Skip to content

chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates - #21024

Merged
objectstack-fleet[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-e1f7e5c775
Oct 1, 2026
Merged

chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates#21024
objectstack-fleet[bot] merged 2 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-e1f7e5c775

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 16 updates in the / directory:

Package From To
@changesets/cli 3.0.0 3.0.3
@types/node 26.2.0 26.6.3
@typescript-eslint/parser 8.67.0 8.70.1
eslint 10.8.1 10.11.0
svelte 5.56.9 5.57.1
turbo 2.10.10 2.11.5
@testing-library/react 16.3.2 16.3.3
jsdom 30.0.1 30.1.1
fast-check 4.9.0 4.10.2
mysql2 3.23.3 3.24.4
pg 8.22.0 8.23.0
ai 7.0.66 7.0.118
mongodb-memory-server 11.2.0 11.3.0
negotiator 1.0.0 1.1.0
postcss 8.5.26 8.5.28
@playwright/test 1.62.1 1.63.0

Updates @changesets/cli from 3.0.0 to 3.0.3

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1

@​changesets/cli@​3.0.2

Patch Changes

@​changesets/cli@​3.0.1

Patch Changes

Changelog

Sourced from @​changesets/cli's changelog.

3.0.3

Patch Changes

  • #2297 3f163da Thanks @​Andarist! - Fixed semver ranges (such as >=1.0.0 <2.0.0) getting cut off (>=2.0.0) when updating internal dependencies.

  • #2276 ca9d110 Thanks @​Andarist! - Fixed pnpm 10 compatibility with npm 12 when reading registry information, packing, and publishing packages.

  • Updated dependencies [3f163da, bfe9050, e522996]:

    • @​changesets/apply-release-plan@​8.1.1
    • @​changesets/config@​4.0.1

3.0.2

Patch Changes

3.0.1

Patch Changes

Commits

Updates @types/node from 26.2.0 to 26.6.3

Commits

Updates @typescript-eslint/parser from 8.67.0 to 8.70.1

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.1

8.70.1 (2026-09-21)

🩹 Fixes

  • ast-spec: narrow import attribute keys to identifiers and strings (#12879)
  • eslint-plugin: [no-useless-default-assignment] avoid false positives on tuples with a rest element (#12768)
  • eslint-plugin: [no-unnecessary-type-parameters] handle type precedence in the suggestion fixer (#12637)
  • eslint-plugin: [no-explicit-any] use unknown[] for bare any rest parameters (#12818)
  • eslint-plugin: [no-generated-empty-object-type] don't report a mapped type whose keys are not resolved yet (#12854)
  • eslint-plugin: [no-misused-spread] omit WeakMap spread suggestions (#12850)
  • eslint-plugin: [no-unnecessary-type-assertion] false positive for empty object asserted to a type alias of Record (#12869)
  • eslint-plugin: [no-meaningless-void-operator] allow void on assignment expressions (#12873)
  • eslint-plugin: [await-thenable] prevent autofix from breaking code when removing await (#12716)
  • eslint-plugin: [no-unnecessary-parameter-property-assignment] account for parameter reassignment (#12880)
  • eslint-plugin: [unbound-method] treat Intl.Collator.prototype.compare as spec-bound (#12845)
  • eslint-plugin: [no-unnecessary-condition] handle union-keyed index access on the left-hand side of nullish assignment (#12747)
  • eslint-plugin: [no-useless-default-assignment] convert the fixer to a suggestion fixer (#12826)
  • eslint-plugin: [no-misused-promises] handle multiple Promise constituents (#12904)
  • rule-tester: test the final autofix output instead of the first pass (#12867)
  • scope-manager: merge implicit global definitions (#12809)
  • type-utils: match package specifiers on whole path components (#12838)
  • typescript-estree: resolve symlinked paths when matching files to projects (#12725)
  • typescript-estree: add missing < token opening type arguments (#12821)
  • typescript-estree: require string literal import attribute values (#12894)
  • website: prevent playground from breaking down after opening link with the .js file type (#12777)

❤️ Thank You

See GitHub Releases for more information.

... (truncated)

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.1 (2026-09-21)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

Updates eslint from 10.8.1 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
  • 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
  • d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
  • b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
  • 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
  • 6c789ff docs: Update README (GitHub Actions Bot)
  • 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

  • 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
  • 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
  • ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
  • c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
  • f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
  • fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

  • 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
  • c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
  • 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

  • bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
  • 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
  • 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
  • 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
  • 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
  • 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

  • 2417cad docs: Update README (GitHub Actions Bot)
  • 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
  • 8724829 docs: update compat table links (#21263) (fnx)
  • 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

  • b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
  • 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits
  • 3c0b7c6 10.11.0
  • 321f0a7 Build: changelog update for 10.11.0
  • 520dd77 perf: Implement fast paths in critical areas (#21210)
  • 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
  • 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
  • 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
  • 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
  • 24310e3 chore: update ecosystem plugins (#21324)
  • d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
  • 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
  • Additional commits viewable in compare view

Updates svelte from 5.56.9 to 5.57.1

Release notes

Sourced from svelte's releases.

svelte@5.57.1

Patch Changes

  • fix: cancel deferred event listeners during cleanup (#18749)

  • fix: preserve global CSS in components without scopable elements (#18793)

  • fix: reduce SSR render result garbage collection (#18798)

  • fix: resolve the fallback of an each block in the enclosing scope (#18803)

  • perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

  • fix: prevent effect tree of batches from interfering with each other (#18508)

  • fix: serialize input default values during server rendering (#18733)

  • fix: remove WAS_MARKED flag in favor of Set (#18127)

  • fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

  • fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

  • fix: keep $state.eager when used as a variable initializer (#18809)

  • perf: avoid regex matching in parser where possible (#18736)

  • fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

  • fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

svelte@5.57.0

Minor Changes

  • feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

  • feat: add has function to createContext (#18472)

  • feat: support defaultValue on <select> (#18591)

  • feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

  • fix: block template store subscriptions on the promise that assigns the store (#18582)

  • fix: route $derived teardown errors through invoke_error_boundary (#18486)

  • fix: track SvelteDate snapshots in reactions (#18700)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.57.1

Patch Changes

  • fix: cancel deferred event listeners during cleanup (#18749)

  • fix: preserve global CSS in components without scopable elements (#18793)

  • fix: reduce SSR render result garbage collection (#18798)

  • fix: resolve the fallback of an each block in the enclosing scope (#18803)

  • perf: speed up parser interactions with Acorn or avoid them where possible (#18740)

  • fix: prevent effect tree of batches from interfering with each other (#18508)

  • fix: serialize input default values during server rendering (#18733)

  • fix: remove WAS_MARKED flag in favor of Set (#18127)

  • fix: throw set_context_after_init when setContext is called after an await during SSR (#18739)

  • fix: make Object.hasOwn reactive for state proxy ownership changes (#18838)

  • fix: keep $state.eager when used as a variable initializer (#18809)

  • perf: avoid regex matching in parser where possible (#18736)

  • fix: in non-async mode, only push variable to current_sources when active_reaction is updating (#18550)

  • fix: recognise aria-braillelabel and aria-brailleroledescription as known ARIA attributes (#18765)

5.57.0

Minor Changes

  • feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

  • feat: add has function to createContext (#18472)

  • feat: support defaultValue on <select> (#18591)

  • feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

  • fix: block template store subscriptions on the promise that assigns the store (#18582)

  • fix: route $derived teardown errors through invoke_error_boundary (#18486)

... (truncated)

Commits
  • 636eaaa Version Packages (#18750)
  • 8030ff2 fix: remove incorrect special handling of :export pseudo-selectors (#18839)
  • a72dc8e fix: make Object.hasOwn reactive for state proxies (#18838)
  • 6eb720a chore: scope.js stops importing from the analysis visitors (#18787)
  • e6ae460 chore: analysis and transform stop importing each other (#18786)
  • 5981c06 chore: move parser helpers next to their users (#18785)
  • f2ad10e fix: preserve global CSS without scopable elements (#18793)
  • a8a9b02 fix: reduce SSR render result garbage collection (#18798)
  • 6be176d fix: resolve the fallback of an each block in the enclosing scope (#18803)
  • 34b13ac fix: keep $state.eager when used as a variable initializer (#18809)
  • Additional commits viewable in compare view

Updates turbo from 2.10.10 to 2.11.5

Release notes

Sourced from turbo's releases.

Turborepo v2.11.5

What's Changed

Changelog

... (truncated)

Commits

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates jsdom from 30.0.1 to 30.1.1

Release notes

Sourced from jsdom's releases.

v30.1.1

  • Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
  • Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
  • Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
  • Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
  • Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
  • Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
  • Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
  • Fixed the storageQuota option being ignored by frames.
  • Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
  • Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
  • Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
  • Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
  • Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

v30.1.0

jsdom is feeling the AGI!

This release is dedicated to @​scttcper, who unleashed @​codex upon jsdom and found tons of performance improvements. Along the way, he found and fixed many correctness issues as well.

We really appreciate his thoughtful PRs, which did a great job following the project's contribution guidelines, and were clearly human-curated, with their PR descriptions edited to be brief and respectful of the maintainers' time.

Thanks to @​scttcper, as well as all the other contributors of this release (most of whom were AI-assisted).

  • Added named access to elements on document, such as document.myForm for <form name="myForm">. (@​vojtisprime11)
  • Added QuotaExceededError, including its use for storage quota errors and oversized crypto.getRandomValues() requests.
  • Added support for the relaxed DOM naming rules when creating elements, attributes, and document types.
  • Improved performance of DOM construction, tree mutations, range operations, and live collection access, especially on large documents. (@​scttcper, @​erezrokah)
  • Improved performance of getComputedStyle(), style changes, and CSS serialization. (@​scttcper, @​jhult)
  • Improved performance of event dispatch, form control and label lookups, and updates to <select> elements and radio button groups. (@​scttcper)
  • Reduced memory use when creating and working with DOM nodes, attributes, event listeners, and mutation observers. (@​scttcper)
  • Changed window.close() to preserve access to the document and its DOM through retained references.
  • Fixed element.querySelectorAll() returning no matches when the first part of the selector matches the element itself, which regressed in v30.0.0. (@​asamuzaK)
  • Fixed case sensitivity in CSS attribute selectors, including selectors matching data-state="", title="", and other case-sensitive values. (@​asamuzaK)
  • Fixed document.querySelector() failing to find a matching element when an earlier element has the same ID but does not match the rest of the selector. (@​vojtisprime11)
  • Fixed :focus matching in shadow trees. (@​asamuzaK)
  • Fixed DOM insertion and replacement, including valid document.replaceChildren() calls, invalid document element and doctype placements, and mutations during ele...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026
@github-actions github-actions Bot added size/m documentation Improvements or additions to documentation labels Oct 1, 2026
@github-actions

github-actions Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 99398542b328eb06be8dbd781200f06a5df608b0 → packageMentionDocs.

This was referenced Oct 1, 2026
Closed
Closed
@objectstack-fleet

objectstack-fleet Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Landing authorized by the maintainer; held until #21083 merges

Provenance:

  • Who: the maintainer.
  • Verbatim: 「按你的推荐:关掉21029立卡,better-auth先放着,21024授权你落地」
  • Where: PM seat session session_018gA1pE6eJtwHhqx72G8U9X, read 2026-10-01T06:04Z.

Review at head 622e60e91c

Landing plan

  1. fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j (critical) and dompurify GHSA-p98j-92pf-mc4p #21083 merges.
  2. This PR's lockfile is brought onto that main, so OSV re-scans the merged lockfile.
    • If the lockfile conflicts, Dependabot's own rebase regenerates it.
    • Otherwise an update-branch merge does it.
  3. When every check on that head is green or an expected skip, the seat arms auto-merge and the merge queue lands the PR.

Watch items (both measured green on this head):

  • @changesets/cli 3.0.3, which is release tooling.
  • turbo 2.11.5: Test Core's completeness and timing reporters parse its run summaries.

Generated by Claude Code

@objectstack-fleet objectstack-fleet Bot added the skip-changeset PR has no user-facing published change; bypasses the changeset gate label Oct 1, 2026
@objectstack-fleet

objectstack-fleet Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Correction to the review above: this lockfile also downgrades nodemailer

Read 2026-10-01T06:07Z. The review in the comment above missed one line of the lockfile diff.

Amended landing plan. Step 2 must leave nodemailer at 10.0.12 or later.

Generated by Claude Code

@dependabot
chore(deps)(deps-dev): bump the development-dependencies group across…
ab7aa3f 
… 1 directory with 16 updates

Bumps the development-dependencies group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@changesets/cli](https://github.com/changesets/changesets/tree/HEAD/packages/cli) | `3.0.0` | `3.0.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.3` |
| [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.70.1` |
| [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.11.0` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.56.9` | `5.57.1` |
| [turbo](https://github.com/vercel/turborepo) | `2.10.10` | `2.11.5` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [jsdom](https://github.com/jsdom/jsdom) | `30.0.1` | `30.1.1` |
| [fast-check](https://github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check) | `4.9.0` | `4.10.2` |
| [mysql2](https://github.com/sidorares/node-mysql2) | `3.23.3` | `3.24.4` |
| [pg](https://github.com/brianc/node-postgres/tree/HEAD/packages/pg) | `8.22.0` | `8.23.0` |
| [ai](https://github.com/vercel/ai/tree/HEAD/packages/ai) | `7.0.66` | `7.0.118` |
| [mongodb-memory-server](https://github.com/typegoose/mongodb-memory-server/tree/HEAD/packages/mongodb-memory-server) | `11.2.0` | `11.3.0` |
| [negotiator](https://github.com/jshttp/negotiator) | `1.0.0` | `1.1.0` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |



Updates `@changesets/cli` from 3.0.0 to 3.0.3
- [Release notes](https://github.com/changesets/changesets/releases)
- [Changelog](https://github.com/changesets/changesets/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/changesets/changesets/commits/@changesets/cli@3.0.3/packages/cli)

Updates `@types/node` from 26.2.0 to 26.6.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@typescript-eslint/parser` from 8.67.0 to 8.70.1
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser)

Updates `eslint` from 10.8.1 to 10.11.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.8.1...v10.11.0)

Updates `svelte` from 5.56.9 to 5.57.1
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.1/packages/svelte)

Updates `turbo` from 2.10.10 to 2.11.5
- [Release notes](https://github.com/vercel/turborepo/releases)
- [Changelog](https://github.com/vercel/turborepo/blob/main/RELEASE.md)
- [Commits](vercel/turborepo@v2.10.10...v2.11.5)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `jsdom` from 30.0.1 to 30.1.1
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Commits](jsdom/jsdom@v30.0.1...v30.1.1)

Updates `fast-check` from 4.9.0 to 4.10.2
- [Release notes](https://github.com/dubzzz/fast-check/releases)
- [Changelog](https://github.com/dubzzz/fast-check/blob/main/packages/fast-check/CHANGELOG.md)
- [Commits](https://github.com/dubzzz/fast-check/commits/v4.10.2/packages/fast-check)

Updates `mysql2` from 3.23.3 to 3.24.4
- [Release notes](https://github.com/sidorares/node-mysql2/releases)
- [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md)
- [Commits](sidorares/node-mysql2@v3.23.3...v3.24.4)

Updates `pg` from 8.22.0 to 8.23.0
- [Changelog](https://github.com/brianc/node-postgres/blob/master/CHANGELOG.md)
- [Commits](https://github.com/brianc/node-postgres/commits/pg@8.23.0/packages/pg)

Updates `ai` from 7.0.66 to 7.0.118
- [Release notes](https://github.com/vercel/ai/releases)
- [Changelog](https://github.com/vercel/ai/blob/main/packages/ai/CHANGELOG.md)
- [Commits](https://github.com/vercel/ai/commits/ai@7.0.118/packages/ai)

Updates `mongodb-memory-server` from 11.2.0 to 11.3.0
- [Release notes](https://github.com/typegoose/mongodb-memory-server/releases)
- [Changelog](https://github.com/typegoose/mongodb-memory-server/blob/master/CHANGELOG.md)
- [Commits](https://github.com/typegoose/mongodb-memory-server/commits/v11.3.0/packages/mongodb-memory-server)

Updates `negotiator` from 1.0.0 to 1.1.0
- [Release notes](https://github.com/jshttp/negotiator/releases)
- [Commits](jshttp/negotiator@v1.0.0...v1.1.0)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.26...8.5.28)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

---
updated-dependencies:
- dependency-name: "@changesets/cli"
  dependency-version: 3.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: "@typescript-eslint/parser"
  dependency-version: 8.70.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: ai
  dependency-version: 7.0.118
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: eslint
  dependency-version: 10.11.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: fast-check
  dependency-version: 4.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: jsdom
  dependency-version: 30.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: mongodb-memory-server
  dependency-version: 11.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: mysql2
  dependency-version: 3.24.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: negotiator
  dependency-version: 1.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: pg
  dependency-version: 8.23.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: svelte
  dependency-version: 5.57.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: turbo
  dependency-version: 2.11.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps)(deps-dev): bump the development-dependencies group with 16 updates chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates Oct 1, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-e1f7e5c775 branch from 622e60e to ab7aa3f Compare October 1, 2026 06:42
@objectstack-fleet objectstack-fleet Bot mentioned this pull request Oct 1, 2026
Closed
@objectstack-fleet

objectstack-fleet Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Rebased head still locks nodemailer 10.0.11; the re-lock is tracked on #21102

Read 2026-10-01T06:44Z.

Generated by Claude Code

@claude
chore(deps): restore nodemailer to 10.0.13 in lockfile
59ceaf8 
The Dependabot-regenerated lockfile resolved nodemailer 10.0.11, below the
10.0.12 on main, although no manifest asks for that. Re-resolve it with
pnpm 10.31.0 so it lands on the current 10.x release; manifests untouched.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VDtqoecgES7ScQYGbFVDRv
This was referenced Oct 1, 2026
Closed
Closed
@objectstack-fleet
objectstack-fleet Bot added this pull request to the merge queue Oct 1, 2026
@objectstack-fleet

objectstack-fleet Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Re-locked head verified; queued 2026-10-01T08:26Z

Generated by Claude Code

Merged via the queue into main with commit 840ec9d Oct 1, 2026
39 checks passed
@objectstack-fleet
objectstack-fleet Bot deleted the dependabot/npm_and_yarn/development-dependencies-e1f7e5c775 branch October 1, 2026 08:59
This was referenced Oct 1, 2026
Closed
Closed
Closed
Merged
@github-actions github-actions Bot mentioned this pull request Oct 2, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation javascript Pull requests that update javascript code size/m skip-changeset PR has no user-facing published change; bypasses the changeset gate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claude