chore(deps)(deps): bump the npm-all group across 8 directories with 53 updates

[dependabot]

Bumps the npm-all group with 34 updates in the / directory:

Package	From	To
@lingui/core	5.9.2	5.9.5
@noble/hashes	2.0.1	2.2.0
dompurify	3.4.2	3.4.11
@types/dompurify	3.0.5	3.2.0
idb-keyval	6.2.2	6.2.5
lit-html	3.3.2	3.3.3
zod	4.3.6	4.4.3
@eslint/compat	2.0.3	2.1.0
@lingui/cli	5.9.2	5.9.5
@lingui/vite-plugin	5.9.2	5.9.5
@playwright/test	1.58.2	1.61.0
@sveltejs/kit	2.54.0	2.65.2
@tailwindcss/vite	4.2.1	4.3.1
@types/node	25.4.0	25.9.3
@vitejs/plugin-basic-ssl	2.1.4	2.3.0
@vitest/browser	4.1.8	4.1.9
@zag-js/svelte	1.35.3	1.41.2
@zag-js/toast	1.35.3	1.41.2
devtools-protocol	0.0.1596832	0.0.1648812
eslint	10.0.3	10.5.0
eslint-plugin-svelte	3.15.2	3.19.0
prettier	3.8.1	3.8.4
prettier-plugin-svelte	3.5.1	3.5.2
prettier-plugin-tailwindcss	0.7.2	0.8.0
svelte	5.53.10	5.56.3
svelte-check	4.4.5	4.6.0
typescript	5.2.2	5.9.3
typescript-eslint	8.57.0	8.61.1
vite	7.3.3	7.3.5
vite-plugin-node-polyfills	0.25.0	0.28.0
@vitejs/plugin-react	5.1.4	5.2.0
undici	7.22.0	7.28.0
vite-plugin-compression2	2.5.1	2.5.3
vite-plugin-wasm	3.5.0	3.6.0

Bumps the npm-all group with 4 updates in the /demos/test-app directory: typescript, vite, vite-plugin-node-polyfills and @icp-sdk/signer.
Bumps the npm-all group with 11 updates in the /demos/using-dev-build directory:

Package	From	To
prettier	2.8.3	2.8.8
prettier-plugin-organize-imports	3.2.2	3.2.4
ts-node	10.9.1	10.9.2
typescript	5.0.4	5.9.3
@icp-sdk/auth	4.1.0	4.2.0
@types/mocha	10.0.6	10.0.10
@wdio/cli	8.32.3	8.46.0
@wdio/globals	8.32.3	8.46.0
@wdio/local-runner	8.32.3	8.46.0
@wdio/mocha-framework	8.32.3	8.46.0
@wdio/spec-reporter	8.21.0	8.43.0

Bumps the npm-all group with 2 updates in the /demos/vc_issuer directory: typescript and vite-plugin-node-polyfills.
Bumps the npm-all group with 1 update in the /src/sig-verifier-js directory: typescript.
Bumps the npm-all group with 2 updates in the /src/test_openid_provider directory: oidc-provider and express.
Bumps the npm-all group with 12 updates in the /src/try-ii directory:

Package	From	To
@lucide/svelte	0.513.0	0.577.0
@sveltejs/adapter-static	3.0.8	3.0.10
@sveltejs/kit	2.21.2	2.65.2
@tailwindcss/forms	0.5.10	0.5.11
@tailwindcss/vite	4.1.8	4.3.1
@zag-js/svelte	1.15.0	1.41.2
@zag-js/toast	1.15.0	1.41.2
svelte	5.33.14	5.56.3
svelte-check	4.2.1	4.6.0
typescript	5.8.3	5.9.3
dotenv	16.5.0	16.6.1
sass	1.89.1	1.101.0

Bumps the npm-all group with 1 update in the /src/try-ii/src/try-ii-frontend directory: @lucide/svelte.

Updates @lingui/core from 5.9.2 to 5.9.5

Release notes

Sourced from @​lingui/core's releases.

v5.9.5

5.9.5 (2026-04-06)

Bug Fixes

• support braces in catalog pathname (#2495) (db14681)

v5.9.4

5.9.4 (2026-03-27)

Bug Fixes

• cli: really keep catalog extra from previous catalog (#2479) (c939113)

v5.9.3

5.9.3 (2026-03-13)

Bug Fixes

• support Vite 8 (#2474) (e4468c7)

Changelog

Sourced from @​lingui/core's changelog.

5.9.5 (2026-04-06)

Note: Version bump only for package @​lingui/core

5.9.4 (2026-03-27)

Note: Version bump only for package @​lingui/core

5.9.3 (2026-03-13)

Note: Version bump only for package @​lingui/core

Commits

• 7b55bd7 chore(release): published v5.9.5 [skip ci] (#2499)
• 8303dbf chore(release): published v5.9.4 [skip ci] (#2483)
• 67be09c chore(release): published v5.9.3 [skip ci] (#2476)
• See full diff in compare view

Updates @noble/hashes from 2.0.1 to 2.2.0

Release notes

Sourced from @​noble/hashes's releases.

2.2.0

• March 2026 self-audit (all files): no major issues found
  • Audited for spec compliance and security
  • Fix: dkLen=0 handling in pbkdf2, blake2, turboshake, kt
  • Fix: parallelHash with blockLen=0
  • Fix: argon2 progress callback now reaches 100%
  • Improve: digestInto no longer returns a value (better performance)
  • Improve: argon2, blake2 support non-4-divisible dkLen
• Fix all Byte Array types, to ensure proper work in both TypeScript 5.6 & TypeScript 5.9+
  • TS 5.6 has Uint8Array, while TS 5.9+ made it generic Uint8Array<ArrayBuffer>
  • This creates incompatibility of code between versions
  • Previously, it was hard to use and constantly emitted errors similar to TS2345
  • See typescript#62240 for more context
• sha3: speed-up by up to 50%. Contributed by @​ChALkeR in paulmillr/noble-hashes#126
• Fix compilation issues on TypeScript v6
• Make package Big Endian friendly. All tests pass on s390x
• Improve tree-shaking, reduce bundle sizes
• Add massive amounts of documentation everywhere

(We're skipping v2.1, to align with other noble packages)

Full Changelog: paulmillr/noble-hashes@2.0.1...2.2.0

Commits

• 81983c2 Release 2.2.0.
• 8883d32 Minor syntax fixes
• e5fedba Run prettier format on tests
• 72e2083 Changes related to March 2026 audit (new tests)
• fd9f580 Changes related to March 2026 audit (typed arrays)
• 9a216b5 Changes related to March 2026 audit
• 85e35d5 Clarify sha3.
• cc8ea40 Merge pull request #126 from ChALkeR/chalker/unroll/sha3/0/chi
• 46c3129 Bump typescript to 6.0.2
• ca90465 Bump devdeps.
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​noble/hashes since your current version.

Updates dompurify from 3.4.2 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

DOMPurify 3.4.7

• Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
• Removed a problem leading to permanent hook pollution, thanks @​offset
• Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

• Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
• Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
• Added more test coverage for IN_PLACE and general DOM Clobbering attacks
• Bumped several dependencies where possible

DOMPurify 3.4.5

• Fixed a bypass caused by the new HTML element selectedcontent added in 3.4.4, thanks @​KabirAcharya

Note that this is a security release for an issue introduced in 3.4.4 and should be upgraded to immediately.

... (truncated)

Commits

• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• ca30f07 release: 3.4.7 (#1414)
• bb7739e release: 3.4.6 (#1394)
• 011b0c7 release: 3.4.5 (#1382)
• 5817ad9 release: 3.4.4 (#1374)
• 520edb0 release: 3.4.3 (#1352)
• See full diff in compare view

Updates @types/dompurify from 3.0.5 to 3.2.0

Commits

• See full diff in compare view

Updates idb-keyval from 6.2.2 to 6.2.5

Commits

• 0c06d26 6.2.5
• 6fe29f1 fix: update() hanging on bad key, remove dead type file (#183)
• e674340 6.2.4
• ea62a7d Fix d.ts location in build
• d5b7e4f 6.2.3
• 99085cf Fix three bugs: nested transaction in entries(), build cleanup, and unpkg p...
• See full diff in compare view

Updates lit-html from 3.3.2 to 3.3.3

Release notes

Sourced from lit-html's releases.

lit-html@3.3.3

Patch Changes

• #5218 be6b275035079db3239be4019c4f93c2b1f32428 Thanks @​louis-bompart! - Ensure the ref directive disconnect gracefuly when its internal ref is undefined.

Changelog

Sourced from lit-html's changelog.

3.3.3

Patch Changes

• #5218 be6b275035079db3239be4019c4f93c2b1f32428 Thanks @​louis-bompart! - Ensure the ref directive disconnect gracefuly when its internal ref is undefined.

Commits

• 20afabd Version Packages (#5337)
• be6b275 [lit-html] Handle undefined arg on disconnect for ref directive (#5218)
• 0fc671b Version Packages (#5183)
• bc2926e [lit-html] Include SVGElement in render root union type (#5064)
• 0d0170e [lit-html] Make ClassInfo mutable (#5044)
• c36626b Make our directives generic, for better type checking of lit templates (#5035)
• e7e52c8 [lit-html] Update expectations for browser change to escaping quoted attributes
• 36c6d73 [all] Regenerate package-lock
• 43c6168 Version Packages (#5019)
• aea85e2 [all] A bunch of README updates (#4997)
• Additional commits viewable in compare view

Updates zod from 4.3.6 to 4.4.3

Release notes

Sourced from zod's releases.

v4.4.3

Commits:

• 4c2fa95ce3f3390fbc522324e406b4e9e89b88f9 docs: use Zernio primary wordmark for gold sponsor logo
• 2aeec83eb135e3a83756e973ef44845fc5a455d2 docs: prune lapsed gold sponsors and rebalance logo sizing
• 7391be88ac1ee5cd02057f5ccc012a1f5df4efd0 docs: prune lapsed silver/bronze sponsors and add active ones
• 2c703322a21b4e2b12f33f49ea8430c451a68b4f docs: normalize bronze sponsor logos to github avatar pattern
• 9195250cab0e7950efe39c3926d6c203b4b0a170 docs: remove Mintlify from bronze sponsors (churned)
• b8dffe9e62f17e6571e6249d05cc5102b54d94e4 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
• 1cab69383fcdeae2a366d5e2a2fc4d8fc765d168 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
• c2be4f819064eed62c7c350a2d399b5faecd15f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent keys (#5941)
• f3c9ec03ba7a28ae72d25cc295f38674bee0f559 4.4.3
• 1fb56a5c18c27102dbc92260a4007c7732a0ccca docs: document release procedure in AGENTS.md

v4.4.2

Commits:

• 0c62df0ea19fd05abdf90473e9eef7eea530fab2 Clean up docs navigation and stale labels (#5901)
• 20cc794895cc8604fe0c87d83a5d1c3f89fad0ac chore: add security policy and refresh tooling deps
• 6fbe07b0177efdd1bf1c0b05160e70d7a0702337 fix(docs): heading anchor links now include the hash so it doesnt scoll all the way up, follows navbar logic (#5791)
• 4bbed1b1c73eca4ce9e59b1189ed236aa6c8b5bd Tighten discriminated union option typing
• bbac3e567e7fccfaaf7cdc97f1ce30c295e2c908 Update PR guidance for agents
• cf0dc942a32805c292fff59ade20a7ace980735a Merge remote-tracking branch 'origin/main' into fix-discriminated-union-key-constraint
• 292c894a5fd2aa42e527900b83d8d7a3009a709c docs: add Zernio gold sponsor
• 1fc9f311c28dcf80d0bb5a36b177086cbc3d8eca docs: document codec inversion
• 1373c85da9aeff704a9762d27bc58699618aefb7 docs: remove AI disclosure guidance
• e20d02b473c08e3a4e557bc610b1b5fac079b649 chore: ignore triage notes
• e58ea4d91b1dfe8194b73508203213cbc7e9c936 docs: test Zod Mini tab code heights
• 905761a5d127e8d5dd2ebb3bc88c75cb0b8149ff docs: document preprocess input type narrowing
• bf64bac850d4dee2b7dde7e64909d5d796d32043 chore: tighten test guidance in AGENTS.md
• 8ec4e73f4c4693b6361ad591be40fb41eb8a9f95 chore: update play.ts scratch
• 02c2baf7d0d615872fa4528a8020603b71211702 Make z.preprocess defer optionality to inner schema (#5929)
• 88015df8e25c44fb5385eb3ef28935119cd5edea fix(docs): drop deprecated baseUrl from tsconfig
• c59d4474e3b4cad1b323462186cf607178ce8267 4.4.2

v4.4.1

Commits:

• 481f7be4238c83ed58183f921b2646f340a91c6a ci: gate release publishing on full test workflow
• 95ccab423aec720b2523c3a64cdc7e3204537cc7 test(v3): restore optional undefined expectations
• cede2c63739a5823d6aa5093d291e9a111da943d fix(v4): reject tuple holes before required defaults (#5900)
• edd0bf0f5ada4a8dc581c259407d7bbad0a71ea7 release: 4.4.1
• 180d83d1dbe6a59260710cc8637a3dea2281ee56 docs: remove Jazz featured sponsor

v4.4.0

4.4.0

This is a minor release with a wide set of correctness and soundness fixes. Some fixes intentionally make Zod stricter, so code that depended on previously accepted invalid or ambiguous inputs may need small updates.

Potentially breaking bug fixes

... (truncated)

Commits

• 1fb56a5 docs: document release procedure in AGENTS.md
• f3c9ec0 4.4.3
• c2be4f8 fix(v4): generalize optin/fallback to transform; restore preprocess on absent...
• 1cab693 fix(v4): restore catch handling for absent object keys (#5937) (#5939)
• b8dffe9 docs: remove Numeric and Speakeasy (2+ missed monthly cycles)
• 9195250 docs: remove Mintlify from bronze sponsors (churned)
• 2c70332 docs: normalize bronze sponsor logos to github avatar pattern
• 7391be8 docs: prune lapsed silver/bronze sponsors and add active ones
• 2aeec83 docs: prune lapsed gold sponsors and rebalance logo sizing
• 4c2fa95 docs: use Zernio primary wordmark for gold sponsor logo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.

Updates @eslint/compat from 2.0.3 to 2.1.0

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

migrate-config: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/config-helpers bumped from ^0.5.5 to ^0.6.0

migrate-config: v2.0.7

2.0.7 (2026-05-01)

Bug Fixes

• update espree to the latest (#437) (a8ff72f)

migrate-config: v2.0.6

2.0.6 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/compat bumped from ^2.0.4 to ^2.0.5
  • devDependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

migrate-config: v2.0.5

2.0.5 (2026-04-03)

Dependencies

• The following workspace dependencies were updated

... (truncated)

Changelog

Sourced from @​eslint/compat's changelog.

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

2.0.5 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

2.0.4 (2026-04-03)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.1 to ^1.2.0

Commits

• b894953 chore: release main (#446)
• 334038d docs: Update README sponsors
• 9b51352 feat: Add new includeIgnoreFile() to config-helpers (#430)
• 70b6997 docs: Update README sponsors
• 35b6b94 chore: update TypeScript to v6 (#417)
• 7807d71 docs: Update README sponsors
• 57001ea docs: Update README sponsors
• 0b62133 docs: Update README sponsors
• d2dbf7b chore: release main (#424)
• fe114ee chore: release main (#413)
• Additional commits viewable in compare view

Updates @lingui/cli from 5.9.2 to 5.9.5

Release notes

Sourced from @​lingui/cli's releases.

v5.9.5

5.9.5 (2026-04-06)

Bug Fixes

• support braces in catalog pathname (#2495) (db14681)

v5.9.4

5.9.4 (2026-03-27)

Bug Fixes

• cli: really keep catalog extra from previous catalog (#2479) (c939113)

v5.9.3

5.9.3 (2026-03-13)

Bug Fixes

• support Vite 8 (#2474) (e4468c7)

Changelog

Sourced from @​lingui/cli's changelog.

5.9.5 (2026-04-06)

Bug Fixes

• support braces in catalog pathname (#2495) (db14681)

5.9.4 (2026-03-27)

Bug Fixes

• really keep catalog extra from previous catalog (#2479) (c939113)

5.9.3 (2026-03-13)

Note: Version bump only for package @​lingui/cli

Commits

• 7b55bd7 chore(release): published v5.9.5 [skip ci] (#2499)
• db14681 fix: support braces in catalog pathname (#2495)
• 8303dbf chore(release): published v5.9.4 [skip ci] (#2483)
• c939113 fix: really keep catalog extra from previous catalog (#2479)
• 67be09c chore(release): published v5.9.3 [skip ci] (#2476)
• See full diff in compare view

Updates @lingui/vite-plugin from 5.9.2 to 5.9.5

Release notes

Sourced from @​lingui/vite-plugin's releases.

v5.9.5

5.9.5 (2026-04-06)

Bug Fixes

• support braces in catalog pathname (#2495) (db14681)

v5.9.4

5.9.4 (2026-03-27)

Bug Fixes

• cli: really keep catalog extra from previous catalog (#2479) (c939113)

v5.9.3

5.9.3 (2026-03-13)

Bug Fixes

• support Vite 8 (#2474) (e4468c7)

Changelog

Sourced from @​lingui/vite-plugin's changelog.

5.9.5 (2026-04-06)

Note: Version bump only for package @​lingui/vite-plugin

5.9.4 (2026-03-27)

Note: Version bump only for package @​lingui/vite-plugin

5.9.3 (2026-03-13)

Bug Fixes

• support vite 8 (#2474) (e4468c7)

Commits

• 7b55bd7 chore(release): published v5.9.5 [skip ci] (#2499)
• 8303dbf chore(release): published v5.9.4 [skip ci] (#2483)
• 67be09c chore(release): published v5.9.3 [skip ci] (#2476)
• e4468c7 fix: support vite 8 (#2474)
• See full diff in compare view

Updates @playwright/test from 1.58.2 to 1.61.0

Release notes

Sourced from @​playwright/test's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits

• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• 8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
• 812432e chore: mark v1.61.0 (#41277)
• ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
• 056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
• 41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
• ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
• b8ee5ae docs: release notes for v1.61 (#41261)
• 49c1f69 fix(trace viewer): load trace from a local file (#41263)
• Additional commits viewable in compare view

Updates @sveltejs/kit from 2.54.0 to 2.65.2

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.65.2

Patch Changes

• fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)

• fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)

• fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)

• fix: allow preloadCode to be called during initial page load (#16028)

• fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#16020)

• fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#16021)

• fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)

• fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)

• fix: normalize path separators when comparing config (#16037)

• fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#16058)

• fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#16018)

@​sveltejs/kit@​2.65.1

Patch Changes

• fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#16023)

• fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#16025)

• fix: reset queries before navigating when invalidateAll is set (#16014)

• fix: regression in loading assets for absolute path apps (#16026)

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.65.2

Patch Changes

• fix: throw an error when prerendering a root +server.js that returns a non-HTML response (#15994)

• fix: decode base64-serialized fetch bodies before caching them for client-side replay (#16034)

• fix: correctly access explicit dynamic public environment variables from prerendered pages and service workers (#16024)

• fix: allow preloadCode to be called during initial page load (#16028)

• fix: send cache-control: private, no-store on remote function responses so personalized query results can never be cached by shared caches (#16020)

• fix: preserve the HTTP status and error body when a remote function request fails in transport (e.g. a 401/403 from a handle hook), instead of reporting a generic 500 (#16021)

• fix: avoid loading universal nodes during build analysis when the app uses a hash router (#16042)

• fix: correctly serve client entry during development when using the pnpm global virtual store (#16045)

• fix: normalize path separators when comparing config (#16037)

• fix: ensure building resolves correctly to allow avoiding build-time explicit environment variable validation (#16058)

• fix: prevent unhandled promise rejections when remote function failures are consumed via current/error instead of await (#16018)

2.65.1

Patch Changes

• fix: avoid importing the Vite development client code into builds with a non-standard NODE_ENV (#16023)

• fix: don't emit the unused bundle and stylesheet files when using bundleStrategy: 'inline' (#16025)

• fix: reset queries before navigating when invalidateAll is set (#16014)

• fix: regression in loading assets for absolute path apps (#16026)

... (truncated)

Commits

• 33fdd3f Version Packages (#16050)
• 0ccdb68 chore: make set_env synchronous (#16060)
• 913643c chore: fix flaky tests (#16059)
• c3b2c34 fix: allow runtime/build only explicit environment variable validation (#16058)
• 80cc084 fix: throw an error when prerendering a root +server.js that returns a non-HT...
• 8bae090 chore: remove unnecessary condition (#16056)
• 82bcb7d fix: prevent unhandled rejections from reactively-consumed remote resources (...
• a34e663 fix: preserve status code when remote function transport requests fail (#16021)
• d33bc6b fix: only reference env.js/env.script.js if dynamic public env vars are i...
• 726b13e chore: Add tests for un-covered behaviors in LiveQuery (#16019)
• Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.2.1 to 4.3.1

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.1

Added

• Add --silent option to suppress output in @tailwindcss/cli (#20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#20052)
• Allow @apply to be used with CSS mixins (#19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[dependabot]

Superseded by #4051.