fix(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@types/react-dom (source)	^19.2.4 → ^19.2.5			devDependencies	patch
@vitejs/devtools (source)	^0.5.1 → ^0.6.2			devDependencies	minor
@vitejs/plugin-react (source)	^6.1.0 → ^6.1.1			devDependencies	patch
@vitejs/release-scripts	^1.9.2 → ^1.10.0			devDependencies	minor
@vue/shared (source)	^3.5.41 → ^3.5.42			dependencies	patch
MatteoGabriele/agentscan-action	v2.4.0 → v2.5.0			action	minor
baseline-browser-mapping	^2.11.18 → ^2.11.20			devDependencies	patch
eslint (source)	10.9.0 → 10.9.1				patch
eslint-plugin-react-refresh	0.5.4 → 0.5.5				patch
github/codeql-action	v4.37.8 → v4.37.9			action	patch
lint-staged	^17.3.0 → ^17.4.1			devDependencies	minor
magic-string	^1.2.2 → ^1.2.3			dependencies	patch
magic-string	^1.2.2 → ^1.2.3			devDependencies	patch
oxfmt (source)	^0.64.0 → ^0.65.0			devDependencies	minor
oxlint (source)	^1.79.0 → ^1.80.0			devDependencies	minor
phoenix	^1.8.12 → ^1.8.13			dependencies	patch
picomatch	^4.0.5 → ^4.0.7			dependencies	patch
semgrep/semgrep	1.174.0 → 1.175.0			container	minor
simple-git-hooks	^2.13.1 → ^2.14.0			devDependencies	minor
svelte (source)	^5.56.10 → ^5.57.0			devDependencies	minor
terser (source)	^5.50.0 → ^5.51.2			devDependencies	minor
tsx (source)	^4.23.12 → ^4.23.13			devDependencies	patch
typescript-eslint (source)	8.67.0 → 8.68.0				minor
typescript-eslint (source)	^8.67.0 → ^8.68.0			devDependencies	minor
vitejs/release-scripts	v1.9.2 → v1.10.0			action	minor
vue (source)	^3.5.41 → ^3.5.42			dependencies	patch
vue (source)	^3.5.41 → ^3.5.42			devDependencies	patch
zizmorcore/zizmor-action	v0.6.2 → v0.6.3			action	patch

---

Release Notes

vitejs/devtools (@​vitejs/devtools)

v0.6.2

Compare Source

   🐞 Bug Fixes

• kit: Restore rpc module augmentation  -  by @​webfansplz in #​551 (c008f)

    View changes on GitHub

v0.6.1

Compare Source

   🚀 Features

• core:
  • Support configurable dock renderers  -  by @​dvcolomban in #​542 (e2928)
  • Allow hosts to override the client auth banner  -  by @​danielroe in #​548 (1c716)
• oxc:
  • Oxfmt setup  -  by @​yuyinws in #​545 (99329)

   🐞 Bug Fixes

• vite: Show unavailable tips in standalone mode  -  by @​webfansplz in #​544 (85e6f)

    View changes on GitHub

v0.6.0

Compare Source

No significant changes

    View changes on GitHub

v0.5.2

Compare Source

   🚀 Features

• core:
  • Allow hosts to override DevTools branding  -  by @​antfubot and @​antfu in #​543 (de9e3)
  • Support vite devtools in serve mode  -  by @​webfansplz in #​541 (9df9d)

    View changes on GitHub

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.1.1

Compare Source

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#​1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

vitejs/release-scripts (@​vitejs/release-scripts)

v1.10.0

Compare Source

vuejs/core (@​vue/shared)

v3.5.42

Compare Source

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#​15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#​15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#​15291) (b535917), closes #​15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#​15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#​15313) (8654f35), closes #​12680
• runtime-dom: support !important on CSS custom properties in style binding (#​15348) (31da934)
• server-renderer: reject CR in attribute names (#​15266) (a2b40db)
• shared: correctly compare Map and Set values (#​15328) (ef82a26), closes #​15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#​15333) (cd19745), closes #​15332
• v-model: re-sync select when model is overridden in change handler (#​15298) (6eaecc1), closes #​10505

MatteoGabriele/agentscan-action (MatteoGabriele/agentscan-action)

v2.5.0

Compare Source

Identity update:

• fix(detectors): branch pr automation flag

Full Changelog: MatteoGabriele/agentscan-action@v2.4.0...v2.5.0

web-platform-dx/baseline-browser-mapping (baseline-browser-mapping)

v2.11.20

Compare Source

v2.11.19

Compare Source

eslint/eslint (eslint)

v10.9.1

Compare Source

ArnaudBarre/eslint-plugin-react-refresh (eslint-plugin-react-refresh)

v0.5.5

Compare Source

• Fix SCREAMING_SNAKE_CASE constant exported via export { Name } incorrectly treated as React component #​114 (fixes #​113)
• Add contentType and size to allowExportNames in Next config #​115

github/codeql-action (github/codeql-action)

v4.37.9

Compare Source

• Update default CodeQL bundle version to 2.26.4. #​4106

lint-staged/lint-staged (lint-staged)

v17.4.1

Compare Source

Patch Changes

• #​1840 efe5b63 - This is a version-bump-only release because the previous version 17.4.0 was not published to npmjs.com due to problems with GitHub Actions and Changesets.

Rich-Harris/magic-string (magic-string)

v1.2.3

Compare Source

Bug Fixes

• clamp negative indices below -length instead of wrapping repeatedly (#​337) (9391bb7)
• guess the most common indentation in a bundle (#​334) (111b030)
• handle empty matches in replace and replaceAll (#​335) (b6a53f7)
• trim the separators between sources (#​333) (1bb4cce)

oxc-project/oxc (oxfmt)

v0.65.0

Compare Source

oxc-project/oxc (oxlint)

v1.80.0

Compare Source

phoenixframework/phoenix (phoenix)

v1.8.13

Compare Source

Bug fixes

• Workaround issue where Mobile Chrome 149+ would not reconnect after tab is resumed (#​6804)

micromatch/picomatch (picomatch)

v4.0.7

Compare Source

Fixed

• Fixed terminal globstars in parenthesized patterns (#​142, e279bd7).

v4.0.6

Compare Source

Fixed

• scan() now scans the full pattern when tokens are requested, instead of merging the remaining path segments into the final token (#​62, 5f5819d).
• scan() now returns complete pattern parts, including leading and trailing empty segments, and handles nested and escaped parentheses correctly (#​58, f201165).

toplenboren/simple-git-hooks (simple-git-hooks)

v2.14.0

Compare Source

What's Changed

• chore: remove some unnecessary ignore files by @​chouchouji in #​135
• Support node_modules created with bun install --linker=isolated by @​dylan-conway in #​136
• feat: silent success if nothing has changed by @​younggglcy in #​138
• README.md - better info about uninstall, manual uninstall by @​MirKml in #​143
• Update installation guide and usages in README.md by @​toplenboren in #​147
• fix: install and remove hooks correctly inside a git worktree by @​wmaurer in #​149
• fix: skip postinstall when project has no package.json by @​DanMat in #​151
• fix: resolve project root via INIT_CWD in postinstall by @​colinhacks in #​146

New Contributors

• @​dylan-conway made their first contribution in #​136
• @​younggglcy made their first contribution in #​138
• @​MirKml made their first contribution in #​143
• @​wmaurer made their first contribution in #​149
• @​DanMat made their first contribution in #​151
• @​colinhacks made their first contribution in #​146

Full Changelog: toplenboren/simple-git-hooks@2.13.1...2.14.0

sveltejs/svelte (svelte)

v5.57.0

Compare Source

Minor Changes

• feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#​18648)

• feat: add has function to createContext (#​18472)

• feat: support defaultValue on <select> (#​18591)

• feat: add getOrInsert/getOrInsertComputed to SvelteMap (#​18728)

Patch Changes

• fix: block template store subscriptions on the promise that assigns the store (#​18582)

• fix: route $derived teardown errors through invoke_error_boundary (#​18486)

• fix: track SvelteDate snapshots in reactions (#​18700)

• fix: remove <svelte:head> anchors on unmount (#​18697)

• fix: warn on undeclared shorthand event handlers on <svelte:window>, <svelte:document> and <svelte:body> (#​18480)

• perf: reuse the cached value in the <option>/<select> value guard (#​18713)

• fix: prevent malformed AST output for <select> with static value attribute (#​18449)

• fix: apply ownership mutation ignores to binding assignments (#​18718)

• fix: prevent onoutroend from firing twice when compilerOptions.hmr is true (#​18655)

• fix: preserve whitespace after inline elements when printing (#​18685)

• perf: fold SSR block-open markers into the branch's first push (#​18712)

• fix: run onDestroy callbacks when a server render throws (#​18585)

• fix: report derived_invalid_export for export let x = $derived(...) in runes mode (#​18692)

• fix: never apply class hash to elements inside <svelte:head> (#​18160)

• fix: keep defaultChecked on hydrated radio inputs with spread attributes (#​18701)

• fix: accept onfocusin/onfocusout in a11y_mouse_events_have_key_events (#​18689)

• perf: O(n²)→O(n) Map lookups for legacy $: reactive statement ordering (#​18602)

• fix: distinct memoizer on style/class directives (#​18466)

• fix: measure nested transitions before applying their starting styles (#​18647)

• fix: don't turn component instances stored in $state into state proxies (#​18646)

• perf: emit $.only_child for elements with a single child (#​18717)

• fix: omit bind:focused from SSR output (it has no HTML attribute) (#​18724)

• fix: more robust rendering of Svelte custom element slots (#​18710)

• perf: optimize simple object destructuring in @const tags (#​18390)

• fix: properly apply static textarea value attribute during CSR (#​18727)

• fix: end a restored reaction context at the end of its synchronous segment (#​18694)

• fix: keep the dependencies of a reaction that throws, so deriveds it read are neither leaked nor stuck in their error (#​18703)

• fix: don't resurrect outroing elements when an ancestor block is paused and resumed (#​18431)

• perf: use $.comment() for single-comment templates (#​18714)

• chore: move @types/trusted-types to devDependencies (#​18730)

• perf: store setters cache as Set instead of Array (#​18251)

• fix: transform derived assignments and select function bindings correctly during server-side rendering (#​18669)

• fix: keep boolean attributes with an empty string value when rendering attribute objects on the server (#​18721)

• fix: sync SvelteURL port signal when the protocol setter clears the port (#​18705)

• fix: block declaration tags and {@const} on async values read inside closures (#​18533)

• fix: avoid css tree-shaking for exported Snippet (#​18540)

• perf: treat <img loading> as a static element again (#​18711)

• fix: prevent selectedcontent mutation from changing the selected option (#​18495)

• fix: avoid NaN keyframe values in slide transition for elements without a layout box (#​18430)

• fix: preserve line feed character references in attribute values (#​18691)

• fix: decode uppercase-X hex numeric character references (&#X...;) (#​18708)

• chore: clarify when $effect.pre runs relative to DOM updates (#​18534)

• fix: scope SSR boundary failed snippets to their boundary (#​18593)

terser/terser (terser)

v5.51.2

Compare Source

• Roll back fix for ambiguously scoped default args, due to issues that came up without clear reproduction

v5.51.1

Compare Source

• Fix transforming code in dynamic import argument.

v5.51.0

Compare Source

• Pin (deoptimize) functions that use argnames scope in ambiguous way. IE when default args access other args, or variables outside the function.
• Fix nullish coalescing ?? operator being considered a "boolean operator" sometimes causing booleans to be generated in its left side.

privatenumber/tsx (tsx)

v4.23.13

Compare Source

typescript-eslint/typescript-eslint (typescript-eslint)

v8.68.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

zizmorcore/zizmor-action (zizmorcore/zizmor-action)

v0.6.3

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.