chore(deps-dev): bump svelte and @sveltejs/vite-plugin-svelte in /services/frontend

[dependabot]

Bumps svelte and @sveltejs/vite-plugin-svelte. These dependencies needed to be updated together.
Updates svelte from 4.2.20 to 5.56.6

Release notes

Sourced from svelte's releases.

svelte@5.56.6

Patch Changes

• perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

• fix: rerun derived that had an abort controller on reconnection (#18551)

svelte@5.56.5

Patch Changes

• chore: drop dead code that make TSGO fail (#18496)

• fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

• fix: skip unnecessary derived effect in earlier batch (#18525)

• fix: avoid declaration tag warning in event handlers (#18500)

• fix: abort deriveds own AbortSignal when it disconnects (#18400)

• fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

• fix: correctly transform declaration tags during SSR (#18492)

• fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

• fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

• fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens (#18541)

• fix: don't treat declaration tags as parts inside each blocks (#18507)

svelte@5.56.4

Patch Changes

• fix: include wrapping parentheses in {@const} declarator end position (#18436)

• fix: always unset reactivity context after restoring it (#18453)

• fix: don't notify searchParams subscribers when the URL changes without affecting the search string (#18425)

• fix: strip ? from optional parameters in <script lang="ts"> so generated JavaScript is valid (#18448)

svelte@5.56.3

Patch Changes

• fix: ignore errors that occur in destroyed effects (#18384)

• fix: type BigInts in $state.snapshot(...) return values (#18388)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.6

Patch Changes

• perf: skip unnecessary blocker analysis when compiling components without top-level await (#18548)

• fix: rerun derived that had an abort controller on reconnection (#18551)

5.56.5

Patch Changes

• chore: drop dead code that make TSGO fail (#18496)

• fix: don't (re)connect deriveds when read inside branch/root effects (#18527)

• fix: skip unnecessary derived effect in earlier batch (#18525)

• fix: avoid declaration tag warning in event handlers (#18500)

• fix: abort deriveds own AbortSignal when it disconnects (#18400)

• fix: ensure $state.eager() is correctly transormed for SSR output (#18530)

• fix: correctly transform declaration tags during SSR (#18492)

• fix: transform computed keys in keyed {#each} destructuring patterns (#18521)

• fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#18518)

• fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens (#18541)

• fix: don't treat declaration tags as parts inside each blocks (#18507)

5.56.4

Patch Changes

• fix: include wrapping parentheses in {@const} declarator end position (#18436)

• fix: always unset reactivity context after restoring it (#18453)

• fix: don't notify searchParams subscribers when the URL changes without affecting the search string (#18425)

• fix: strip ? from optional parameters in <script lang="ts"> so generated JavaScript is valid (#18448)

5.56.3

Patch Changes

... (truncated)

Commits

• 4a6a85b Version Packages (#18552)
• d0dbe1a perf: skip quadratic blocker analysis when no top-level await (#18548)
• 22e0adb fix: rerun derived that had an abort controller on reconnection (#18551)
• 602a873 Version Packages (#18497)
• a4fd67e fix: $state.eager() is sometimes incorrect in SSR (#18530)
• 199ffeb fix: clear previous_task reference after abort in Tween (#18541)
• edeef1f chore: add some failing tests (#18528)
• a91b068 fix: abort deriveds own AbortSignal when it disconnects (#18400)
• b4d1583 fix: transform computed keys in keyed each block destructuring patterns (#18521)
• 08a9e9e fix: prevent derived connection leak in untracked contexts (#18517)
• Additional commits viewable in compare view

Updates @sveltejs/vite-plugin-svelte from 3.1.2 to 7.2.0

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.2.0

Minor Changes

• feat(inspector): add a context menu with current component stack (#1370)

@​sveltejs/vite-plugin-svelte@​7.1.4

Patch Changes

• fix: enforce ltr styles for inspector (#1324)

@​sveltejs/vite-plugin-svelte@​7.1.3

Patch Changes

• fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

@​sveltejs/vite-plugin-svelte@​7.1.2

Patch Changes

• fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

@​sveltejs/vite-plugin-svelte@​7.1.1

Patch Changes

• fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

• fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

@​sveltejs/vite-plugin-svelte@​7.1.0

Minor Changes

• feat: enable optimizer for server environments during dev (#1328)

@​sveltejs/vite-plugin-svelte@​7.0.0

Major Changes

• breaking(deps): require vite 8 (#1266)

• breaking(options): remove deprecated options (#1274)

  • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead
  • vitePlugin.ignorePluginPreprocessors in svelte.config.js no longer needed
  • api.idFilter of vite-plugin-svelte:api use api.filter instead

... (truncated)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.2.0

Minor Changes

• feat(inspector): add a context menu with current component stack (#1370)

7.1.4

Patch Changes

• fix: enforce ltr styles for inspector (#1324)

7.1.3

Patch Changes

• fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

7.1.2

Patch Changes

• fix: correctly resolve compiled CSS on the server for dependencies with Svelte files (#1342)

7.1.1

Patch Changes

• fix: pass typescript.onlyRemoveTypeImports to transformWithOxc in vitePreprocess so that value imports are not dropped when they are only referenced in Svelte template markup (#1326)

• fix: correctly resolve compiled CSS for optimised Svelte dependencies on the server (#1336)

7.1.0

Minor Changes

• feat: enable optimizer for server environments during dev (#1328)

7.0.0

Major Changes

• breaking(deps): require vite 8 (#1266)

• breaking(options): remove deprecated options (#1274)

  • vitePlugin.hot in svelte.config.js use compilerOptions.hmr instead

... (truncated)

Commits

• 02981fd Version Packages (#1371)
• 4158aa2 feat: context menu with component stack (#1370)
• c867a3a Version Packages (#1368)
• dbdb255 fix: inspector rtl host styles (#1324)
• 694bc95 chore(deps): update dependency typescript to v6 (#1315)
• 9281816 chore(deps): update all non-major dependencies (#1365)
• 02d370d Version Packages (#1361)
• 3b581de Revert "feat: support .svelte.mjs and .svelte.mts files" (#1366)
• 5545e1a feat: support .svelte.mjs and .svelte.mts files (#1293)
• 2cb977e fix(inspector): activate under Vite+ by matching its client module path (#1355)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[jmservera]

🤖 Automated PR review

Bumps svelte 4→5 + @sveltejs/vite-plugin-svelte 3→7 (dev deps) in services/frontend, leaving vite at 5.

Findings

Severity	Item	Finding
🔴 Critical	vite peer unsatisfiable	@sveltejs/vite-plugin-svelte@7 requires vite@^8, but vite stays at ^5.4.8 → npm install fails with ERESOLVE; the lock only resolved because it's internally inconsistent.
🔴 Critical	Svelte 5 runtime break	src/main.js mounts via new App({ target }), removed in Svelte 5 (component_api_invalid_new), and svelte.config.js has no compatibility.componentApi: 4. The app fails to mount. A dev-dep bump can't ship without the paired import { mount } from 'svelte'; mount(App, { target }) change (or the compat flag).
🟠 High	overlap with #3	This is the svelte-5 half; #3 is the vite-8 half. Correct state is the union (svelte 5 + plugin 7 + vite 8); neither PR is mergeable standalone and they conflict on package.json/package-lock.json.

Recommendation: ❌ Request changes. Close both #1 and #3 and land a single combined bump (svelte ^5 + @sveltejs/vite-plugin-svelte ^7 + vite ^8) together with the main.js mount fix, then verify npm ci + npm run build + the Playwright acceptance suite (esp. the Golden Layout window-manager spec) pass.

[jmservera]

🤖 Automated line-anchored review — see the summary comment for the full findings table.

[jmservera]

🔴 Critical — Svelte 5 breaks the app + unsatisfiable vite peer. Bumping svelte to 5 (with @sveltejs/vite-plugin-svelte@7, which requires vite@^8) while vite stays at 5 fails npm install with ERESOLVE. Worse, src/main.js mounts via new App({ target }), removed in Svelte 5 (component_api_invalid_new) with no compatibility.componentApi: 4 set — the app fails to mount. This is the svelte-5 half; #3 is the vite-8 half — combine them into a single PR (svelte 5 + plugin 7 + vite 8) together with the main.js mount(App, { target }) change, then verify npm ci + npm run build + the Playwright suite.