chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@eslint/js (source)	^9.39.0 -> ^9.39.1			devDependencies	patch
@testing-library/svelte	^5.2.8 -> ^5.2.9			devDependencies	patch
@types/node (source)	^24.9.2 -> ^24.10.1			devDependencies	minor
eslint (source)	^9.39.0 -> ^9.39.1			devDependencies	patch
node	24.11.0 -> 24.11.1			uses-with	patch
pnpm (source)	10.20.0 -> 10.23.0			packageManager	minor
svelte (source)	^5.43.2 -> ^5.43.14			devDependencies	patch
svelte-check	^4.3.3 -> ^4.3.4			devDependencies	patch
typescript-eslint (source)	^8.46.2 -> ^8.47.0			devDependencies	minor
vite (source)	^7.1.12 -> ^7.2.4			devDependencies	minor
vitest (source)	^4.0.6 -> ^4.0.13			devDependencies	patch

---

Release Notes

eslint/eslint (@​eslint/js)

v9.39.1

Compare Source

testing-library/svelte-testing-library (@​testing-library/svelte)

v5.2.9

Compare Source

Bug Fixes

• svelte5: do not deeply proxify passed-in props (#​456) (734e290), closes #​455

eslint/eslint (eslint)

v9.39.1

Compare Source

actions/node-versions (node)

v24.11.1: 24.11.1

Compare Source

Node.js 24.11.1

pnpm/pnpm (pnpm)

v10.23.0: pnpm 10.23

Compare Source

Minor Changes

• Added --lockfile-only option to pnpm list #​10020.

Patch Changes

• pnpm self-update should download pnpm from the configured npm registry #​10205.
• pnpm self-update should always install the non-executable pnpm package (pnpm in the registry) and never the @pnpm/exe package, when installing v11 or newer. We currently cannot ship @pnpm/exe as pkg doesn't work with ESM #​10190.
• Node.js runtime is not added to "dependencies" on pnpm add, if there's a engines.runtime setting declared in package.json #​10209.
• The installation should fail if an optional dependency cannot be installed due to a trust policy check failure #​10208.
• pnpm list and pnpm why now display npm: protocol for aliased packages (e.g., foo npm:[email protected]) #​8660.
• Don't add an extra slash to the Node.js mirror URL #​10204.
• pnpm store prune should not fail if the store contains Node.js packages #​10131.

Platinum Sponsors

Gold Sponsors

v10.22.0: pnpm 10.22

Compare Source

Minor Changes

• Added support for trustPolicyExclude #​10164.

  You can now list one or more specific packages or versions that pnpm should allow to install, even if those packages don't satisfy the trust policy requirement. For example:

  trustPolicy: no-downgrade
  trustPolicyExclude:
    - [email protected]
    - [email protected] || 5.102.1

• Allow to override the engines field on publish by the publishConfig.engines field.

Patch Changes

• Don't crash when two processes of pnpm are hardlinking the contents of a directory to the same destination simultaneously #​10179.

Platinum Sponsors

Gold Sponsors

v10.21.0

Compare Source

sveltejs/svelte (svelte)

v5.43.14

Compare Source

Patch Changes

• fix: correctly migrate named self closing slots (#​17199)

• fix: error at compile time instead of at runtime on await expressions inside bindings/transitions/animations/attachments (#​17198)

• fix: take async blockers into account for bindings/transitions/animations/attachments (#​17198)

v5.43.13

Compare Source

Patch Changes

• fix: don't set derived values during time traveling (#​17200)

v5.43.12

Compare Source

Patch Changes

• fix: maintain correct linked list of effects when updating each blocks (#​17191)

v5.43.11

Compare Source

Patch Changes

• perf: don't use tracing overeager during dev (#​17183)

• fix: don't cancel transition of already outroing elements (#​17186)

v5.43.10

Compare Source

Patch Changes

• fix: avoid other batches running with queued root effects of main batch (#​17145)

v5.43.9

Compare Source

Patch Changes

• fix: correctly handle functions when determining async blockers (#​17137)

• fix: keep deriveds reactive after their original parent effect was destroyed (#​17171)

• fix: ensure eager effects don't break reactions chain (#​17138)

• fix: ensure async @const in boundary hydrates correctly (#​17165)

• fix: take blockers into account when creating #await blocks (#​17137)

• fix: parallelize async @consts in the template (#​17165)

v5.43.8

Compare Source

Patch Changes

• fix: each block losing reactivity when items removed while promise pending (#​17150)

v5.43.7

Compare Source

Patch Changes

• fix: properly defer document title until async work is complete (#​17158)

• fix: ensure deferred effects can be rescheduled later on (#​17147)

• fix: take blockers of components into account (#​17153)

v5.43.6

Compare Source

Patch Changes

• fix: don't deactivate other batches (#​17132)

v5.43.5

Compare Source

Patch Changes

• fix: ensure async static props/attributes are awaited (#​17120)

• fix: wait on dependencies of async bindings (#​17120)

• fix: await dependencies of style directives (#​17120)

v5.43.4

Compare Source

Patch Changes

• chore: simplify connection/disconnection logic (#​17105)

• fix: reconnect deriveds to effect tree when time-travelling (#​17105)

v5.43.3

Compare Source

Patch Changes

• fix: ensure fork always accesses correct values (#​17098)

• fix: change title only after any pending work has completed (#​17061)

• fix: preserve symbols when creating derived rest properties (#​17096)

sveltejs/language-tools (svelte-check)

v4.3.4

Compare Source

Patch Changes

• chore: use machine format when run by Claude Code (#​2870)

typescript-eslint/typescript-eslint (typescript-eslint)

v8.47.0

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.46.4

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

v8.46.3

Compare Source

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

You can read about our versioning strategy and releases on our website.

vitejs/vite (vite)

v7.2.4

Compare Source

Bug Fixes

• revert "perf(deps): replace debug with obug (#​21107)" (2d66b7b)

v7.2.3

Compare Source

Bug Fixes

• allow multiple bindCLIShortcuts calls with shortcut merging (#​21103) (5909efd)
• deps: update all non-major dependencies (#​21096) (6a34ac3)
• deps: update all non-major dependencies (#​21128) (4f8171e)

Performance Improvements

• deps: replace debug with obug (#​21107) (acfe939)

Miscellaneous Chores

• deps: update dependency @​rollup/plugin-commonjs to v29 (#​21099) (02ceaec)
• deps: update rolldown-related dependencies (#​21095) (39a0a15)
• deps: update rolldown-related dependencies (#​21127) (5029720)

v7.2.2

Compare Source

Bug Fixes

• revert "refactor: use fs.cpSync (#​21019)" (#​21081) (728c8ee)

v7.2.1

Compare Source

Bug Fixes

• worker: some worker asset was missing (#​21074) (82d2d6c)

Code Refactoring

• build: rename indexOfMatchInSlice to findPreloadMarker (#​21054) (f83264f)

v7.2.0

Compare Source

Bug Fixes

• css: fallback to sass when sass-embedded platform binary is missing (#​21002) (b1fd616)
• module-runner: make getBuiltins response JSON serializable (#​21029) (ad5b3bf)
• types: add undefined to optional properties for exactOptionalProperties type compatibility (#​21040) (2833c55)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​21047) (e3a6a83)

vitest-dev/vitest (vitest)

v4.0.13

Compare Source

   🐞 Bug Fixes

• types:
  • Don't use type from Vite 7.1  -  by @​sheremet-va in #​9071 (6356b)
  • Don't import node.js dependent types in vitest/browser  -  by @​sheremet-va in #​9068 (332af)

   🏎 Performance

• Avoid fetchModule roundtrip if the module is cached  -  by @​sheremet-va in #​9075 (b27e0)
• experimental: If fsCacheModule is enabled, read from the memory when possible  -  by @​sheremet-va in #​9076 (6b9a1)

    View changes on GitHub

v4.0.12

Compare Source

   🐞 Bug Fixes

• Inherit fsModuleCachePath by default  -  by @​sheremet-va in #​9063 (9a8bc)
• Don't import from @opentelemetry/api in public types  -  by @​sheremet-va in #​9066 (e944a)

    View changes on GitHub

v4.0.11

Compare Source

   🚀 Experimental Features

• api: Add extensible test artifact API  -  by @​macarie in #​8987 (77292)
  • See more at https://vitest.dev/api/advanced/artifacts
• expect: Provide task in MatchState  -  by @​macarie in #​9022 (afd1f)
• experimental: Support OpenTelemetry traces  -  by @​sheremet-va in #​8994 (d6d33)
  • See more at https://vitest.dev/guide/open-telemetry

   🏎 Performance

• experimental: Add file system cache  -  by @​sheremet-va in #​9026 (1b147)
  • See more at https://vitest.dev/config/experimental#experimental-fsmodulecache

    View changes on GitHub

v4.0.10

Compare Source

   🐞 Bug Fixes

• Remove onCancel when worker is terminated  -  by @​sheremet-va in #​9033 (6d7f0)
• browser:
  • Don't scale the iframe if UI is disabled  -  by @​sheremet-va in #​9018 (5406e)
  • Handle dependency stack traces with external source maps. Resolves: #​9003  -  by @​iclectic in #​9016 and #​9003 (57ae5)
• bun:
  • Parsing of stack trace for bun runtime  -  by @​nazarhussain in #​9032 (f3ec6)
• core:
  • Prevent starting new run when cancelling  -  by @​AriPerkkio in #​8991 (eb98d)
• pool:
  • Prevent writing to closed worker  -  by @​AriPerkkio and @​sheremet-va in #​9023 (042c6)
• reporters:
  • Report correct test run duration at the end  -  by @​sheremet-va in #​8969 (bc3a6)
• ui:
  • Use execution time from ws reporter (onFinished)  -  by @​userquin in #​8975 (f56dc)

    View changes on GitHub

v4.0.9

Compare Source

   🚀 Experimental Features

• expect: Add Set support to toBeOneOf  -  by @​tim-we and @​sheremet-va in #​8906 (a415d)

   🐞 Bug Fixes

• browser: Add favicon icons to the browser mode ui  -  by @​userquin in #​8972 (353ee)
• forks: Increase worker start timeout  -  by @​AriPerkkio in #​9027 (5e750)
• jsdom: Cloned request is an instance of Request  -  by @​sheremet-va in #​8985 (506a9)
• ui: Collect file/suite/test duration correctly  -  by @​userquin in #​8976 (8016d)

    View changes on GitHub

v4.0.8

Compare Source

   🐞 Bug Fixes

• Workaround noExternal merging bug on Vite 6  -  by @​hi-ogawa in #​8950 (bcb13)
• Missed context.d.ts file  -  by @​termorey in #​8965 (9044d)
• Incorrect error message for non-awaited expect.element()  -  by @​StyleShit in #​8954 (9638d)
• browser: Cleanup frame-ancestors from CSP header at coverage middleware  -  by @​userquin in #​8941 (1f730)
• deps: Update all non-major dependencies  -  by @​sheremet-va in #​8636 (da8b9)
• forks: Do not fail with Windows Defender enabled  -  by @​sheremet-va in #​8967 (c79f4)
• runner: Properly encode Uint8Array body in annotations  -  by @​Livan-pro in #​8951 (997ca)
• spy: Copy static properties if spy is initialised with vi.fn(), fix types for vi.spyOn(obj, class)  -  by @​sheremet-va in #​8956 (75e7f)
• webdriverio: When no argument is passed to the .click interaction command, the webdriver command should also have no argument  -  by @​julienw in #​8937 (069e6)

    View changes on GitHub

v4.0.7

Compare Source

   🐞 Bug Fixes

• Bind process in case global is overwritten  -  by @​AriPerkkio in #​8916 (6240d)
• Create environment once per worker with isolate: false  -  by @​sheremet-va in #​8915 (c9078)
• Add Locator as a possible element type in toContainElement() matcher  -  by @​vitalybaev in #​8910 and #​8927 (35a27)
• browser: Inherit isolate option, deprecate browser.isolate/browser.fileParallelism  -  by @​sheremet-va in #​8890 (9d2b4)
• cli: Parse --execArgv as array  -  by @​AriPerkkio in #​8924 (751c3)
• jsdom: Support URL.createObjectURL, FormData.set(prop, blob)  -  by @​sheremet-va in #​8935 (a1b73)
• pool: Avoid --require argument when running in deno  -  by @​pi0 in #​8897 (d41fa)
• typecheck: Handle re-runs outside tsc  -  by @​AriPerkkio in #​8920 (fdb2e)

   🏎 Performance

• pool:
  • Sort test files by project by default  -  by @​AriPerkkio in #​8914 (680a6)
• reporters:
  • Optimize getting the tests stats  -  by @​Connormiha in #​8908 (06d62)
  • Remove unnecessary Array.from call  -  by @​Connormiha in #​8907 (b6014)

    View changes on GitHub

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0053c91

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
sv-router	Ignored	Preview		Nov 21, 2025 7:00pm