build(deps-dev): Bump @sveltejs/vite-plugin-svelte from 5.0.3 to 6.2.4 in /frontend by dependabot[bot] · Pull Request #8 · kenn-io/agentsview

dependabot · 2026-02-19T19:35:10Z

Bumps @sveltejs/vite-plugin-svelte from 5.0.3 to 6.2.4.

Release notes

Sourced from @sveltejs/vite-plugin-svelte's releases.

@sveltejs/vite-plugin-svelte@6.2.4

Patch Changes

fix(hmr): ensure that svelte files are recompiled and updated css modules returned correctly when reported out of order (#1258)

@sveltejs/vite-plugin-svelte@6.2.3

Patch Changes

fix(filter): ignore zero-tagged ids per rollup convention (#1255)

@sveltejs/vite-plugin-svelte@6.2.2

Patch Changes

Update experimental support for rolldown-vite to vite 8 beta (#1246)

perf: switch from debug to obug (smaller, esm-only) (#1241)

@sveltejs/vite-plugin-svelte@6.2.1

Patch Changes

fix: remove unscopable global styles warning (#1223)

Remove automatic configuration for rolldownOptions.optimization.inlineConst because latest version of rolldown-vite has it enabled by default. (#1225)

@sveltejs/vite-plugin-svelte@6.2.0

Minor Changes

feat(rolldown-vite): enable optimization.inlineConst by default to ensure treeshaking works with esm-env in svelte (#1207)

@sveltejs/vite-plugin-svelte@6.1.4

Patch Changes

fix: allow preprocess plugin to run twice (#1206)

fix(types): update urls to PreprocessorGroup and CompileOptions in type documention (#1203)

replace kleur dependency with builtin node:utils styleText (#1210)

@sveltejs/vite-plugin-svelte@6.1.3

Patch Changes

fix(api): add api.filter and deprecate api.idFilter to avoid confusing filter.id = idFilter.id assignments when used as hybrid filter in other plugins (#1199)

@sveltejs/vite-plugin-svelte@6.1.2

Patch Changes

... (truncated)

Changelog

Sourced from @sveltejs/vite-plugin-svelte's changelog.

6.2.4

Patch Changes

fix(hmr): ensure that svelte files are recompiled and updated css modules returned correctly when reported out of order (#1258)

6.2.3

Patch Changes

fix(filter): ignore zero-tagged ids per rollup convention (#1255)

6.2.2

Patch Changes

Update experimental support for rolldown-vite to vite 8 beta (#1246)

perf: switch from debug to obug (smaller, esm-only) (#1241)

6.2.1

Patch Changes

fix: remove unscopable global styles warning (#1223)

Remove automatic configuration for rolldownOptions.optimization.inlineConst because latest version of rolldown-vite has it enabled by default. (#1225)

6.2.0

Minor Changes

feat(rolldown-vite): enable optimization.inlineConst by default to ensure treeshaking works with esm-env in svelte (#1207)

6.1.4

Patch Changes

fix: allow preprocess plugin to run twice (#1206)

fix(types): update urls to PreprocessorGroup and CompileOptions in type documention (#1203)

replace kleur dependency with builtin node:utils styleText (#1210)

6.1.3

Patch Changes

... (truncated)

Commits

24bf204 Version Packages (#1259)
599dbc1 fix: transform Svelte component first during HMR (#1258)
83513a8 Version Packages (#1256)
b280447 fix(filter): ignore zero-tagged ids per rollup convention (#1255)
99bfe1a Version Packages (#1247)
c4f8535 fix: update from rolldown-vite to vite-8 beta (#1246)
cba6ae8 perf: replace debug with obug (#1241)
fdf68ea chore: updates (#1239)
1b50eb9 Version Packages (#1224)
b81ef40 fix: remove automatic setting of rolldown inlineConst (#1225)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @sveltejs/vite-plugin-svelte since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [@sveltejs/vite-plugin-svelte](https://github.com/sveltejs/vite-plugin-svelte/tree/HEAD/packages/vite-plugin-svelte) from 5.0.3 to 6.2.4. - [Release notes](https://github.com/sveltejs/vite-plugin-svelte/releases) - [Changelog](https://github.com/sveltejs/vite-plugin-svelte/blob/main/packages/vite-plugin-svelte/CHANGELOG.md) - [Commits](https://github.com/sveltejs/vite-plugin-svelte/commits/@sveltejs/vite-plugin-svelte@6.2.4/packages/vite-plugin-svelte) --- updated-dependencies: - dependency-name: "@sveltejs/vite-plugin-svelte" dependency-version: 6.2.4 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

roborev-ci · 2026-02-22T17:31:47Z

roborev: Combined Review (`3dd71ab`)

Verdict: ⚠️ Changes are mostly dependency-only, but there is 1 High and 1 Medium toolchain compatibility risk to address before merge.

High

Peer dependency mismatch may break install/build
- Files: frontend/package.json:21, frontend/package.json:28, frontend/package-lock.json:1106
- @sveltejs/vite-plugin-svelte was upgraded to 6.2.4, while vite remains 6.1.0. The plugin now declares vite peer ^6.3.0 || ^7.0.0, so the dependency graph is out of contract and may cause peer resolution or runtime/plugin incompatibility failures.
- Suggested fix: bump vite to >=6.3.0 (latest compatible 6.x), regenerate lockfile, and run build/tests.

Medium

Node.js minimum version increased without explicit project guardrails
- Files: frontend/package-lock.json:1102, frontend/package-lock.json:1119
- Updated plugin/transitives require Node ^20.19 || ^22.12 || >=24, which can fail on older Node 20 patch versions (e.g., 20.0–20.18) in CI/dev environments.
- Suggested fix: declare engines.node in frontend/package.json and align CI/runtime config (.nvmrc, pipeline image/docs) to 20.19+ or 22.12+.

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

dependabot · 2026-02-22T17:57:15Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

…uidelines Set CLAUDE_NO_SOUND=1 on the claude command directly (appended to inherited env) to suppress audible notifications during automated insight generation. Add review guideline #8: subprocess env inheritance is intentional and env sanitization is the user's responsibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

## Summary - Update GitHub Actions: checkout v6.0.2, upload-artifact v6.0.0, download-artifact v7.0.0 - Update npm deps: svelte 5.53.2 (SSR vulnerability fix), vite-plugin-svelte 6.2.4, vite 6.4.1, typescript 5.9.3, svelte-check 4.4.1, @tsconfig/svelte 5.0.8, @tanstack/virtual-core 3.13.18 - Add engines.node constraint for vite-plugin-svelte 6.x minimum - Fix search.test.ts timing for Svelte 5.53.2 reactive system changes Closes #1, closes #2, closes #3, closes #4, closes #5, closes #6, closes #7, closes #8 ## Test plan - [ ] CI passes: Go tests, frontend unit tests, E2E tests, lint, type check - [ ] `npm audit` shows 0 vulnerabilities - [ ] Frontend builds cleanly with vite 6.4.1 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

…uidelines Set CLAUDE_NO_SOUND=1 on the claude command directly (appended to inherited env) to suppress audible notifications during automated insight generation. Add review guideline #8: subprocess env inheritance is intentional and env sanitization is the user's responsibility. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

> ℹ️ **Note** > > This PR body was truncated due to platform limits. This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@inlang/paraglide-js](https://paraglidejs.com) ([source](https://redirect.github.com/opral/paraglide-js)) | [`2.19.0` → `2.20.1`](https://renovatebot.com/diffs/npm/@inlang%2fparaglide-js/2.19.0/2.20.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@inlang%2fparaglide-js/2.20.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@inlang%2fparaglide-js/2.19.0/2.20.1?slim=true) | | [@lucide/svelte](https://lucide.dev) ([source](https://redirect.github.com/lucide-icons/lucide/tree/HEAD/packages/svelte)) | [`1.17.0` → `1.21.0`](https://renovatebot.com/diffs/npm/@lucide%2fsvelte/1.17.0/1.21.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@lucide%2fsvelte/1.21.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@lucide%2fsvelte/1.17.0/1.21.0?slim=true) | | [@playwright/test](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright)) | [`1.60.0` → `1.61.0`](https://renovatebot.com/diffs/npm/@playwright%2ftest/1.60.0/1.61.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2ftest/1.61.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2ftest/1.60.0/1.61.0?slim=true) | | [@playwright/test](https://playwright.dev) ([source](https://redirect.github.com/microsoft/playwright)) | [`1.55.1` → `1.61.0`](https://renovatebot.com/diffs/npm/@playwright%2ftest/1.55.1/1.61.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2ftest/1.61.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2ftest/1.55.1/1.61.0?slim=true) | | [@tanstack/virtual-core](https://tanstack.com/virtual) ([source](https://redirect.github.com/TanStack/virtual/tree/HEAD/packages/virtual-core)) | [`3.17.0` → `3.17.1`](https://renovatebot.com/diffs/npm/@tanstack%2fvirtual-core/3.17.0/3.17.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tanstack%2fvirtual-core/3.17.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tanstack%2fvirtual-core/3.17.0/3.17.1?slim=true) | | [@tauri-apps/cli](https://redirect.github.com/tauri-apps/tauri) | [`2.11.2` → `2.11.3`](https://renovatebot.com/diffs/npm/@tauri-apps%2fcli/2.11.2/2.11.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@tauri-apps%2fcli/2.11.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tauri-apps%2fcli/2.11.2/2.11.3?slim=true) | | [@testing-library/svelte](https://redirect.github.com/testing-library/svelte-testing-library) ([source](https://redirect.github.com/testing-library/svelte-testing-library/tree/HEAD/packages/svelte)) | [`5.3.1` → `5.4.1`](https://renovatebot.com/diffs/npm/@testing-library%2fsvelte/5.3.1/5.4.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@testing-library%2fsvelte/5.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@testing-library%2fsvelte/5.3.1/5.4.1?slim=true) | | [openapi-typescript-codegen](https://redirect.github.com/ferdikoomen/openapi-typescript-codegen) | [`^0.30.0` → `^0.31.0`](https://renovatebot.com/diffs/npm/openapi-typescript-codegen/0.30.0/0.31.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/openapi-typescript-codegen/0.31.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/openapi-typescript-codegen/0.30.0/0.31.0?slim=true) | | [svelte](https://svelte.dev) ([source](https://redirect.github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.56.1` → `5.56.3`](https://renovatebot.com/diffs/npm/svelte/5.56.1/5.56.3) | ![age](https://developer.mend.io/api/mc/badges/age/npm/svelte/5.56.3?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/svelte/5.56.1/5.56.3?slim=true) | | [vite](https://viteplus.dev/guide) ([source](https://redirect.github.com/voidzero-dev/vite-plus/tree/HEAD/packages/core)) | [`0.1.24` → `0.2.1`](https://renovatebot.com/diffs/npm/vite/0.1.24/0.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@voidzero-dev%2fvite-plus-core/0.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@voidzero-dev%2fvite-plus-core/0.1.24/0.2.1?slim=true) | | [vite-plus](https://viteplus.dev/guide) ([source](https://redirect.github.com/voidzero-dev/vite-plus/tree/HEAD/packages/cli)) | [`0.1.24` → `0.2.1`](https://renovatebot.com/diffs/npm/vite-plus/0.1.24/0.2.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite-plus/0.2.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite-plus/0.1.24/0.2.1?slim=true) | --- ### Release Notes <details> <summary>opral/paraglide-js (@inlang/paraglide-js)</summary> ### [`v2.20.1`](https://redirect.github.com/opral/paraglide-js/blob/HEAD/CHANGELOG.md#2201) ##### Patch Changes - [`8c3493d`](https://redirect.github.com/opral/paraglide-js/commit/8c3493d): Fix server cookie locale parsing when Cookie headers omit whitespace after semicolons. ### [`v2.20.0`](https://redirect.github.com/opral/paraglide-js/blob/HEAD/CHANGELOG.md#2200) ##### Minor Changes - [`2c34351`](https://redirect.github.com/opral/paraglide-js/commit/2c34351): Emit `messages/package.json` with `{ "type": "module", "sideEffects": false }` for `message-modules` output, declaring the generated message modules side-effect-free. This lets bundlers (notably Vite 8 / Rolldown) drop unused re-exports from the `m` barrel per entry, instead of bundling every message used anywhere in the app into one shared chunk that every entry downloads. Without it, per-page JS scales with the union of all messages used across the app rather than with the messages a given route actually uses. The declaration is scoped to `messages/`, so `runtime.js` (which has real side effects) is unaffected. `type: "module"` is included because the package.json creates a new module scope for `messages/`; without it, the generated ESM files would default to CommonJS (a package.json without `type` is CJS in Node, even when the consuming project is `type: "module"`). See [#668](https://redirect.github.com/opral/paraglide-js/issues/668) ##### Patch Changes - [`921c3be`](https://redirect.github.com/opral/paraglide-js/commit/921c3be): `experimentalMiddlewareLocaleSplitting`: the injected inline script now reuses the nonce from the response's `Content-Security-Policy` header, so it is allowed under a strict CSP instead of being blocked and breaking hydration. Automatic - no configuration needed. </details> <details> <summary>lucide-icons/lucide (@lucide/svelte)</summary> ### [`v1.21.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.21.0): Version 1.21.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.20.0...1.21.0) #### What's Changed - ci(release.yml): Remove new-version in release flow by [@ericfennis](https://redirect.github.com/ericfennis) in [#4478](https://redirect.github.com/lucide-icons/lucide/pull/4478) - ci(release.yml): Fix workflow and remove `version` scripts in package scripts by [@ericfennis](https://redirect.github.com/ericfennis) in [#4479](https://redirect.github.com/lucide-icons/lucide/pull/4479) - fix(docs): rename navigation category label by [@Hsiii](https://redirect.github.com/Hsiii) in [#4483](https://redirect.github.com/lucide-icons/lucide/pull/4483) - feat(icons): added `broken-bone` icon by [@Patolord](https://redirect.github.com/Patolord) in [#4131](https://redirect.github.com/lucide-icons/lucide/pull/4131) #### New Contributors - [@Hsiii](https://redirect.github.com/Hsiii) made their first contribution in [#4483](https://redirect.github.com/lucide-icons/lucide/pull/4483) - [@Patolord](https://redirect.github.com/Patolord) made their first contribution in [#4131](https://redirect.github.com/lucide-icons/lucide/pull/4131) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.20.0...1.21.0> ### [`v1.20.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.20.0): Version 1.20.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.19.0...1.20.0) #### What's Changed - fix(icons): decreased size of arrows inside `square-arrow-*` icons by [@jguddas](https://redirect.github.com/jguddas) in [#3926](https://redirect.github.com/lucide-icons/lucide/pull/3926) - chore(tags): Add tags to `search-` icons by [@jamiemlaw](https://redirect.github.com/jamiemlaw) in [#4099](https://redirect.github.com/lucide-icons/lucide/pull/4099) - feat(icons): added `save-check` icon by [@Konixy](https://redirect.github.com/Konixy) in [#3120](https://redirect.github.com/lucide-icons/lucide/pull/3120) - feat(icons): added `tag-plus` and `tag-x` icons by [@adam-kov](https://redirect.github.com/adam-kov) in [#3980](https://redirect.github.com/lucide-icons/lucide/pull/3980) - feat(icons): added `banknote-check` icon by [@mfjramirezf](https://redirect.github.com/mfjramirezf) in [#3956](https://redirect.github.com/lucide-icons/lucide/pull/3956) - feat(icons): added `clock-arrow-in` icon by [@jguddas](https://redirect.github.com/jguddas) in [#2403](https://redirect.github.com/lucide-icons/lucide/pull/2403) - feat(icons): added `summary` icon by [@jpjacobpadilla](https://redirect.github.com/jpjacobpadilla) in [#3114](https://redirect.github.com/lucide-icons/lucide/pull/3114) - feat(icons): added `user-round-arrow-in` icon by [@jguddas](https://redirect.github.com/jguddas) in [#2283](https://redirect.github.com/lucide-icons/lucide/pull/2283) - feat(icons): added `clock-arrow-out` icon by [@jguddas](https://redirect.github.com/jguddas) in [#2404](https://redirect.github.com/lucide-icons/lucide/pull/2404) - docs(docs): fix broken Svelte package source link in README by [@SRKrukowski](https://redirect.github.com/SRKrukowski) in [#4468](https://redirect.github.com/lucide-icons/lucide/pull/4468) - chore(deps-dev): bump [@angular/compiler](https://redirect.github.com/angular/compiler) from 21.2.5 to 21.2.17 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4474](https://redirect.github.com/lucide-icons/lucide/pull/4474) - chore(deps-dev): bump [@angular/core](https://redirect.github.com/angular/core) from 21.2.5 to 21.2.17 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4470](https://redirect.github.com/lucide-icons/lucide/pull/4470) - chore(deps-dev): bump vitest from 4.0.12 to 4.1.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4429](https://redirect.github.com/lucide-icons/lucide/pull/4429) - chore(deps-dev): bump markdown-it from 14.1.1 to 14.2.0 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4475](https://redirect.github.com/lucide-icons/lucide/pull/4475) - chore(deps-dev): bump [@angular/common](https://redirect.github.com/angular/common) from 21.2.5 to 21.2.17 by [@dependabot](https://redirect.github.com/dependabot)\[bot] in [#4471](https://redirect.github.com/lucide-icons/lucide/pull/4471) - feat(icons): added `pencil-sparkles` icon by [@jennieboops](https://redirect.github.com/jennieboops) in [#4445](https://redirect.github.com/lucide-icons/lucide/pull/4445) #### New Contributors - [@Konixy](https://redirect.github.com/Konixy) made their first contribution in [#3120](https://redirect.github.com/lucide-icons/lucide/pull/3120) - [@adam-kov](https://redirect.github.com/adam-kov) made their first contribution in [#3980](https://redirect.github.com/lucide-icons/lucide/pull/3980) - [@mfjramirezf](https://redirect.github.com/mfjramirezf) made their first contribution in [#3956](https://redirect.github.com/lucide-icons/lucide/pull/3956) - [@SRKrukowski](https://redirect.github.com/SRKrukowski) made their first contribution in [#4468](https://redirect.github.com/lucide-icons/lucide/pull/4468) - [@jennieboops](https://redirect.github.com/jennieboops) made their first contribution in [#4445](https://redirect.github.com/lucide-icons/lucide/pull/4445) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.19.0...1.20.0> ### [`v1.19.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.19.0): Version 1.19.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.18.0...1.19.0) #### What's Changed - chore(deps): upgrade pnpm to version 11.6.0 by [@ericfennis](https://redirect.github.com/ericfennis) in [#4458](https://redirect.github.com/lucide-icons/lucide/pull/4458) - feat(icons): added `star-*` icons by [@RajnishKMehta](https://redirect.github.com/RajnishKMehta) in [#3918](https://redirect.github.com/lucide-icons/lucide/pull/3918) - chore(suggest-tags): Update metadata suggestion script by [@ericfennis](https://redirect.github.com/ericfennis) in [#4462](https://redirect.github.com/lucide-icons/lucide/pull/4462) - feat(icons): added `save-pen` icon by [@vaporvee](https://redirect.github.com/vaporvee) in [#4179](https://redirect.github.com/lucide-icons/lucide/pull/4179) - feat(icons): added `wrench-off` icon by [@nilsjonsson](https://redirect.github.com/nilsjonsson) in [#4434](https://redirect.github.com/lucide-icons/lucide/pull/4434) - feat(icons): added `ad` icon by [@jamiemlaw](https://redirect.github.com/jamiemlaw) in [#4323](https://redirect.github.com/lucide-icons/lucide/pull/4323) - feat(icons): added `eye-dashed` icon by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#4415](https://redirect.github.com/lucide-icons/lucide/pull/4415) - feat(icons): added `save-plus` icon by [@jwlinqx](https://redirect.github.com/jwlinqx) in [#4448](https://redirect.github.com/lucide-icons/lucide/pull/4448) - feat(icons): added `list-sort-descending` icon by [@ericfennis](https://redirect.github.com/ericfennis) in [#4457](https://redirect.github.com/lucide-icons/lucide/pull/4457) - fix(lucide-react-native): Fix provider exports by [@ericfennis](https://redirect.github.com/ericfennis) in [#4463](https://redirect.github.com/lucide-icons/lucide/pull/4463) - fix(site): reserve space for icon detail drawer by [@vyctorbrzezowski](https://redirect.github.com/vyctorbrzezowski) in [#4344](https://redirect.github.com/lucide-icons/lucide/pull/4344) - fix(icons): changed `wallet-cards` icon by [@jguddas](https://redirect.github.com/jguddas) in [#3888](https://redirect.github.com/lucide-icons/lucide/pull/3888) - feat(site): Improve search and add sorting options by [@ericfennis](https://redirect.github.com/ericfennis) in [#4453](https://redirect.github.com/lucide-icons/lucide/pull/4453) - feat(icons): added `podium` icon by [@jguddas](https://redirect.github.com/jguddas) in [#2124](https://redirect.github.com/lucide-icons/lucide/pull/2124) #### New Contributors - [@vaporvee](https://redirect.github.com/vaporvee) made their first contribution in [#4179](https://redirect.github.com/lucide-icons/lucide/pull/4179) - [@nilsjonsson](https://redirect.github.com/nilsjonsson) made their first contribution in [#4434](https://redirect.github.com/lucide-icons/lucide/pull/4434) - [@jwlinqx](https://redirect.github.com/jwlinqx) made their first contribution in [#4448](https://redirect.github.com/lucide-icons/lucide/pull/4448) - [@vyctorbrzezowski](https://redirect.github.com/vyctorbrzezowski) made their first contribution in [#4344](https://redirect.github.com/lucide-icons/lucide/pull/4344) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.18.0...1.19.0> ### [`v1.18.0`](https://redirect.github.com/lucide-icons/lucide/releases/tag/1.18.0): Version 1.18.0 [Compare Source](https://redirect.github.com/lucide-icons/lucide/compare/1.17.0...1.18.0) #### What's Changed - chore(site): Remove survey from site by [@ericfennis](https://redirect.github.com/ericfennis) in [#4417](https://redirect.github.com/lucide-icons/lucide/pull/4417) - feat(icons): added `play-off` icon by [@Ahmed-Dghaies](https://redirect.github.com/Ahmed-Dghaies) in [#4412](https://redirect.github.com/lucide-icons/lucide/pull/4412) - fix(metadata): add missing use-cases prop on play-off.json by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#4423](https://redirect.github.com/lucide-icons/lucide/pull/4423) - fix(docs): force hide #bb-banner, if html.has-bb-banner is missing by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#4422](https://redirect.github.com/lucide-icons/lucide/pull/4422) - fix(docs): Remove `@next` from installation instructions for`@lucide/svelte` by [@alecglassford](https://redirect.github.com/alecglassford) in [#4432](https://redirect.github.com/lucide-icons/lucide/pull/4432) - feat(packages/angular): add support for Angular v22 and onwards by [@karsa-mistmere](https://redirect.github.com/karsa-mistmere) in [#4450](https://redirect.github.com/lucide-icons/lucide/pull/4450) - fix(ci): add check to skip release if latest tag was created today by [@ericfennis](https://redirect.github.com/ericfennis) in [#4085](https://redirect.github.com/lucide-icons/lucide/pull/4085) - feat(icons): added `webcam-off` icon by [@jordan-burnett](https://redirect.github.com/jordan-burnett) in [#4242](https://redirect.github.com/lucide-icons/lucide/pull/4242) #### New Contributors - [@alecglassford](https://redirect.github.com/alecglassford) made their first contribution in [#4432](https://redirect.github.com/lucide-icons/lucide/pull/4432) - [@jordan-burnett](https://redirect.github.com/jordan-burnett) made their first contribution in [#4242](https://redirect.github.com/lucide-icons/lucide/pull/4242) **Full Changelog**: <https://github.com/lucide-icons/lucide/compare/1.17.0...1.18.0> </details> <details> <summary>microsoft/playwright (@playwright/test)</summary> ### [`v1.61.0`](https://redirect.github.com/microsoft/playwright/releases/tag/v1.61.0) [Compare Source](https://redirect.github.com/microsoft/playwright/compare/v1.60.0...v1.61.0) ##### 🔑 WebAuthn passkeys New [Credentials](https://playwright.dev/docs/api/class-credentials) virtual authenticator, available via [browserContext.credentials](https://playwright.dev/docs/api/class-browsercontext#browser-context-credentials), lets tests register passkeys and answer `navigator.credentials.create()` / `navigator.credentials.get()` ceremonies in the page — no real hardware key required, works in all browsers: ```js const context = await browser.newContext(); // Seed a passkey your backend provisioned for a test user. await context.credentials.create('example.com', { id: credentialId, userHandle, privateKey, publicKey, }); await context.credentials.install(); const page = await context.newPage(); await page.goto('https://example.com/login'); // The page's navigator.credentials.get() is answered with the seeded passkey. ``` You can also let the app register a passkey once in a setup test, read it back with [credentials.get()](https://playwright.dev/docs/api/class-credentials#credentials-get), and seed it into later tests — see [Credentials](https://playwright.dev/docs/api/class-credentials) for details. ##### 🗃️ Web Storage New [WebStorage](https://playwright.dev/docs/api/class-webstorage) API, available via [page.localStorage](https://playwright.dev/docs/api/class-page#page-local-storage) and [page.sessionStorage](https://playwright.dev/docs/api/class-page#page-session-storage), reads and writes the page's storage for the current origin: ```js await page.localStorage.setItem('token', 'abc'); const token = await page.localStorage.getItem('token'); const items = await page.sessionStorage.items(); ``` ##### New APIs ##### Network - [apiResponse.securityDetails()](https://playwright.dev/docs/api/class-apiresponse#api-response-security-details) and [apiResponse.serverAddr()](https://playwright.dev/docs/api/class-apiresponse#api-response-server-addr) mirror the browser-side [response.securityDetails()](https://playwright.dev/docs/api/class-response#response-security-details) and [response.serverAddr()](https://playwright.dev/docs/api/class-response#response-server-addr). ##### Browser and Screencast - New option `artifactsDir` in [browserType.connectOverCDP()](https://playwright.dev/docs/api/class-browsertype#browser-type-connect-over-cdp) controls where artifacts such as traces and downloads are stored when attached to an existing browser. - New option `cursor` in [screencast.showActions()](https://playwright.dev/docs/api/class-screencast#screencast-show-actions) controls the cursor decoration rendered for pointer actions. - The `onFrame` callback in [screencast.start()](https://playwright.dev/docs/api/class-screencast#screencast-start) now receives a `timestamp` of when the frame was presented by the browser. ##### Test runner - The [testOptions.video](https://playwright.dev/docs/api/class-testoptions#test-options-video) option now supports the same set of modes as `trace`: new `'on-all-retries'`, `'retain-on-first-failure'` and `'retain-on-failure-and-retries'` values. See the [video modes table](https://playwright.dev/docs/test-use-options#video-modes) for which runs are recorded and kept in each mode. - Supported `expect.soft.poll(...)`. - New [fullConfig.argv](https://playwright.dev/docs/api/class-fullconfig#full-config-argv) — a snapshot of `process.argv` from the runner process, handy for reading custom arguments passed after the `--` separator. - New [fullConfig.failOnFlakyTests](https://playwright.dev/docs/api/class-fullconfig#full-config-fail-on-flaky-tests) mirrors the config option, so reporters can explain why a flaky run failed. - [testInfo.errors](https://playwright.dev/docs/api/class-testinfo#test-info-errors) now lists each sub-error of an `AggregateError` as a separate entry. - New `-G` command line shorthand for `--grep-invert`. ##### 🛠️ Other improvements - Playwright now supports Ubuntu 26.04. - HAR and trace recordings now include WebSocket requests. ##### Browser Versions - Chromium 149.0.7827.55 - Mozilla Firefox 151.0 - WebKit 26.5 This version was also tested against the following stable channels: - Google Chrome 149 - Microsoft Edge 149 </details> <details> <summary>TanStack/virtual (@tanstack/virtual-core)</summary> ### [`v3.17.1`](https://redirect.github.com/TanStack/virtual/blob/HEAD/packages/virtual-core/CHANGELOG.md#3171) [Compare Source](https://redirect.github.com/TanStack/virtual/compare/@tanstack/virtual-core@3.17.0...@tanstack/virtual-core@3.17.1) ##### Patch Changes - [#1199](https://redirect.github.com/TanStack/virtual/pull/1199) [`ef69ea3`](https://redirect.github.com/TanStack/virtual/commit/ef69ea31738caa2819142e922efa03d3c408e25c) - Fix "items jump while scrolling up": the default scroll-adjustment predicate now compensates scrollTop on the first measurement of an above-viewport item even while scrolling backward (the estimate→actual delta must be absorbed), and only skips compensation for re-measurements during backward scroll to avoid the cascading jank </details> <details> <summary>tauri-apps/tauri (@tauri-apps/cli)</summary> ### [`v2.11.3`](https://redirect.github.com/tauri-apps/tauri/releases/tag/%40tauri-apps/cli-v2.11.3): @tauri-apps/cli v2.11.3 [Compare Source](https://redirect.github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.11.2...@tauri-apps/cli-v2.11.3) #### \[2.11.3] ##### Bug Fixes - [`50b0237ed`](https://www.github.com/tauri-apps/tauri/commit/50b0237edb9ed683979b7954975b98a4d22a9f70) ([#15549](https://redirect.github.com/tauri-apps/tauri/pull/15549) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Escape special characters in `productName` when generating Android `strings.xml` - [`728c8d4a5`](https://www.github.com/tauri-apps/tauri/commit/728c8d4a5d9e3badf4683eb2e493d950d27d6b66) ([#15473](https://redirect.github.com/tauri-apps/tauri/pull/15473) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Skip building bundles when using `tauri android run` - [`be0cb0d43`](https://www.github.com/tauri-apps/tauri/commit/be0cb0d4378ddf26bc33066b3750f2639ade15f5) ([#15344](https://redirect.github.com/tauri-apps/tauri/pull/15344) by [@raglady](https://www.github.com/tauri-apps/tauri/../../raglady)) Fix NDK\_HOME environment variable not honored when set - [`ed8fd411f`](https://www.github.com/tauri-apps/tauri/commit/ed8fd411fe10469da33f63ed5bd9d7ae19e77d84) ([#15552](https://redirect.github.com/tauri-apps/tauri/pull/15552) by [@Legend-Master](https://www.github.com/tauri-apps/tauri/../../Legend-Master)) Make `ureq_proto` show trace level logs only on `-vvv` instead of `-vv` - [`fca4a31f9`](https://www.github.com/tauri-apps/tauri/commit/fca4a31f94f8ba709d1b28e073e69867b8704e6e) ([#15454](https://redirect.github.com/tauri-apps/tauri/pull/15454) by [@fallintoplace](https://www.github.com/tauri-apps/tauri/../../fallintoplace)) Fix `tauri migrate` generating invalid namespace imports for aliased pluginified imports from `@tauri-apps/api`. Inputs like `import { cli as superCli } from "@tauri-apps/api"` now migrate to `import * as superCli from "@tauri-apps/plugin-cli"` instead of producing invalid ESM syntax. The migration tests also reparse migrated JS, Svelte, and Vue output so syntax regressions are caught directly. ##### Dependencies - Upgraded to `tauri-cli@2.11.3` </details> <details> <summary>testing-library/svelte-testing-library (@testing-library/svelte)</summary> ### [`v5.4.1`](https://redirect.github.com/testing-library/svelte-testing-library/releases/tag/%40testing-library/svelte%405.4.1) [Compare Source](https://redirect.github.com/testing-library/svelte-testing-library/compare/@testing-library/svelte@5.4.0...@testing-library/svelte@5.4.1) #### [@testing-library/svelte](https://redirect.github.com/testing-library/svelte) [5.4.1](https://redirect.github.com/testing-library/svelte-testing-library/compare/@testing-library/svelte@5.4.0...@testing-library/svelte@5.4.1) (2026-06-21) ##### Dependencies - **[@testing-library/svelte-core](https://redirect.github.com/testing-library/svelte-core):** upgraded to 1.1.2 ### [`v5.4.0`](https://redirect.github.com/testing-library/svelte-testing-library/releases/tag/%40testing-library/svelte%405.4.0) [Compare Source](https://redirect.github.com/testing-library/svelte-testing-library/compare/@testing-library/svelte@5.3.1...@testing-library/svelte@5.4.0) #### [@testing-library/svelte](https://redirect.github.com/testing-library/svelte) [5.4.0](https://redirect.github.com/testing-library/svelte-testing-library/compare/@testing-library/svelte@5.3.1...@testing-library/svelte@5.4.0) (2026-06-20) ##### Features - add wrapper option ([#492](https://redirect.github.com/testing-library/svelte-testing-library/issues/492)) ([959f8c5](https://redirect.github.com/testing-library/svelte-testing-library/commit/959f8c5a5d7b1540907043bef23cc070757903e8)) ##### Dependencies - **[@testing-library/svelte-core](https://redirect.github.com/testing-library/svelte-core):** upgraded to 1.1.0 </details> <details> <summary>ferdikoomen/openapi-typescript-codegen (openapi-typescript-codegen)</summary> ### [`v0.31.0`](https://redirect.github.com/ferdikoomen/openapi-typescript-codegen/releases/tag/v0.31.0) [Compare Source](https://redirect.github.com/ferdikoomen/openapi-typescript-codegen/compare/v0.30.0...v0.31.0) #### v0.31.0 Maintenance release: dependency upgrades (including several major-version bumps), TypeScript 6 compatibility, and a build script fix. No changes to the generator's output or public API. ##### Dependencies - commander 14.0.2 → 14.0.3 - fs-extra 11.3.3 → 11.3.5 - handlebars 4.7.8 → 4.7.9 ##### Dev dependencies - [@angular-devkit/build-angular](https://redirect.github.com/angular-devkit/build-angular) 21.0.4 → 22.0.3 - [@angular/animations](https://redirect.github.com/angular/animations) 21.0.6 → 22.0.2 - [@angular/cli](https://redirect.github.com/angular/cli) 21.0.4 → 22.0.3 - [@angular/common](https://redirect.github.com/angular/common) 21.0.6 → 22.0.2 - [@angular/compiler](https://redirect.github.com/angular/compiler) 21.0.6 → 22.0.2 - [@angular/compiler-cli](https://redirect.github.com/angular/compiler-cli) 21.0.6 → 22.0.2 - [@angular/core](https://redirect.github.com/angular/core) 21.0.6 → 22.0.2 - [@angular/forms](https://redirect.github.com/angular/forms) 21.0.6 → 22.0.2 - [@angular/platform-browser](https://redirect.github.com/angular/platform-browser) 21.0.6 → 22.0.2 - [@angular/platform-browser-dynamic](https://redirect.github.com/angular/platform-browser-dynamic) 21.0.6 → 22.0.2 - [@angular/router](https://redirect.github.com/angular/router) 21.0.6 → 22.0.2 - [@babel/cli](https://redirect.github.com/babel/cli) 7.28.3 → 7.29.7 - [@babel/core](https://redirect.github.com/babel/core) 7.28.5 → 7.29.7 - [@babel/preset-env](https://redirect.github.com/babel/preset-env) 7.28.5 → 7.29.7 - [@babel/preset-typescript](https://redirect.github.com/babel/preset-typescript) 7.28.5 → 7.29.7 - [@eslint/js](https://redirect.github.com/eslint/js) 9.39.2 → 10.0.1 - [@rollup/plugin-commonjs](https://redirect.github.com/rollup/plugin-commonjs) 29.0.0 → 29.0.3 - [@rollup/plugin-terser](https://redirect.github.com/rollup/plugin-terser) 0.4.4 → 1.0.0 - [@types/node](https://redirect.github.com/types/node) 25.0.3 → 26.0.0 - [@types/qs](https://redirect.github.com/types/qs) 6.14.0 → 6.15.1 - [@typescript-eslint/eslint-plugin](https://redirect.github.com/typescript-eslint/eslint-plugin) 8.50.1 → 8.61.1 - [@typescript-eslint/parser](https://redirect.github.com/typescript-eslint/parser) 8.50.1 → 8.61.1 - axios 1.13.2 → 1.18.0 - eslint 9.39.2 → 10.5.0 - eslint-plugin-prettier 5.5.4 → 5.5.6 - eslint-plugin-simple-import-sort 12.1.1 → 13.0.0 - form-data 4.0.5 → 4.0.6 - glob 13.0.0 → 13.0.6 - globals 16.5.0 → 17.6.0 - jest 30.2.0 → 30.4.2 - jest-cli 30.2.0 → 30.4.2 - prettier 3.7.4 → 3.8.4 - puppeteer 24.34.0 → 24.43.1 - qs 6.14.0 → 6.15.2 - rimraf 6.1.2 → 6.1.3 - rollup 4.54.0 → 4.62.2 - typescript 5.9.3 → 6.0.3 - typescript-eslint 8.50.1 → 8.61.1 - zone.js 0.16.0 → 0.16.2 **Full Changelog**: <https://github.com/ferdikoomen/openapi-typescript-codegen/compare/v0.30.0...v0.31.0> </details> <details> <summary>sveltejs/svelte (svelte)</summary> ### [`v5.56.3`](https://redirect.github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5563) [Compare Source](https://redirect.github.com/sveltejs/svelte/compare/svelte@5.56.2...svelte@5.56.3) ##### Patch Changes - fix: ignore errors that occur in destroyed effects ([#18384](https://redirect.github.com/sveltejs/svelte/pull/18384)) - fix: type BigInts in `$state.snapshot(...)` return values ([#18388](https://redirect.github.com/sveltejs/svelte/pull/18388)) ### [`v5.56.2`](https://redirect.github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5562) [Compare Source](https://redirect.github.com/sveltejs/svelte/compare/svelte@5.56.1...svelte@5.56.2) ##### Patch Changes - fix: properly track effect end node for async sibling component ([#18371](https://redirect.github.com/sveltejs/svelte/pull/18371)) - fix: prevent false-positive reactivity loss warning ([#18373](https://redirect.github.com/sveltejs/svelte/pull/18373)) - chore: bump esrap dependency ([#18372](https://redirect.github.com/sveltejs/svelte/pull/18372)) - fix: ignore declaration tags for animation directive ([#18366](https://redirect.github.com/sveltejs/svelte/pull/18366)) - fix: reject pending async deriveds on discard ([#18308](https://redirect.github.com/sveltejs/svelte/pull/18308)) </details> <details> <summary>voidzero-dev/vite-plus (vite)</summary> ### [`v0.2.1`](https://redirect.github.com/voidzero-dev/vite-plus/releases/tag/v0.2.1): vite-plus v0.2.1 [Compare Source](https://redirect.github.com/voidzero-dev/vite-plus/compare/v0.2.0...v0.2.1) Restores support for older Node.js (back to `20.19.0`) and makes `vp exec --fail-if-no-match` fail correctly on unmatched filters. ##### Fixes & Enhancements - Stop blocking older Node.js versions: v0.2.0 blocked commands when the resolved Node.js version fell outside the declared range. This reverts that enforcement and widens `engines.node` to `^20.19.0 || ^22.18.0 || >=24.11.0`, matching Vite's own `^20.19.0` floor, so older Node that works in practice (e.g. Node 20 in rolldown CI) is no longer rejected ([#1865](https://redirect.github.com/voidzero-dev/vite-plus/pull/1865)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp exec --fail-if-no-match`: exit non-zero when one or more `--filter` expressions match no workspace packages. Strict mode previously only warned and returned success, so typoed filters looked successful in CI even though no package command ran ([#1859](https://redirect.github.com/voidzero-dev/vite-plus/pull/1859)), by [@jong-kyung](https://redirect.github.com/jong-kyung) ##### Bundled Versions | Tool | Version | Source | | --------------- | -------- | ------------------------------------------------------------------------------------------------- | | vite | `8.0.16` | [`f94df87`](https://redirect.github.com/vitejs/vite/commit/f94df87ff03b40b65e29bacdc04cc18c7bccaa4a) | | rolldown | `1.1.1` | [`d7f919c`](https://redirect.github.com/rolldown/rolldown/commit/d7f919c18980e6b4a26d06bd071d7cf14cf810a7) | | tsdown | `0.22.3` | [npm](https://npmx.dev/package/tsdown/v/0.22.3) | | vitest | `4.1.9` | [npm](https://npmx.dev/package/vitest/v/4.1.9) | | oxlint | `1.70.0` | [npm](https://npmx.dev/package/oxlint/v/1.70.0) | | oxlint-tsgolint | `0.23.0` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/0.23.0) | | oxfmt | `0.55.0` | [npm](https://npmx.dev/package/oxfmt/v/0.55.0) | ##### Upgrade ```bash vp upgrade ``` ##### Upgrading from 0.1.x to 0.2.1 Prompt ```md You are upgrading a project that uses Vite+ (the `vp` CLI) from v0.1.x to v0.2.1. v0.2.1 has one breaking change vs v0.1.x: it consumes upstream Vitest directly. The `@voidzero-dev/vite-plus-test` wrapper package is removed. `vitest` and the base browser runtime (`@vitest/browser`, `@vitest/browser-preview`) now come in transitively through `vite-plus`. The opt-in browser providers (`@vitest/browser-playwright`, `@vitest/browser-webdriverio`) are NOT shipped by `vite-plus`: any project that runs browser-mode tests must install the provider it uses itself. Do not run `vp migrate` for this upgrade; it is not reliable enough yet. Make the changes yourself by editing the project's files, then verify by running the tools. How to run vp: if a global `vp` is available, use it. Otherwise this project only ships the local CLI from the `vite-plus` package, so run vp as the project-local binary (for example via the package manager's exec: pnpm exec, npx, yarn, or bunx). After any install, re-resolve vp so you always run the version currently in the project. Do the following: 1. Set the `vite-plus` dependency to the exact version `0.2.1` and reinstall, so the new toolchain is installed and the lockfile moves off 0.1.x. In a monorepo, do this for every workspace package that depends on `vite-plus` (a shared `catalog:` entry covers them all at once). Changing the spec to `0.2.1` is what moves the lockfile off the old resolution; a reinstall that leaves the spec unchanged would keep the old version. 2. Remove the `@voidzero-dev/vite-plus-test` wrapper from the project. Search everywhere it could appear: package.json, the lockfile, any workspace or catalog config (such as pnpm-workspace.yaml or .yarnrc.yml), and the source files. Then classify the project and apply the matching case. Note these are not exclusive: a browser-mode project is also handled by case C in addition to removing the wrapper config. First, determine the project's Vitest usage: - BROWSER MODE: the project runs Vitest in the browser. It does if a config or test file imports a real browser provider (`vite-plus/test/browser-playwright` or `vite-plus/test/browser-webdriverio`, or the pre-upgrade raw forms `@vitest/browser-playwright` / `@vitest/browser-webdriverio`), or sets `test.browser.enabled`. This needs extra deps regardless of anything below; see case C. - DIRECT vitest usage: a source or test file imports directly from `vitest` or `@vitest/...`, or a `@vitest/*` package is listed in its dependencies (for example a coverage provider). Plain imports from `vite-plus/test` and `vite-plus/test/*` do NOT count as direct usage; a `vite-plus/test/browser-*` provider import is a browser-mode signal (case C), not direct usage. Case A - node-mode only (no direct vitest usage, no browser mode; the common case): remove the vitest configuration entirely. In package.json, delete the `vitest` entry from `dependencies` / `devDependencies` in whatever form it takes (a `@voidzero-dev/vite-plus-test` alias, a `catalog:` reference, or a plain version). Also remove the `vitest` entry from every dependency-resolution mechanism in the project: both `overrides` and `resolutions`, pnpm `overrides`/`catalog` (in package.json or pnpm-workspace.yaml), and any catalog entry. If `vitest` appears in more than one of these, remove all of them. Do not add a pinned `vitest`; it arrives transitively through `vite-plus` and the node-mode test command works without it. Case B - direct vitest usage: pin upstream vitest to the version bundled with vite-plus (4.1.9 for v0.2.1), and upgrade every vitest ecosystem package the project depends on so the whole tree resolves to a single vitest. Set each `@vitest/*` package the project lists (for example `@vitest/coverage-v8`, `@vitest/ui`, `@vitest/browser`) to that same version (4.1.9), since those are pinned to an exact vitest version. Also update any other vitest integration package (such as `vitest-browser-*`) to a release compatible with that vitest version. Leaving an ecosystem package on an older version pulls in a second copy of vitest, which Vitest rejects at runtime. Case C - browser mode (in addition to removing the wrapper config): you MUST add two deps to the workspace package that runs the browser tests (not the repo root, unless that is where the tests live), both pinned to the bundled vitest version so the tree still resolves to a single vitest: - The browser provider the project actually uses: `@vitest/browser-playwright@4.1.9` and/or `@vitest/browser-webdriverio@4.1.9`. Without it, config load fails with `Cannot find package '@vitest/browser-playwright'` from `vite-plus/test/browser-playwright`. Make sure its framework peer is present too (`playwright` for Playwright, `webdriverio` for WebdriverIO); the project usually already has it. - A direct `vitest@4.1.9`. This is the one case where you DO add a pinned vitest, and it contradicts the "never add vitest" rule that holds for node mode. Reason: under pnpm's isolated node_modules, `vitest` is only a transitive dep of `vite-plus`, so the browser-tester Vite server (rooted at the consumer project) cannot resolve `vitest/internal/browser` or the `vitest > ...` optimizeDeps entries. The symptom is `Failed to resolve import "vitest/internal/browser"` followed by `Failed to connect to the browser session ... within the timeout` and a `no tests` run. vite-plus 0.2.1 ships a `vite-plus:vitest-resolver` plugin meant to rescue this, but it does not reach the separate `@vitest/browser` orchestrator server, so a direct `vitest@4.1.9` (matching the bundled version, single copy preserved) is required. (If a future vite-plus fixes the resolver to cover the browser-tester server, this direct `vitest` may become unnecessary; re-check.) In all cases, also delete any dependency-resolution config that existed only to accommodate the wrapper or the old vitest, for example pnpm `peerDependencyRules` entries (`allowedVersions` / `ignoreMissing`) referencing `vitest`, `@vitest/*`, or `@voidzero-dev/vite-plus-test`, and the equivalent peer-tweak config in other package managers (such as yarn `packageExtensions`). Leave rules that are unrelated to vitest or the wrapper untouched. 3. Keep the `vite` -> Vite+ core override (it is still required) and set it to the matching exact version: map `vite` to `npm:@voidzero-dev/vite-plus-core@0.2.1` in whatever override, resolution, or catalog form the project already uses. `@voidzero-dev/vite-plus-core` is released in lockstep with `vite-plus`. 4. Leave imports from `vite-plus/test` (and `vite-plus/test/*`, including `vite-plus/test/browser-playwright`) unchanged; that is the stable public API. Only if a file imports directly from `@voidzero-dev/vite-plus-test`, repoint it to `vite-plus/test`. Leave `declare module 'vitest'` / `declare module '@vitest/browser*'` type augmentations pointing at the upstream module (they must target the upstream identity to merge). 5. Reinstall so the lockfile reflects your edits, then verify: - No reference to `@voidzero-dev/vite-plus-test` remains anywhere outside node_modules (source, configs, lockfile). - The dependency tree resolves to a single `vitest` version (4.1.9) with no duplicate copies. Note that one `vitest@4.1.9:` entry in the lockfile `packages:` section plus one `vitest@4.1.9(...)` key in `snapshots:` is still a single version, not a duplicate. - The project's tests pass with Vitest's native banner; for browser mode, confirm the suite actually runs in the browser (you get passing test files, not `no tests` or a session timeout). Browser tests also need the browser binary installed (e.g. `npx playwright install chromium`). - The Vite+ check workflow passes (exit 0). A pre-existing lint/format warning in a file you did not touch is not a failure; report it but do not fix it. Troubleshooting: if you hit `vitest/internal/browser` resolution errors, or see duplicate `@vitest/browser` / `vite-plus` peer-variant directories under `node_modules/.pnpm` after several sequential installs across this dependency-graph change, do a clean reinstall (remove `node_modules` in the root and all workspaces, remove the Vite optimize caches `node_modules/.vite`, then reinstall) to collapse the stale variants before concluding it is a code problem. Constraints: - Do not run `vp migrate`. - Do not bypass git hooks. If a pre-existing failure blocks you, report it rather than forcing through. - Make the smallest set of edits that reaches the end state above; do not reformat unrelated files. (For browser mode, the added `vitest` + provider pins ARE part of that minimal end state.) - When done, give me a short summary: old vs new `vite-plus` version, the files you changed, the test/check results, and call out explicitly any dependency you added beyond the wrapper removal (especially a direct `vitest`) with the reason. ``` **Full Changelog**: <https://github.com/voidzero-dev/vite-plus/compare/v0.2.0...v0.2.1> ##### Published Packages - `@voidzero-dev/vite-plus-core@0.2.1` - `vite-plus@0.2.1` ##### Installation **macOS/Linux:** ```bash curl -fsSL https://vite.plus | bash ``` **Windows:** ```powershell irm https://vite.plus/ps1 | iex ``` Or download and run `vp-setup.exe` from the assets below. ### [`v0.2.0`](https://redirect.github.com/voidzero-dev/vite-plus/releases/tag/v0.2.0): vite-plus v0.2.0 [Compare Source](https://redirect.github.com/voidzero-dev/vite-plus/compare/v0.1.24...v0.2.0) Vite+ now consumes upstream Vitest directly (no wrapper), raises the minimum supported Node.js version to 22.18.0, and ships corepack and devEngines support. ##### Highlights - **`vp test` now runs upstream Vitest directly (breaking)**: Vite+ used to ship `@voidzero-dev/vite-plus-test`, a rebundled copy of Vitest that lagged upstream releases. That package is removed; `vp test` now runs the real upstream `vitest`, which is installed automatically as a dependency of `vite-plus` (you no longer add `vitest` or `@vitest/*` yourself, and `vite` still resolves to `@voidzero-dev/vite-plus-core` via package-manager overrides). Your `import ... from 'vite-plus/test'` code keeps working unchanged and `vp migrate` updates existing projects ([#1588](https://redirect.github.com/voidzero-dev/vite-plus/pull/1588)), by [@Brooooooklyn](https://redirect.github.com/Brooooooklyn) - **Minimum supported Node.js version raised to `^22.18.0 || >=24.11.0` (breaking)**: Node 20 reached end-of-life and the bundled tsdown already required `^22.18.0`, so the published engines range now matches what `vp pack` can actually deliver; `vp exec` / `vp run` / `vp dlx` reject projects resolving an older Node with the existing incompatibility error ([#1813](https://redirect.github.com/voidzero-dev/vite-plus/pull/1813)), by [@fengmk2](https://redirect.github.com/fengmk2) - **Corepack now works under Vite+**: `corepack` now set up by default, so `corepack enable` and the pnpm/yarn launchers just work, even on Node 25+ which no longer ships it. ([#1808](https://redirect.github.com/voidzero-dev/vite-plus/pull/1808)), by [@fengmk2](https://redirect.github.com/fengmk2) - **devEngines support for runtime and package-manager selection**: Vite+ reads `devEngines.runtime` (ranked above `engines.node`) and `devEngines.packageManager`; auto-pin and `vp migrate` write `devEngines.packageManager`, `vp env pin` / `unpin` target `devEngines.runtime`, and `vp env doctor` reports conflicts instead of silently resolving them ([#1760](https://redirect.github.com/voidzero-dev/vite-plus/pull/1760)), by [@fengmk2](https://redirect.github.com/fengmk2) ##### Features - `vp pm approve-builds`: forward to npm's new `approve-scripts` / `deny-scripts` (npm >= 11.16.0) instead of the previous no-op, matching `pnpm approve-builds` / `bun pm trust`; mixed approve+deny is rejected with actionable guidance and npm's advisory-only caveat is surfaced ([#1733](https://redirect.github.com/voidzero-dev/vite-plus/pull/1733)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp create`: support local monorepo templates declared in `create.templates` in `vite.config.ts`; `vp create vite:generator` scaffolds a Bingo generator and auto-registers it in the picker, replacing the old package.json-keyword inference ([#1777](https://redirect.github.com/voidzero-dev/vite-plus/pull/1777)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp create`: detect direct dependencies whose build scripts the package manager gated (e.g. native builds like `better-sqlite3`) and act on them; prompt to approve each (default off) interactively, point at `vp pm approve-builds` non-interactively, or build them with `--approve-builds` ([#1828](https://redirect.github.com/voidzero-dev/vite-plus/pull/1828)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp config`: add `--no-hooks` and `--no-agent` opt-outs to skip git-hook installation and coding-agent instruction updates ([#1842](https://redirect.github.com/voidzero-dev/vite-plus/pull/1842)), by [@leno23](https://redirect.github.com/leno23) - `vp list -g`: sort the global package list output so entries appear in a stable order ([#1748](https://redirect.github.com/voidzero-dev/vite-plus/pull/1748)), by [@liangmiQwQ](https://redirect.github.com/liangmiQwQ) - Upgrade upstream dependencies: rolldown `1.0.3 -> 1.1.1`, tsdown `0.22.1 -> 0.22.3`, oxlint `1.67.0 -> 1.70.0`, oxfmt `0.52.0 -> 0.55.0`, vitest `4.1.8 -> 4.1.9`, and the oxc toolchain `0.133.0 -> 0.136.0` ([#1749](https://redirect.github.com/voidzero-dev/vite-plus/pull/1749), [#1767](https://redirect.github.com/voidzero-dev/vite-plus/pull/1767), [#1812](https://redirect.github.com/voidzero-dev/vite-plus/pull/1812), [#1834](https://redirect.github.com/voidzero-dev/vite-plus/pull/1834), [#1855](https://redirect.github.com/voidzero-dev/vite-plus/pull/1855)), by [@voidzero-guard](https://redirect.github.com/voidzero-guard)\[bot] ##### Fixes & Enhancements - Security: resolve open Rust Dependabot advisories by bumping transitive `openssl` `0.10.76 -> 0.10.80` (`openssl-sys` `0.9.112 -> 0.9.116`), fixing five high-severity rust-openssl issues (buffer overflows in key derivation, AES key wrap, and digest finalization; an unchecked PSK/cookie trampoline length leaking adjacent memory; and OCSP-responder undefined behavior: [GHSA-pqf5-4pqq-29f5](https://redirect.github.com/advisories/GHSA-pqf5-4pqq-29f5), [GHSA-8c75-8mhr-p7r9](https://redirect.github.com/advisories/GHSA-8c75-8mhr-p7r9), [GHSA-ghm9-cr32-g9qj](https://redirect.github.com/advisories/GHSA-ghm9-cr32-g9qj), [GHSA-hppc-g8h3-xhp3](https://redirect.github.com/advisories/GHSA-hppc-g8h3-xhp3), [GHSA-xp3w-r5p5-63rr](https://redirect.github.com/advisories/GHSA-xp3w-r5p5-63rr)), and drop the unmaintained, unsound `libyml` ([GHSA-gfxp-f68g-8x78](https://redirect.github.com/advisories/GHSA-gfxp-f68g-8x78), high) by removing dead `serde_yml` code ([#1742](https://redirect.github.com/voidzero-dev/vite-plus/pull/1742)), by [@fengmk2](https://redirect.github.com/fengmk2) - Security (docs site): update `mermaid` `11.13.0 -> 11.15.0` to fix improper `classDef` sanitization in state diagrams that allowed HTML injection ([CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) / [GHSA-ghcm-xqfw-q4vr](https://redirect.github.com/advisories/GHSA-ghcm-xqfw-q4vr), medium severity; `<script>` tags are stripped so it does not reach XSS) ([#1745](https://redirect.github.com/voidzero-dev/vite-plus/pull/1745)), by [@renovate](https://redirect.github.com/renovate)\[bot] - `vp check --fix` / `vp staged`: create/migrate now wrap inline Vite `plugins: [...]` arrays with `lazyPlugins(...)` so plugin factories aren't eagerly executed (and don't hang on open handles) during lint/format/check config loading ([#1752](https://redirect.github.com/voidzero-dev/vite-plus/pull/1752)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - `vp migrate`: complete pending migration work for projects that already have `vite-plus` installed (scripts, imports, tsconfig types, ESLint/Prettier, legacy hooks, package-manager settings) instead of treating `vite-plus` as migration-complete; fully migrated projects stay idempotent ([#1821](https://redirect.github.com/voidzero-dev/vite-plus/pull/1821)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - `vp create` / `vp migrate`: detect shorthand `fmt,` / `lint,` config keys so a duplicate inline block is no longer injected ([#1843](https://redirect.github.com/voidzero-dev/vite-plus/pull/1843)), by [@fengmk2](https://redirect.github.com/fengmk2) - IDE oxlint/oxfmt wrappers: set `VP_COMMAND` so `lazyPlugins()` skips framework plugins during LSP config reads, preventing a stray `.svelte-kit` (and similar) directory at the monorepo root ([#1764](https://redirect.github.com/voidzero-dev/vite-plus/pull/1764)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - `vp lint` / `vp run -r lint` on Windows: keep the absolute `tsgolint` path for workspace lint runs instead of downgrading it to a wrong cwd-relative path ([#1758](https://redirect.github.com/voidzero-dev/vite-plus/pull/1758)), by [@semimikoh](https://redirect.github.com/semimikoh) - oxlint wrapper: set the `tsgolint` path so type-aware lint resolves it ([#1811](https://redirect.github.com/voidzero-dev/vite-plus/pull/1811)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - `vp install -g`: use a unique backup directory and treat stale-backup cleanup as best-effort so a locked Windows binary no longer fails an otherwise successful reinstall ([#1753](https://redirect.github.com/voidzero-dev/vite-plus/pull/1753)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp install -g`: remove stale managed binary shims when a reinstalled package drops a bin from its `package.json#bin` ([#1765](https://redirect.github.com/voidzero-dev/vite-plus/pull/1765)), by [@liangmiQwQ](https://redirect.github.com/liangmiQwQ) - `vp create --git`: surface git's actual stdout/stderr when the initial commit fails instead of always blaming `user.name` / `user.email` ([#1819](https://redirect.github.com/voidzero-dev/vite-plus/pull/1819)), by [@fengmk2](https://redirect.github.com/fengmk2) - `vp create vite:generator`: reject `--git` / `--no-git`, since adding a generator to an existing monorepo does not initialize git ([#1788](https://redirect.github.com/voidzero-dev/vite-plus/pull/1788)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - Global CLI: harden `find_system_tool` against a self-exec loop (skip the running executable's own bin directory) and fix two `vite_global_cli` tests that could hang ([#1820](https://redirect.github.com/voidzero-dev/vite-plus/pull/1820)), by [@fengmk2](https://redirect.github.com/fengmk2) - CLI help: unify alias display ([#1832](https://redirect.github.com/voidzero-dev/vite-plus/pull/1832)), show supported `run` options ([#1797](https://redirect.github.com/voidzero-dev/vite-plus/pull/1797)), show `--fail-if-no-match` in `exec` help ([#1798](https://redirect.github.com/voidzero-dev/vite-plus/pull/1798)), add the `implode` documentation link ([#1796](https://redirect.github.com/voidzero-dev/vite-plus/pull/1796)), and handle nested-command typo help ([#1803](https://redirect.github.com/voidzero-dev/vite-plus/pull/1803)), by [@jong-kyung](https://redirect.github.com/jong-kyung) ##### Docs - Document `vp create` opt-out options ([#1790](https://redirect.github.com/voidzero-dev/vite-plus/pull/1790)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - Document `vp upgrade` options ([#1847](https://redirect.github.com/voidzero-dev/vite-plus/pull/1847)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - Align the config overview with the sidebar ([#1846](https://redirect.github.com/voidzero-dev/vite-plus/pull/1846)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - Sync the documented command lists with the help output ([#1850](https://redirect.github.com/voidzero-dev/vite-plus/pull/1850)), by [@jong-kyung](https://redirect.github.com/jong-kyung) - Clarify lazy plugin side effects ([#1841](https://redirect.github.com/voidzero-dev/vite-plus/pull/1841)), by [@leno23](https://redirect.github.com/leno23) - Add JongKyung's X profile ([#1844](https://redirect.github.com/voidzero-dev/vite-plus/pull/1844)) and update Christoph's X profile ([#1845](https://redirect.github.com/voidzero-dev/vite-plus/pull/1845)) on the team page, by [@jong-kyung](https://redirect.github.com/jong-kyung) ##### Refactor - Remove the CLI tips system; the shortcuts it printed on `vp install` are already covered by the help system and added unnecessary complexity ([#1799](https://redirect.github.com/voidzero-dev/vite-plus/pull/1799)), by [@cpojer](https://redirect.github.com/cpojer) ##### Chore - Re-enable Renovate dependency updates with a targeted ignore-list ([#1744](https://redirect.github.com/voidzero-dev/vite-plus/pull/1744)), by [@fengmk2](https://redirect.github.com/fengmk2) - Keep generated NAPI bindings during upgrade-deps ([#&#8 > ✂ **Note** > > PR body was truncated to here. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/kenn-io/agentsview).  Co-authored-by: renovate[bot] <renovate[bot]@users.noreply.github.com>

Model-assisted evaluation must not silently weaken the local extraction boundary. Keep judging local by default and require explicit per-run disclosure before a named remote judge receives candidate or transcript-derived evidence. Also bind the merge-hardening plan to the existing source-UUID index, synchronous batched exposure recording, and explicit Milestone 2 ownership of calibration-only APIs and data-retention limits. VALID (fixed): #1-#6, #8. INVALID (dismissed): #7 -- the applicable repository AGENTS.md defines no function-length limit and no repository CLAUDE.md exists. PEDANTIC (skipped): none.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 19, 2026

wesm mentioned this pull request Feb 22, 2026

build: batch update all dependencies #9

Merged

3 tasks

wesm closed this in 03715e9 Feb 22, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/frontend/sveltejs/vite-plugin-svelte-6.2.4 branch February 22, 2026 17:57

renovate Bot mentioned this pull request Jun 28, 2026

fix(deps): update javascript dependencies #908

Merged

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps-dev): Bump @sveltejs/vite-plugin-svelte from 5.0.3 to 6.2.4 in /frontend - #8

build(deps-dev): Bump @sveltejs/vite-plugin-svelte from 5.0.3 to 6.2.4 in /frontend#8
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend/sveltejs/vite-plugin-svelte-6.2.4

dependabot Bot commented on behalf of github Feb 19, 2026

Uh oh!

roborev-ci Bot commented Feb 22, 2026

Uh oh!

dependabot Bot commented on behalf of github Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 19, 2026

@​sveltejs/vite-plugin-svelte@​6.2.4

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.2.3

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.2.2

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.2.1

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.2.0

Minor Changes

@​sveltejs/vite-plugin-svelte@​6.1.4

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.1.3

Patch Changes

@​sveltejs/vite-plugin-svelte@​6.1.2

Patch Changes

6.2.4

Patch Changes

6.2.3

Patch Changes

6.2.2

Patch Changes

6.2.1

Patch Changes

6.2.0

Minor Changes

6.1.4

Patch Changes

6.1.3

Patch Changes

Uh oh!

roborev-ci Bot commented Feb 22, 2026

roborev: Combined Review (3dd71ab)

High

Medium

Uh oh!

dependabot Bot commented on behalf of github Feb 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

`@sveltejs/vite-plugin-svelte@6`.2.4

`@sveltejs/vite-plugin-svelte@6`.2.3

`@sveltejs/vite-plugin-svelte@6`.2.2

`@sveltejs/vite-plugin-svelte@6`.2.1

`@sveltejs/vite-plugin-svelte@6`.2.0

`@sveltejs/vite-plugin-svelte@6`.1.4

`@sveltejs/vite-plugin-svelte@6`.1.3

`@sveltejs/vite-plugin-svelte@6`.1.2

roborev: Combined Review (`3dd71ab`)