Skip to content

Bump the npm-minor-and-patch group across 1 directory with 23 updates - #16

Closed
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/npm-minor-and-patch-d104bc328c
Closed

Bump the npm-minor-and-patch group across 1 directory with 23 updates#16
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/develop/npm-minor-and-patch-d104bc328c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm-minor-and-patch group with 23 updates in the / directory:

Package From To
@tailwindcss/typography 0.5.19 0.5.20
@tauri-apps/plugin-deep-link 2.4.7 2.4.10
@tauri-apps/plugin-dialog 2.6.0 2.7.3
@tauri-apps/plugin-fs 2.4.5 2.5.2
@tauri-apps/plugin-opener 2.5.3 2.5.5
@tauri-apps/plugin-updater 2.10.0 2.12.0
@thisux/sveltednd 0.0.20 0.8.0
dompurify 3.3.2 3.4.15
@types/dompurify 3.0.5 3.2.0
highlight.js 11.11.1 11.12.0
marked-highlight 2.2.3 2.2.4
svelte-dnd-action 0.9.68 0.9.79
tailwind-merge 3.4.0 3.7.0
@tailwindcss/postcss 4.1.17 4.3.3
@tauri-apps/api 2.10.1 2.11.1
@tauri-apps/cli 2.10.0 2.11.5
@testing-library/svelte 5.3.1 5.4.2
@testing-library/user-event 14.6.1 14.6.7
autoprefixer 10.4.22 10.6.1
happy-dom 20.1.0 20.14.5
postcss 8.5.6 8.5.28
svelte 5.45.6 5.57.1
tailwindcss 4.1.17 4.3.3

Updates @tailwindcss/typography from 0.5.19 to 0.5.20

Release notes

Sourced from @​tailwindcss/typography's releases.

v0.5.20

Fixed

  • Support installing with stable versions of Tailwind CSS v4 (#424)
Changelog

Sourced from @​tailwindcss/typography's changelog.

[0.5.20] - 2026-06-08

Fixed

  • Support installing with stable versions of Tailwind CSS v4 (#424)
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tailwindcss/typography since your current version.


Updates @tauri-apps/plugin-deep-link from 2.4.7 to 2.4.10

Commits

Updates @tauri-apps/plugin-dialog from 2.6.0 to 2.7.3

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

http v2.7.0

[2.7.0]

  • 1198a524 Security: Added the scopeRedirects plugin configuration option, which checks the URL scope on every hop of a redirect chain instead of only on the URL requested by the frontend. Without it, a server on an allowed origin can redirect the request to any other origin - including localhost services, internal hosts and cloud metadata endpoints - and the plugin follows it, returning the response to the webview.

    {
  "plugins": {
    "http": {
      "scopeRedirects": true
    }
  }
}

    It is opt-in because a redirect to a URL that is not allowed by the scope now fails with url not allowed on the configured scope instead of being followed, so applications that rely on being redirected outside of their scope must add the redirect target to the scope. This will become the default in v3.

    Note that tauri_plugin_http::init() now returns TauriPlugin<R, Option<Config>> instead of TauriPlugin<R>.

Updating crates.io index
    Updating crates.io index
   Packaging tauri-plugin-http v2.7.0 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/http)
    Updating crates.io index
    Packaged 26 files, 221.5KiB (57.9KiB compressed)
   Uploading tauri-plugin-http v2.7.0 (/home/runner/work/plugins-workspace/plugins-workspace/plugins/http)
    Uploaded tauri-plugin-http v2.7.0 to registry `crates-io`
note: waiting for tauri-plugin-http v2.7.0 to be available at registry `crates-io`
help: you may press ctrl-c to skip waiting; the crate should be available shortly
   Published tauri-plugin-http v2.7.0 at registry `crates-io`

http-js v2.6.1

[2.6.1]

  • a21555dd (#3566 by @​followdarko) Fix unhandled promise rejections on every fetch teardown: the request/body cleanup commands were fired as floating promises, and releasing an already-released resource rejects with The resource id N is invalid.. dropBody is now idempotent and both cleanup calls handle their own rejection.
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
</tr></table>

... (truncated)

Commits

Updates @tauri-apps/plugin-fs from 2.4.5 to 2.5.2

Commits

Updates @tauri-apps/plugin-opener from 2.5.3 to 2.5.5

Commits
  • 6e2e7e4 publish new versions (#3070)
  • 9a2c98f temp: remove updater changefiles
  • 4a2ecb6 chore(deps): update rkyv, closes #3196
  • 31415ef docs(shell): update example to include Encoding usage in Command::spawn (#3...
  • 04b33ea chore(deps): update dependency typescript-eslint to v8.50.1 (#3181)
  • 54e21f1 chore(deps): update dependency rollup to v4.54.0 (#3179)
  • d528c88 chore(deps): update dependency rollup to v4.53.5 (#3172)
  • 69146fa chore(deps): update dependency rollup to v4.53.4 (#3167)
  • 9f68f2d chore(deps): update dependency typescript-eslint to v8.50.0 (#3170)
  • 3d0d2e0 fix(opener): ignore inAppBrowser on desktop (#3163)
  • Additional commits viewable in compare view

Updates @tauri-apps/plugin-updater from 2.10.0 to 2.12.0

Release notes

Sourced from @​tauri-apps/plugin-updater's releases.

updater-js v2.12.0

[2.12.0]

  • 1308bfa3 Breaking change: the allowDowngrades option was removed from the check command and is now read from the plugin configuration instead.

    Previously any code running in the webview could pass allowDowngrades: true to plugin:updater|check and relax the version check from "the update must be newer" to "the update must be different", overriding the comparator the application had configured on the Rust side. The flag is now an application-level setting:

    {
  "plugins": {
    "updater": {
      "allowDowngrades": true
    }
  }
}

    It defaults to false, and is ignored when the application provides its own Builder::default_version_comparator, which continues to take precedence.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-updater@2.12.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.2kB README.md
npm notice 3.2kB dist-js/index.cjs
npm notice 3.0kB dist-js/index.d.ts
npm notice 3.2kB dist-js/index.js
npm notice 659B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-updater
npm notice version: 2.12.0
npm notice filename: tauri-apps-plugin-updater-2.12.0.tgz
npm notice package size: 3.9 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: f3b47d4bae20f5499efe043f4debb7c85f88b9b3
npm notice integrity: sha512-74+g7rSIHXQje[...]osT+6nphSa8Og==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=2893838281
</tr></table>

... (truncated)

Commits

Updates @thisux/sveltednd from 0.0.20 to 0.8.0

Release notes

Sourced from @​thisux/sveltednd's releases.

sveltednd: v0.8.0

0.8.0 (2026-09-01)

Features

  • add containerGroup for selective nested drag indicators (#77) (0239734)

This PR was generated with Release Please. See documentation.

sveltednd: v0.7.0

0.7.0 (2026-07-19)

Features

  • demo: rich SEO with THISUX brand signals (#72) (bad94f8)

sveltednd: v0.6.1

0.6.1 (2026-07-19)

Bug Fixes

  • demo: show package version from package.json (#70) (fff8bf2)

sveltednd: v0.6.0

0.6.0 (2026-07-19)

Features

  • add opt-in keyboard drag accessibility (#68) (e75485c)

sveltednd: v0.5.0

0.5.0 (2026-07-19)

Features

sveltednd: v0.4.2

0.4.2 (2026-07-19)

Bug Fixes

... (truncated)

Changelog

Sourced from @​thisux/sveltednd's changelog.

0.8.0 (2026-09-01)

Features

  • add containerGroup for selective nested drag indicators (#77) (0239734)

0.7.0 (2026-07-19)

Features

  • demo: rich SEO with THISUX brand signals (#72) (bad94f8)

0.6.1 (2026-07-19)

Bug Fixes

  • demo: show package version from package.json (#70) (fff8bf2)

0.6.0 (2026-07-19)

Features

  • add opt-in keyboard drag accessibility (#68) (e75485c)

0.5.0 (2026-07-19)

Features

[Unreleased]

Documentation

  • Rich SEO for the demo site: shared SeoHead, sitemap/robots, JSON-LD (SoftwareApplication + THISUX Private Limited Organization), OG image, canonical URLs, and consistent thisux.com brand signature

0.4.2 (2026-07-19)

Bug Fixes

... (truncated)

Commits
  • 53c5729 chore(main): release sveltednd 0.8.0 (#78)
  • 0239734 feat: add containerGroup for selective nested drag indicators (#77)
  • c57ab69 docs: add agent skill for skills.sh discovery (#75)
  • b66d8dd chore(main): release sveltednd 0.7.0 (#73)
  • bad94f8 feat(demo): rich SEO with THISUX brand signals (#72)
  • d764ef0 chore(main): release sveltednd 0.6.1 (#71)
  • fff8bf2 fix(demo): show package version from package.json (#70)
  • 0ce143c chore(main): release sveltednd 0.6.0 (#69)
  • e75485c feat: add opt-in keyboard drag accessibility (#68)
  • 1f11f32 chore(main): release sveltednd 0.5.0 (#67)
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates dompurify from 3.3.2 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

  • Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
  • Added several smaller hardening and edge-case improvements, thanks @​leechristensen
  • Bumped several dependencies where possible

DOMPurify 3.4.14

  • Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
  • Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
  • Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
  • Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
  • Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
  • Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @types/dompurify from 3.0.5 to 3.2.0

Commits

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]
  • enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
  • fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
  • fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

  • fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

  • add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
  • added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
  • added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
  • added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
  • added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
  • added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
  • added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
  • added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
  • added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
  • added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
  • added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
  • added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
  • added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
  • referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

  • fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
  • fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
  • fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
  • fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
  • fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
  • enh(cmake) add block and endblock keywords [Anonymous Maarten][]
  • fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
  • fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
  • fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
  • enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
  • enh(css) add corner-shape properties [Hama Tanveer][]
  • enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
  • enh(dart) add highlighting for class and function names [guuido][]
  • enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
  • enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
  • enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
  • enh(gherkin) update keyword list [Hirse][]
  • enh(gherkin) variables can't contain whitespace [Hirse][]
  • enh(gherkin) docstrings can use backticks [Hirse][]
  • enh(go) recognize binary integer literals [spokodev][]
  • enh(groovy) support underscores in numeric literals [greymoth][]
  • fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
  • fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
  • enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
  • enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits
  • f7f7d38 (release) release v11.12.0
  • c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
  • 9142292 bump version to 11.12.0
  • 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
  • ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
  • 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
  • 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
  • 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
  • 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
  • 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.


Updates marked-highlight from 2.2.3 to 2.2.4

Release notes

Sourced from marked-highlight's releases.

v2.2.4

2.2.4 (2026-04-07)

Bug Fixes

Commits
  • cf57ad7 chore(release): 2.2.4 [skip ci]
  • 0b2e4cd fix: allow marked v18 (#577)
  • c8f42ff Merge pull request #576 from markedjs/dependabot/npm_and_yarn/eslint-10.2.0
  • 9930b3b Merge pull request #575 from markedjs/dependabot/npm_and_yarn/marked-17.0.6
  • 26f7a44 chore(deps-dev): Bump eslint from 10.1.0 to 10.2.0
  • abd5ba8 chore(deps-dev): Bump marked from 17.0.5 to 17.0.6
  • a0f87cb Merge pull request #574 from markedjs/dependabot/npm_and_yarn/rollup-4.60.1
  • 1dd94e2 chore(deps-dev): Bump rollup from 4.60.0 to 4.60.1
  • 62f12ab Merge pull request #573 from markedjs/dependabot/npm_and_yarn/rollup-4.60.0
  • 2e74cd8 chore(deps-dev): Bump rollup from 4.59.0 to 4.60.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for marked-highlight since your current version.


Updates svelte-dnd-action from 0.9.68 to 0.9.79

Changelog

Sourced from svelte-dnd-action's changelog.

0.9.79

Bugfix: keep drop-position detection accurate while list items are moving with Svelte's animate:flip, preventing the shadow element from becoming stuck at a previously visited position. Fixes #706.

0.9.78

Feature: add global setKeyboardDragTrigger configuration for choosing whether Space, Enter or either key starts and stops keyboard dragging.

  • Leave the unselected key completely untouched so applications can use it for actions such as opening or editing the focused item.
  • Apply the setting consistently to every dndzone and drag handle, including changes made after zones have rendered.
  • Keep the built-in screen-reader instruction synchronized and support trigger-aware translated instructions.

0.9.77

Feature: add setAriaStrings for localizing the built-in screen-reader instructions and keyboard-drag announcements.

  • Override any subset of messages with formatter functions that receive item, zone, position and count context.
  • Update the document-wide locale at runtime while keeping English defaults for omitted messages.
  • Preserve the library's existing ARIA roles and behavior without enabling autoAriaDisabled.

0.9.76

Bugfix: include the originating drop-zone label in keyboard drag announcements so screen-reader users hear the list name from drag start and while reordering within the list.

0.9.75

Bugfix: keep an active keyboard drag synchronized when a consumer re-render moves or removes the grabbed item.

  • Follow an item moved between same-type zones without losing focus or cross-zone keyboard navigation.
  • End the drag safely if the item disappears instead of moving an unrelated item from a stale origin.
  • Keep zones of other types isolated even when they use the same item id.

0.9.74

Bugfix: prevent nested dragHandleZone teardown during an active drag from broadcasting a stale update that can hide a real item as the shadow element.

0.9.73

Bugfix: preserve the cursor's relative grab point when a dragged element morphs again before its previous size transition completes. Size and position transitions are also synchronized when the first morph happens before delayed transition setup.

0.9.72

Bugfixes: harden drag lifecycle cleanup against timing-sensitive updates and teardown.

  • Keep pointer observation tied to the exact zones being watched, including when zone types change during an animated drop.
  • Cancel pending pointer and delayed-touch gestures when their owning zone is destroyed, and serialize simultaneous touch starts.
  • Prevent stale animation frames from reattaching zones after drop cleanup has destroyed them.
  • Make keyboard drop handling safe when event handlers synchronously destroy the focused zone.
  • Destroy the wrapped dndzone when a dragHandleZone action is destroyed.

... (truncated)

Commits

Updates tailwind-merge from 3.4.0 to 3.7.0

Release notes

Sourced from tailwind-merge's releases.

tailwind-merge@3.7.0

New Features

  • Prepare some upcoming changes by @​dcastil in dcastil/tailwind-merge#713
    • Theme getters returned by fromTheme now expose the theme key they read as a themeKey property, so tooling can identify the referenced theme scale without calling the getter.
    • Release tags now include the package name, starting with tailwind-merge@3.7.0.

Bug Fixes

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 23, 2026
@dependabot
Bump the npm-minor-and-patch group across 1 directory with 23 updates
648da77 
Bumps the npm-minor-and-patch group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@tailwindcss/typography](https://github.com/tailwindlabs/tailwindcss-typography) | `0.5.19` | `0.5.20` |
| [@tauri-apps/plugin-deep-link](https://github.com/tauri-apps/plugins-workspace) | `2.4.7` | `2.4.10` |
| [@tauri-apps/plugin-dialog](https://github.com/tauri-apps/plugins-workspace) | `2.6.0` | `2.7.3` |
| [@tauri-apps/plugin-fs](https://github.com/tauri-apps/plugins-workspace) | `2.4.5` | `2.5.2` |
| [@tauri-apps/plugin-opener](https://github.com/tauri-apps/plugins-workspace) | `2.5.3` | `2.5.5` |
| [@tauri-apps/plugin-updater](https://github.com/tauri-apps/plugins-workspace) | `2.10.0` | `2.12.0` |
| [@thisux/sveltednd](https://github.com/thisuxhq/sveltednd) | `0.0.20` | `0.8.0` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.2` | `3.4.15` |
| [@types/dompurify](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/dompurify) | `3.0.5` | `3.2.0` |
| [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.12.0` |
| [marked-highlight](https://github.com/markedjs/marked-highlight) | `2.2.3` | `2.2.4` |
| [svelte-dnd-action](https://github.com/isaacHagoel/svelte-dnd-action) | `0.9.68` | `0.9.79` |
| [tailwind-merge](https://github.com/dcastil/tailwind-merge/tree/HEAD/packages/tailwind-merge) | `3.4.0` | `3.7.0` |
| [@tailwindcss/postcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-postcss) | `4.1.17` | `4.3.3` |
| [@tauri-apps/api](https://github.com/tauri-apps/tauri) | `2.10.1` | `2.11.1` |
| [@tauri-apps/cli](https://github.com/tauri-apps/tauri) | `2.10.0` | `2.11.5` |
| [@testing-library/svelte](https://github.com/testing-library/svelte-testing-library/tree/HEAD/packages/svelte) | `5.3.1` | `5.4.2` |
| [@testing-library/user-event](https://github.com/testing-library/user-event) | `14.6.1` | `14.6.7` |
| [autoprefixer](https://github.com/postcss/autoprefixer) | `10.4.22` | `10.6.1` |
| [happy-dom](https://github.com/capricorn86/happy-dom) | `20.1.0` | `20.14.5` |
| [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.28` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.45.6` | `5.57.1` |
| [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.1.17` | `4.3.3` |



Updates `@tailwindcss/typography` from 0.5.19 to 0.5.20
- [Release notes](https://github.com/tailwindlabs/tailwindcss-typography/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss-typography/blob/main/CHANGELOG.md)
- [Commits](tailwindlabs/tailwindcss-typography@v0.5.19...v0.5.20)

Updates `@tauri-apps/plugin-deep-link` from 2.4.7 to 2.4.10
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@deep-link-v2.4.7...deep-link-v2.4.10)

Updates `@tauri-apps/plugin-dialog` from 2.6.0 to 2.7.3
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@log-v2.6.0...dialog-v2.7.3)

Updates `@tauri-apps/plugin-fs` from 2.4.5 to 2.5.2
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@fs-v2.4.5...fs-v2.5.2)

Updates `@tauri-apps/plugin-opener` from 2.5.3 to 2.5.5
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@http-v2.5.3...http-v2.5.5)

Updates `@tauri-apps/plugin-updater` from 2.10.0 to 2.12.0
- [Release notes](https://github.com/tauri-apps/plugins-workspace/releases)
- [Commits](tauri-apps/plugins-workspace@updater-v2.10.0...updater-v2.12.0)

Updates `@thisux/sveltednd` from 0.0.20 to 0.8.0
- [Release notes](https://github.com/thisuxhq/sveltednd/releases)
- [Changelog](https://github.com/thisuxhq/sveltednd/blob/main/CHANGELOG.md)
- [Commits](thisuxhq/sveltednd@v0.0.20...sveltednd-v0.8.0)

Updates `dompurify` from 3.3.2 to 3.4.15
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.3.2...3.4.15)

Updates `@types/dompurify` from 3.0.5 to 3.2.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/dompurify)

Updates `highlight.js` from 11.11.1 to 11.12.0
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md)
- [Commits](highlightjs/highlight.js@11.11.1...11.12.0)

Updates `marked-highlight` from 2.2.3 to 2.2.4
- [Release notes](https://github.com/markedjs/marked-highlight/releases)
- [Changelog](https://github.com/markedjs/marked-highlight/blob/main/release.config.cjs)
- [Commits](markedjs/marked-highlight@v2.2.3...v2.2.4)

Updates `svelte-dnd-action` from 0.9.68 to 0.9.79
- [Changelog](https://github.com/isaacHagoel/svelte-dnd-action/blob/master/release-notes.md)
- [Commits](https://github.com/isaacHagoel/svelte-dnd-action/commits)

Updates `tailwind-merge` from 3.4.0 to 3.7.0
- [Release notes](https://github.com/dcastil/tailwind-merge/releases)
- [Commits](https://github.com/dcastil/tailwind-merge/commits/tailwind-merge@3.7.0/packages/tailwind-merge)

Updates `@tailwindcss/postcss` from 4.1.17 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/@tailwindcss-postcss)

Updates `@tauri-apps/api` from 2.10.1 to 2.11.1
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/api-v2.10.1...@tauri-apps/api-v2.11.1)

Updates `@tauri-apps/cli` from 2.10.0 to 2.11.5
- [Release notes](https://github.com/tauri-apps/tauri/releases)
- [Commits](https://github.com/tauri-apps/tauri/compare/@tauri-apps/cli-v2.10.0...@tauri-apps/cli-v2.11.5)

Updates `@testing-library/svelte` from 5.3.1 to 5.4.2
- [Release notes](https://github.com/testing-library/svelte-testing-library/releases)
- [Changelog](https://github.com/testing-library/svelte-testing-library/blob/main/CHANGELOG.md)
- [Commits](https://github.com/testing-library/svelte-testing-library/commits/@testing-library/svelte@5.4.2/packages/svelte)

Updates `@testing-library/user-event` from 14.6.1 to 14.6.7
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.1...v14.6.7)

Updates `autoprefixer` from 10.4.22 to 10.6.1
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@10.4.22...10.6.1)

Updates `happy-dom` from 20.1.0 to 20.14.5
- [Release notes](https://github.com/capricorn86/happy-dom/releases)
- [Commits](capricorn86/happy-dom@v20.1.0...v20.14.5)

Updates `postcss` from 8.5.6 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.6...8.5.28)

Updates `svelte` from 5.45.6 to 5.57.1
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.1/packages/svelte)

Updates `tailwindcss` from 4.1.17 to 4.3.3
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.3/packages/tailwindcss)

---
updated-dependencies:
- dependency-name: "@tailwindcss/postcss"
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tailwindcss/typography"
  dependency-version: 0.5.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/api"
  dependency-version: 2.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/cli"
  dependency-version: 2.11.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-deep-link"
  dependency-version: 2.4.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-dialog"
  dependency-version: 2.7.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-fs"
  dependency-version: 2.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-opener"
  dependency-version: 2.5.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@tauri-apps/plugin-updater"
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@testing-library/svelte"
  dependency-version: 5.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: "@thisux/sveltednd"
  dependency-version: 0.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: "@types/dompurify"
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: autoprefixer
  dependency-version: 10.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: happy-dom
  dependency-version: 20.14.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: highlight.js
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: marked-highlight
  dependency-version: 2.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: svelte
  dependency-version: 5.57.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: svelte-dnd-action
  dependency-version: 0.9.79
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title build(deps): bump the npm-minor-and-patch group with 23 updates Bump the npm-minor-and-patch group across 1 directory with 23 updates Sep 24, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/develop/npm-minor-and-patch-d104bc328c branch from e2666c1 to 648da77 Compare September 24, 2026 19:31
EarMaster added a commit that referenced this pull request Sep 24, 2026
@EarMaster @claude
Skip CodeQL's rust analysis on pull requests that touch no Rust
46c2650 
The rust leg is the whole length of codeql.yml - six to eight minutes, against
about one each for actions and javascript-typescript - and almost none of it
is this repository's code. The extractor spends it resolving the 799 crates in
Cargo.lock, and the queries spend it on one shared pass over the database that
builds, which is why all 37 finish within seconds of each other. Caching the
cargo registry was measured and saved nothing, so the remaining lever is not
running it when it cannot find anything new.

A small job now asks the pull request's file list whether anything under
src-tauri/, or this workflow itself, changed. When nothing did, the rust leg
still runs as a job but skips its steps and says so in its summary, so the
check reads as skipped rather than disappearing. Every doubt resolves to
analysing: a failed lookup, an empty list, or a list at the endpoint's
3000-file cap. The weekly schedule and a manual dispatch always analyse
everything, which keeps the Security tab's baseline for main complete.

Checked the lookup against real pull requests: #16 and #18 (npm only) skip,
#19 and #21 (cargo) analyse, #23 (develop) analyses, a missing PR analyses,
and a scheduled run analyses.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@EarMaster

EarMaster commented Sep 24, 2026

Copy link
Copy Markdown
Owner

Closing: scheduled npm/cargo version updates are being turned off. Dependencies are now refreshed by hand before each release, and security alerts stay on.

@EarMaster EarMaster closed this Sep 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 24, 2026

Copy link
Copy Markdown
Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@EarMaster
EarMaster deleted the dependabot/npm_and_yarn/develop/npm-minor-and-patch-d104bc328c branch September 24, 2026 22:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@EarMaster