0.60.0
  • @opentelemetry/instrumentation-mysql removed 0.60.0
  • @opentelemetry/instrumentation-mysql2 removed 0.60.0
  • @opentelemetry/instrumentation-pg removed 0.66.0
  • @opentelemetry/instrumentation-redis removed 0.62.0
  • @opentelemetry/instrumentation-tedious removed 0.33.0
  • @opentelemetry/instrumentation-undici removed 0.24.0
  • @opentelemetry/otlp-exporter-base removed 0.208.0
  • @opentelemetry/otlp-transformer removed 0.208.0
  • @opentelemetry/redis-common removed 0.38.2
  • @opentelemetry/resources removed 2.2.0, 2.6.1
  • @opentelemetry/sdk-logs removed 0.208.0
  • @opentelemetry/sdk-metrics removed 2.2.0
  • @opentelemetry/sdk-trace-base removed 2.2.0, 2.6.1
  • @opentelemetry/semantic-conventions removed 1.40.0
  • @opentelemetry/sql-common removed 0.41.2
  • @oxc-parser/binding-android-arm-eabi added 0.143.0
  • @oxc-parser/binding-android-arm64 added 0.143.0
  • @oxc-parser/binding-darwin-arm64 added 0.143.0
  • @oxc-parser/binding-darwin-x64 added 0.143.0
  • @oxc-parser/binding-freebsd-x64 added 0.143.0
  • @oxc-parser/binding-linux-arm-gnueabihf added 0.143.0
  • @oxc-parser/binding-linux-arm-musleabihf added 0.143.0
  • @oxc-parser/binding-linux-arm64-gnu added 0.143.0
  • @oxc-parser/binding-linux-arm64-musl added 0.143.0
  • @oxc-parser/binding-linux-ppc64-gnu added 0.143.0
  • @oxc-parser/binding-linux-riscv64-gnu added 0.143.0
  • @oxc-parser/binding-linux-riscv64-musl added 0.143.0
  • @oxc-parser/binding-linux-s390x-gnu added 0.143.0
  • @oxc-parser/binding-linux-x64-gnu added 0.143.0
  • @oxc-parser/binding-linux-x64-musl added 0.143.0
  • @oxc-parser/binding-openharmony-arm64 added 0.143.0
  • @oxc-parser/binding-win32-arm64-msvc added 0.143.0
  • @oxc-parser/binding-win32-ia32-msvc added 0.143.0
  • @oxc-parser/binding-win32-x64-msvc added 0.143.0
  • @oxc-project/types 0.122.0 → 0.143.0, 0.152.0
  • @posthog/browser-common added 0.9.0
  • @posthog/core 1.24.4 → 1.55.2
  • @posthog/types 1.364.4 → 1.413.0
  • @prisma/instrumentation removed 7.6.0
  • @protobufjs/aspromise removed 1.1.2
  • @protobufjs/base64 removed 1.1.2
  • @protobufjs/codegen removed 2.0.4
  • @protobufjs/eventemitter removed 1.1.0
  • @protobufjs/fetch removed 1.1.0
  • @protobufjs/float removed 1.0.2
  • @protobufjs/inquire removed 1.1.0
  • @protobufjs/path removed 1.1.2
  • @protobufjs/pool removed 1.1.0
  • @protobufjs/utf8 removed 1.1.0
  • @rolldown/binding-android-arm-eabi added 1.2.12
  • @rolldown/binding-android-arm64 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-darwin-arm64 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-darwin-x64 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-freebsd-x64 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-arm-gnueabihf 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-arm64-gnu 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-arm64-musl 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-ppc64-gnu 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-s390x-gnu 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-x64-gnu 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-linux-x64-musl 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-openharmony-arm64 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-wasm32-wasi removed 1.0.0-rc.12
  • @rolldown/binding-win32-arm64-msvc 1.0.0-rc.12 → 1.2.12
  • @rolldown/binding-win32-x64-msvc 1.0.0-rc.12 → 1.2.12
  • @rolldown/pluginutils 1.0.0-rc.12 → 1.0.1
  • @sentry-internal/browser-utils removed 10.47.0
  • @sentry-internal/feedback removed 10.47.0
  • @sentry-internal/replay removed 10.47.0
  • @sentry-internal/replay-canvas removed 10.47.0
  • @sentry/babel-plugin-component-annotate removed 5.1.1
  • @sentry/browser-utils added 11.1.0
  • @sentry/bundler-plugin-core removed 5.1.1
  • @sentry/bundler-plugins added 11.1.0
  • @sentry/cli removed 2.58.5
  • @sentry/cli-darwin removed 2.58.5
  • @sentry/cli-linux-arm removed 2.58.5
  • @sentry/cli-linux-arm64 removed 2.58.5
  • @sentry/cli-linux-i686 removed 2.58.5
  • @sentry/cli-linux-x64 removed 2.58.5
  • @sentry/cli-win32-arm64 removed 2.58.5
  • @sentry/cli-win32-i686 removed 2.58.5
  • @sentry/cli-win32-x64 removed 2.58.5
  • @sentry/conventions added 0.24.0
  • @sentry/feedback added 11.1.0
  • @sentry/node-core removed 10.47.0
  • @sentry/replay added 11.1.0
  • @sentry/replay-canvas added 11.1.0
  • @sentry/rollup-plugin removed 5.1.1
  • @sentry/server-runtime-injection added 11.1.0
  • @sentry/server-utils added 11.1.0
  • @sentry/vite-plugin removed 5.1.1
  • @speed-highlight/core 1.2.15 → 1.2.24
  • @sveltejs/acorn-typescript 1.0.9 → 1.0.13
  • @sveltejs/load-config added 0.2.3
  • @testing-library/dom 10.4.1 → 10.4.2
  • @testing-library/svelte-core 1.0.0 → 1.1.3
  • @tybys/wasm-util removed 0.10.1
  • @types/connect removed 3.4.38
  • @types/estree 1.0.8 → 1.0.8, 1.0.9
  • @types/mysql removed 2.15.27
  • @types/pg removed 8.15.6
  • @types/pg-pool removed 2.0.7
  • @types/tedious removed 4.0.14
  • @typescript-eslint/eslint-plugin 8.58.0 → 8.71.0
  • @typescript-eslint/parser 8.58.0 → 8.71.0
  • @typescript-eslint/project-service 8.58.0 → 8.71.0
  • @typescript-eslint/scope-manager 8.58.0 → 8.71.0
  • @typescript-eslint/tsconfig-utils 8.58.0 → 8.71.0
  • @typescript-eslint/type-utils 8.58.0 → 8.71.0
  • @typescript-eslint/types 8.58.0 → 8.71.0
  • @typescript-eslint/typescript-estree 8.58.0 → 8.71.0
  • @typescript-eslint/utils 8.58.0 → 8.71.0
  • @typescript-eslint/visitor-keys 8.58.0 → 8.71.0
  • @vitest/expect removed 4.1.2
  • @vitest/pretty-format removed 4.1.2
  • @vitest/runner removed 4.1.2
  • @vitest/snapshot removed 4.1.2
  • @vitest/utils removed 4.1.2
  • acorn 8.16.0 → 8.18.0
  • acorn-import-attributes removed 1.9.5
  • agent-base removed 6.0.2
  • ajv 6.14.0 → 6.15.0
  • bidi-js 1.0.3 → 1.1.0
  • cacheable added 2.5.0
  • caniuse-lite 1.0.30001782 → 1.0.30001814
  • chai 6.2.2 → 6.3.0
  • cjs-module-lexer removed 2.2.0
  • core-js 3.49.0 → 3.50.0
  • electron-to-chromium 1.5.329 → 1.5.443
  • es-module-lexer 2.0.0 → 2.3.2
  • esrap 2.2.4 → 2.4.0
  • expect-type 1.3.0 → 1.4.0
  • flatted 3.4.2 → 3.4.4
  • forwarded-parse removed 2.1.2
  • fsevents 2.3.2, 2.3.3 → 2.3.3
  • has-flag added 4.0.0
  • hashery added 1.5.1
  • hookified added 1.15.1, 2.2.0
  • https-proxy-agent removed 5.0.1
  • ignore 5.3.2, 7.0.5 → 5.3.2, 7.0.11
  • import-in-the-middle removed 2.0.6, 3.0.0
  • json-buffer removed 3.0.1
  • lightningcss 1.32.0 → 1.33.0
  • lightningcss-android-arm64 1.32.0 → 1.33.0
  • lightningcss-darwin-arm64 1.32.0 → 1.33.0
  • lightningcss-darwin-x64 1.32.0 → 1.33.0
  • lightningcss-freebsd-x64 1.32.0 → 1.33.0
  • lightningcss-linux-arm-gnueabihf 1.32.0 → 1.33.0
  • lightningcss-linux-arm64-gnu 1.32.0 → 1.33.0
  • lightningcss-linux-arm64-musl 1.32.0 → 1.33.0
  • lightningcss-linux-x64-gnu 1.32.0 → 1.33.0
  • lightningcss-linux-x64-musl 1.32.0 → 1.33.0
  • lightningcss-win32-arm64-msvc 1.32.0 → 1.33.0
  • lightningcss-win32-x64-msvc 1.32.0 → 1.33.0
  • long removed 5.3.2
  • lru-cache 11.2.7, 5.1.1 → 11.5.3, 5.1.1
  • minimatch 10.2.5 → 10.2.6
  • module-details-from-path removed 1.0.4
  • node-fetch removed 2.7.0
  • node-releases 2.0.36 → 2.0.57
  • obug 2.1.1 → 2.2.1
  • oxc-parser added 0.143.0
  • parse5 8.0.0 → 8.0.1
  • pg-int8 removed 1.0.1
  • pg-protocol removed 1.13.0
  • pg-types removed 2.2.0
  • picomatch 4.0.4 → 4.0.7
  • playwright 1.58.2 → 1.63.0
  • playwright-core 1.58.2 → 1.63.0
  • postcss-safe-parser 7.0.1 → 7.1.0
  • postgres-array removed 2.0.0
  • postgres-bytea removed 1.0.1
  • postgres-date removed 1.0.7
  • postgres-interval removed 1.2.0
  • preact 10.29.0 → 10.29.8
  • progress removed 2.0.3
  • protobufjs removed 7.5.4
  • proxy-from-env removed 1.1.0
  • qified added 0.10.1
  • require-in-the-middle removed 8.0.1
  • rolldown 1.0.0-rc.12 → 1.2.12
  • semver 6.3.1, 7.7.4 → 6.3.1, 7.8.5
  • sentry added 0.44.1
  • set-cookie-parser 3.1.0 → 3.1.2
  • siginfo removed 2.0.0
  • source-map-js 1.2.1 → 1.2.2
  • stackback removed 0.0.2
  • std-env 4.0.0 → 4.3.0
  • svelte-eslint-parser 1.6.0 → 1.8.1
  • symbol-tree removed 3.2.4
  • tinyexec 1.0.4 → 1.3.1
  • tinyglobby 0.2.15 → 0.2.17
  • tinyrainbow removed 3.1.0
  • tldts 7.0.27 → 7.4.16
  • tldts-core 7.0.27 → 7.4.16
  • tough-cookie 6.0.1 → 6.0.2
  • tr46 0.0.3, 6.0.0 → 6.0.0
  • update-browserslist-db 1.2.3 → 1.3.3
  • vitefu 1.1.2 → 1.1.3
  • webidl-conversions 3.0.1, 8.0.1 → 8.0.1
  • workerd 1.20260329.1 → 1.20260930.2
  • xtend removed 4.0.2
  • zimmerframe 1.1.4 → 1.1.5

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Updated (UTC)
✅ Deployment successful!
View logs		 is-it-shorts-weather-today ad987f3 Oct 01 2026, 09:27 PM

@tommyp
tommyp merged commit 8b9d359 into main Oct 1, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

@testing-library/svelte-core wrapper-scaffold.svelte fails to compile when consumer enables runes mode

1 participant

@tommyp