Skip to content

chore(deps-dev): bump the minor-and-patch group across 1 directory with 24 updates - #192

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-8647b1851f
Open

chore(deps-dev): bump the minor-and-patch group across 1 directory with 24 updates#192
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-8647b1851f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 24 updates in the / directory:

Package From To
@microsoft/api-extractor 7.59.4 7.60.1
rollup 4.65.1 4.67.5
astro 7.4.2 7.4.7
@astrojs/node 11.1.9 11.1.11
fake-indexeddb 6.2.6 6.2.7
elysia 1.4.30 1.4.31
fastify 5.12.7 5.12.8
@hapi/hapi 21.4.11 21.4.13
hono 4.13.14 4.13.16
playwright 1.64.1 1.65.0
vite 8.3.5 8.3.6
vue 3.5.44 3.5.45
koa 3.2.1 3.3.0
@nestjs/common 12.3.1 12.3.3
@nestjs/core 12.3.1 12.3.3
@nestjs/platform-express 12.3.1 12.4.0
@nestjs/platform-fastify 12.3.1 12.4.0
next 15.5.28 15.5.29
nitropack 2.13.5 2.13.6
nuxt 4.6.2 4.6.4
preact 11.1.0 11.2.0
svelte 5.57.2 5.57.3
@sveltejs/kit 3.1.0 3.1.1
@sveltejs/adapter-node 6.0.0 6.0.1

Updates @microsoft/api-extractor from 7.59.4 to 7.60.1

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.60.1

Fri, 30 Oct 2026 21:34:20 GMT

Version update only

7.60.0

Tue, 27 Oct 2026 00:20:25 GMT

Minor changes

  • Upgrade the bundled compiler engine to TypeScript 6.0.3
Commits

Updates rollup from 4.65.1 to 4.67.5

Release notes

Sourced from rollup's releases.

v4.67.5

4.67.5

2026-11-04

Bug Fixes

  • Do not ignore output.sourcemapFile when the output.file option is not used (#6623)
  • Change chunk hash when debug IDs are enabled/disabled (#6625)
  • Avoid an unnecessary optional dependency on Linux system (#6627)

Pull Requests

v4.67.4

4.67.4

2026-11-01

Bug Fixes

  • Make rollup work again on older Xeon processors (#6622)

Pull Requests

v4.67.3

4.67.3

2026-10-31

Bug Fixes

  • Ensure line breaks in module ids are handled correctly in imports (#6620)

Pull Requests

v4.67.2

4.67.2

2026-10-30

Features

... (truncated)

Changelog

Sourced from rollup's changelog.

4.67.5

2026-11-04

Bug Fixes

  • Do not ignore output.sourcemapFile when the output.file option is not used (#6623)
  • Change chunk hash when debug IDs are enabled/disabled (#6625)
  • Avoid an unnecessary optional dependency on Linux system (#6627)

Pull Requests

4.67.4

2026-11-01

Bug Fixes

  • Make rollup work again on older Xeon processors (#6622)

Pull Requests

4.67.3

2026-10-31

Bug Fixes

  • Ensure line breaks in module ids are handled correctly in imports (#6620)

Pull Requests

4.67.2

2026-10-30

Features

  • Support X64 Android (#6603)

Pull Requests

... (truncated)

Commits

Updates astro from 7.4.2 to 7.4.7

Release notes

Sourced from astro's releases.

astro@7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

astro@7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

astro@7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

astro@7.4.4

Patch Changes

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.7

Patch Changes

  • 7da442b Thanks @​matthewp! - Fixes the image endpoint treating directories whose names differ only by letter case as being inside the build output directory on case-sensitive filesystems
  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1
    • @​astrojs/markdown-satteri@​0.4.7

7.4.6

Patch Changes

  • #18565 cd09986 Thanks @​praveen-kumary! - Avoids attributing client-only components or scripts to unrelated pages importing astro:i18n by bounding top-level page graph traversal at virtual page entries

  • #18608 babd96d Thanks @​umeraamir69! - Fixes an extra page reload on the first page load after starting astro dev without an existing .astro directory

  • #18589 402c0fa Thanks @​astro-factory! - Fixes astro check exiting with code 0 when @astrojs/check or typescript is not installed. The command now exits with code 1 so CI fails instead of silently skipping type checking.

  • #18503 54fcdd5 Thanks @​SwastikTripathi! - Preserves the last-modified date of cached font files and unchanged public files when copying them into the build output. Public-file timestamp preservation respects the resolved public-directory configuration, follows source symlinks, and avoids backdating files overwritten by build plugins.

  • #18605 76cd239 Thanks @​astro-factory! - Fixes the glob() loader adding files from a folder excluded with a negation pattern such as !_docs when they change during astro dev

  • #18432 ed60d82 Thanks @​alexmv! - Improves the MissingSharp error to include the reason Sharp failed to load, such as its prebuilt binaries not supporting the current CPU

  • #18474 59543c3 Thanks @​miottid! - Fixes i18n fallback for on-demand rendered pages. A locale-prefixed request for a page that only exists in the fallback locale (for example /de/about with fallback: { de: 'en' }) was answered with status 302 and no Location header. Such requests are now rewritten or redirected to the fallback locale according to i18n.routing.fallbackType, including encoded paths and sites with a configured base. Query strings are preserved, and explicit page statuses and redirects are left unchanged.

  • #18541 cfa2d2b Thanks @​ump45nose! - Fixes matchAllRoutes to consider fallbackRoutes, matching matchRoute and the production router. Dev-server i18n fallback requests now resolve to the source route's metadata instead of the 404 route, and SSR-only fallback candidates can fall through the prerender handler.

  • #18602 d856064 Thanks @​astro-factory! - Fixes astro check losing the end of its output, including the Result summary, when stdout is piped to a slow reader. When the reader closes the pipe early, for example astro check | head, astro check now exits with code 1 instead of crashing with an EPIPE stack trace.

  • #18574 da0f149 Thanks @​astro-factory! - Fixes an unnecessary full page reload in astro dev when a content loader calls store.clear() or store.delete() and the content store has no asset imports

  • #18570 e71c038 Thanks @​astro-factory! - Fixes pages using <ClientRouter /> briefly showing the top of the page on reload before jumping back to the previous scroll position. Full reloads now use the browser's native scroll restoration.

  • #18531 f75553b Thanks @​praveen-kumary! - Fixes an unhandled TypeError: Cannot convert undefined or null to object when calling route.generate() without arguments on static routes

7.4.5

Patch Changes

  • #18558 fac3c50 Thanks @​astro-factory! - Fixes astro dev status and other background server commands deleting the lock file of a running dev or preview server when run from a sandbox or as another user that is not permitted to signal its process

  • #18559 10dae2f Thanks @​astro-factory! - Fixes import.meta.env values containing $ sequences (such as $$ or $&) being corrupted in astro build when server code reads the import.meta.env object directly, for example with const { MY_SECRET } = import.meta.env

  • #18544 e3bec3d Thanks @​skezo! - Fixes request paths with invalid percent-encoding (e.g. /%C0%AF or a bare %) being logged as an Invalid URL encoding error and routed with the undecoded path. These requests now return a 400, the same as a path that is encoded too many times.

  • #18520 e023aba Thanks @​matthewp! - Makes rendering of string tag names stricter and consistent across .astro dynamic tags, JSX, and MDX. Only the leading part of the string that is a valid element name is rendered, so characters such as / or = can no longer change the generated markup. A string that does not start with a valid element name (for example '!--' or '') now throws an error instead of producing invalid HTML.

7.4.4

... (truncated)

Commits
  • cd30ae2 [ci] release (#18637)
  • 7a1255f [ci] release (#18582)
  • 78eddf9 Update dependency p-queue to v10 (#18619)
  • ff1e2fb Update dependency undici to v8 [SECURITY] (#18519)
  • babd96d fix(astro): skip data-store full-reload when no clients are connected (#18608)
  • b64567f Update all non-major dependencies (#18615)
  • cfa2d2b fix(routing): consider fallbackRoutes in matchAllRoutes (#18541)
  • f75553b fix(routing): avoid TypeError when calling route generator without arguments ...
  • 59543c3 Fix i18n fallback for on-demand pages reached through a fallback route (#18474)
  • e71c038 ClientRouter no longer flashes the top of the page on full reload when scroll...
  • Additional commits viewable in compare view

Updates @astrojs/node from 11.1.9 to 11.1.11

Release notes

Sourced from @​astrojs/node's releases.

@​astrojs/node@​11.1.11

Patch Changes

  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1

@​astrojs/node@​11.1.10

Patch Changes

@​astrojs/node@​11.1.10-beta.0

Patch Changes

  • Updated dependencies [db62f3b]:
    • astro@7.4.4-beta.0
Changelog

Sourced from @​astrojs/node's changelog.

11.1.11

Patch Changes

  • Updated dependencies [7da442b]:
    • @​astrojs/internal-helpers@​0.13.1

11.1.10

Patch Changes

Commits

Updates fake-indexeddb from 6.2.6 to 6.2.7

Release notes

Sourced from fake-indexeddb's releases.

v6.2.7

  • Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)
Changelog

Sourced from fake-indexeddb's changelog.

6.2.7 (2026-10-29)

  • Improve performance of put and delete for object stores with indexes (#172 by @​jameskfry)
Commits
  • 09e7f76 6.2.7
  • e1b6b48 Changelog
  • f7cf6d8 Merge pull request #172 from jameskfry/perf/delete-index-records
  • 0f4e496 Keep the single-key index path allocation-free
  • f0f8bc0 Delete index records by index key instead of scanning the whole index
  • 8881007 Update for 6.2.6 because the version script didn't automatically run for me s...
  • See full diff in compare view

Updates elysia from 1.4.30 to 1.4.31

Release notes

Sourced from elysia's releases.

1.4.31

What's new

Advisory:

GHSA-8v2r-hrw2-w54f: harden generated multipart request handling GHSA-wfrv-2qh2-qjg3: harden generated route compilation GHSA-952m-m7x7-mg46: harden generated schema compilation GHSA-g7gw-g6xr-hc3w: harden generated validation GHSA-7jpf-w5v7-43vw: harden generated request processing GHSA-49jc-gq6m-2p59: harden generated schema processing GHSA-8m2q-mx4w-gx5x: harden generated file validation GHSA-mmpg-3m88-65rj: harden generated handler compilation GHSA-mmpm-xfx6-v8p7: harden object construction and property assignment GHSA-8fvr-j2m8-w3g5: strengthen authorization handling GHSA-3xqr-x7wh-2j94: strengthen route authorization GHSA-wc83-j7p2-6rv9: preserve authorization across plugins GHSA-9rcf-wx52-g3qx: strengthen signed-cookie decoding GHSA-3mvx-9fjx-ggrv: strengthen signed-cookie decoding GHSA-ghvf-2m42-wm6j: strengthen signed-cookie verification GHSA-878j-w97q-ggw5: harden incoming WebSocket validation GHSA-7f78-4837-6rc4: harden outgoing WebSocket validation GHSA-99h3-78f3-ggfr: bound validation-error handling GHSA-hrhv-3p8p-5744: bound multipart array parsing GHSA-h497-rjj5-w9xr: bound multipart array parsing GHSA-xj99-v483-474c: bound multipart array parsing GHSA-6wqq-f7gp-pcm7: bound multipart parsing work GHSA-pxh4-839p-c8c8: harden encoded path routing GHSA-297c-f888-3xh9: harden streamed response framing GHSA-2458-2qvh-2p36: harden streamed response framing GHSA-w2mg-29g9-g8pq: harden default-value application GHSA-jvp4-v264-6m79: bound stream fan-out GHSA-29vh-32ww-hrmg: restrict published package contents

Full Changelog: elysiajs/elysia@1.4.30...1.4.31

Changelog

Sourced from elysia's changelog.

1.4.31 - 5 Nov 2026

Advisory:

  • GHSA-8v2r-hrw2-w54f: harden generated multipart request handling
  • GHSA-wfrv-2qh2-qjg3: harden generated route compilation
  • GHSA-952m-m7x7-mg46: harden generated schema compilation
  • GHSA-g7gw-g6xr-hc3w: harden generated validation
  • GHSA-7jpf-w5v7-43vw: harden generated request processing
  • GHSA-49jc-gq6m-2p59: harden generated schema processing
  • GHSA-8m2q-mx4w-gx5x: harden generated file validation
  • GHSA-mmpg-3m88-65rj: harden generated handler compilation
  • GHSA-mmpm-xfx6-v8p7: harden object construction and property assignment
  • GHSA-8fvr-j2m8-w3g5: strengthen authorization handling
  • GHSA-3xqr-x7wh-2j94: strengthen route authorization
  • GHSA-wc83-j7p2-6rv9: preserve authorization across plugins
  • GHSA-9rcf-wx52-g3qx: strengthen signed-cookie decoding
  • GHSA-3mvx-9fjx-ggrv: strengthen signed-cookie decoding
  • GHSA-ghvf-2m42-wm6j: strengthen signed-cookie verification
  • GHSA-878j-w97q-ggw5: harden incoming WebSocket validation
  • GHSA-7f78-4837-6rc4: harden outgoing WebSocket validation
  • GHSA-99h3-78f3-ggfr: bound validation-error handling
  • GHSA-hrhv-3p8p-5744: bound multipart array parsing
  • GHSA-h497-rjj5-w9xr: bound multipart array parsing
  • GHSA-xj99-v483-474c: bound multipart array parsing
  • GHSA-6wqq-f7gp-pcm7: bound multipart parsing work
  • GHSA-pxh4-839p-c8c8: harden encoded path routing
  • GHSA-297c-f888-3xh9: harden streamed response framing
  • GHSA-2458-2qvh-2p36: harden streamed response framing
  • GHSA-w2mg-29g9-g8pq: harden default-value application
  • GHSA-jvp4-v264-6m79: bound stream fan-out
  • GHSA-29vh-32ww-hrmg: restrict published package contents
Commits

Updates fastify from 5.12.7 to 5.12.8

Release notes

Sourced from fastify's releases.

v5.12.8

⚠️ Security Release

What's Changed

Full Changelog: fastify/fastify@v5.12.7...v5.12.8

Commits
  • 0c7413a Bumped v5.12.8
  • 0ffe18f test: make handlerTimeout ended-but-not-finished test deterministic
  • 8e7c2b7 test: restore 100% coverage for handlerTimeout abort paths
  • 15fbadf [Backport 5.x] fix: abort streaming response when handlerTimeout fires after ...
  • 18a7049 docs: fix syntax errors in code examples (#7159)
  • c410867 docs: clarify that maxParamLength does not prevent ReDoS (#7140)
  • 0fa6bc2 [Backport 5.x] fix(decorators): evaluate instance getters once in getDecorato...
  • 0873d55 perf(request): hoist port regex to module level (#7110)
  • 25cd11e [Backport 5.x] docs: remove plugins that do not support Fastify v5 (#7152)
  • d60a57b [Backport 5.x] docs(reply): reorganize Reply reference by properties and meth...
  • Additional commits viewable in compare view

Updates @hapi/hapi from 21.4.11 to 21.4.13

Commits

Updates hono from 4.13.14 to 4.13.16

Release notes

Sourced from hono's releases.

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

What's Changed

  • fix(jwt): reject a signature segment outside the base64url alphabet and a header with crit in honojs/hono#5597

Full Changelog: honojs/hono@v4.13.15...v4.13.16

v4.13.15

What's Changed

Full Changelog: honojs/hono@v4.13.14...v4.13.15

Commits
  • c91b60a 4.13.16
  • e1dd588 fix(jwt): reject a signature segment outside the base64url alphabet and a hea...
  • bf16471 Merge commit from fork
  • d88fab3 Merge commit from fork
  • 34f9043 Merge commit from fork
  • 8a103aa Merge commit from fork
  • 15bbd96 Merge commit from fork
  • 3cb29de 4.13.15
  • 17ad0e2 fix(context): allow c.header() after the response body is consumed (#5587)
  • ee88684 docs(contributing): drop the note about linking a fork branch (#5593)
  • Additional commits viewable in compare view

Updates playwright from 1.64.1 to 1.65.0

Release notes

Sourced from playwright's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

  • There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
  • Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
  • Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
  • Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

  • New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

    test('restart the server', { lock: '-exclusive-' }, async () => {
  // No other test runs while this one is running.
});

  • test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

    test('upload a file', async ({ page }) => {
  test.skip('Not implemented yet');
});

... (truncated)

Commits
  • a1f35e1 chore: mark v1.65.0 (#43925)
  • a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
  • 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
  • daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
  • 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
  • 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
  • 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
  • d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
  • 6e3f5ff docs: release notes for v1.65 (#43874)
  • aa33d27 fix(chromium): honor Linux config directories for channel connection...

    Description has been truncated

@dependabot
chore(deps-dev): bump the minor-and-patch group across 1 directory wi…
7b35844 
…th 24 updates

Bumps the minor-and-patch group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@microsoft/api-extractor](https://github.com/microsoft/rushstack/tree/HEAD/apps/api-extractor) | `7.59.4` | `7.60.1` |
| [rollup](https://github.com/rollup/rollup) | `4.65.1` | `4.67.5` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.4.2` | `7.4.7` |
| [@astrojs/node](https://github.com/withastro/astro/tree/HEAD/packages/integrations/node) | `11.1.9` | `11.1.11` |
| [fake-indexeddb](https://github.com/dumbmatter/fakeIndexedDB) | `6.2.6` | `6.2.7` |
| [elysia](https://github.com/elysiajs/elysia) | `1.4.30` | `1.4.31` |
| [fastify](https://github.com/fastify/fastify) | `5.12.7` | `5.12.8` |
| [@hapi/hapi](https://github.com/hapijs/hapi) | `21.4.11` | `21.4.13` |
| [hono](https://github.com/honojs/hono) | `4.13.14` | `4.13.16` |
| [playwright](https://github.com/microsoft/playwright) | `1.64.1` | `1.65.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` |
| [vue](https://github.com/vuejs/core) | `3.5.44` | `3.5.45` |
| [koa](https://github.com/koajs/koa) | `3.2.1` | `3.3.0` |
| [@nestjs/common](https://github.com/nestjs/nest/tree/HEAD/packages/common) | `12.3.1` | `12.3.3` |
| [@nestjs/core](https://github.com/nestjs/nest/tree/HEAD/packages/core) | `12.3.1` | `12.3.3` |
| [@nestjs/platform-express](https://github.com/nestjs/nest/tree/HEAD/packages/platform-express) | `12.3.1` | `12.4.0` |
| [@nestjs/platform-fastify](https://github.com/nestjs/nest/tree/HEAD/packages/platform-fastify) | `12.3.1` | `12.4.0` |
| [next](https://github.com/vercel/next.js) | `15.5.28` | `15.5.29` |
| [nitropack](https://github.com/nitrojs/nitro) | `2.13.5` | `2.13.6` |
| [nuxt](https://github.com/nuxt/nuxt/tree/HEAD/packages/nuxt) | `4.6.2` | `4.6.4` |
| [preact](https://github.com/preactjs/preact) | `11.1.0` | `11.2.0` |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.57.2` | `5.57.3` |
| [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `3.1.0` | `3.1.1` |
| [@sveltejs/adapter-node](https://github.com/sveltejs/kit/tree/HEAD/packages/adapter-node) | `6.0.0` | `6.0.1` |



Updates `@microsoft/api-extractor` from 7.59.4 to 7.60.1
- [Changelog](https://github.com/microsoft/rushstack/blob/main/apps/api-extractor/CHANGELOG.md)
- [Commits](https://github.com/microsoft/rushstack/commits/HEAD/apps/api-extractor)

Updates `rollup` from 4.65.1 to 4.67.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.65.1...v4.67.5)

Updates `astro` from 7.4.2 to 7.4.7
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.7/packages/astro)

Updates `@astrojs/node` from 11.1.9 to 11.1.11
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/node/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/node@11.1.11/packages/integrations/node)

Updates `fake-indexeddb` from 6.2.6 to 6.2.7
- [Release notes](https://github.com/dumbmatter/fakeIndexedDB/releases)
- [Changelog](https://github.com/dumbmatter/fakeIndexedDB/blob/master/CHANGELOG.md)
- [Commits](dumbmatter/fakeIndexedDB@v6.2.6...v6.2.7)

Updates `elysia` from 1.4.30 to 1.4.31
- [Release notes](https://github.com/elysiajs/elysia/releases)
- [Changelog](https://github.com/elysiajs/elysia/blob/main/CHANGELOG.md)
- [Commits](elysiajs/elysia@1.4.30...1.4.31)

Updates `fastify` from 5.12.7 to 5.12.8
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v5.12.7...v5.12.8)

Updates `@hapi/hapi` from 21.4.11 to 21.4.13
- [Release notes](https://github.com/hapijs/hapi/releases)
- [Commits](hapijs/hapi@v21.4.11...v21.4.13)

Updates `hono` from 4.13.14 to 4.13.16
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.14...v4.13.16)

Updates `playwright` from 1.64.1 to 1.65.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.1...v1.65.0)

Updates `vite` from 8.3.5 to 8.3.6
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite)

Updates `vue` from 3.5.44 to 3.5.45
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.44...v3.5.45)

Updates `koa` from 3.2.1 to 3.3.0
- [Release notes](https://github.com/koajs/koa/releases)
- [Changelog](https://github.com/koajs/koa/blob/master/History.md)
- [Commits](koajs/koa@v3.2.1...v3.3.0)

Updates `@nestjs/common` from 12.3.1 to 12.3.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/common)

Updates `@nestjs/core` from 12.3.1 to 12.3.3
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.3.3/packages/core)

Updates `@nestjs/platform-express` from 12.3.1 to 12.4.0
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.4.0/packages/platform-express)

Updates `@nestjs/platform-fastify` from 12.3.1 to 12.4.0
- [Release notes](https://github.com/nestjs/nest/releases)
- [Commits](https://github.com/nestjs/nest/commits/v12.4.0/packages/platform-fastify)

Updates `next` from 15.5.28 to 15.5.29
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v15.5.28...v15.5.29)

Updates `nitropack` from 2.13.5 to 2.13.6
- [Release notes](https://github.com/nitrojs/nitro/releases)
- [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts)
- [Commits](nitrojs/nitro@v2.13.5...v2.13.6)

Updates `nuxt` from 4.6.2 to 4.6.4
- [Release notes](https://github.com/nuxt/nuxt/releases)
- [Commits](https://github.com/nuxt/nuxt/commits/v4.6.4/packages/nuxt)

Updates `preact` from 11.1.0 to 11.2.0
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](preactjs/preact@11.1.0...11.2.0)

Updates `svelte` from 5.57.2 to 5.57.3
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.3/packages/svelte)

Updates `@sveltejs/kit` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@3.1.1/packages/kit)

Updates `@sveltejs/adapter-node` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/sveltejs/kit/releases)
- [Changelog](https://github.com/sveltejs/kit/blob/main/packages/adapter-node/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/adapter-node@6.0.1/packages/adapter-node)

---
updated-dependencies:
- dependency-name: "@microsoft/api-extractor"
  dependency-version: 7.60.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: rollup
  dependency-version: 4.67.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: astro
  dependency-version: 7.4.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@astrojs/node"
  dependency-version: 11.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fake-indexeddb
  dependency-version: 6.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: elysia
  dependency-version: 1.4.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: fastify
  dependency-version: 5.12.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@hapi/hapi"
  dependency-version: 21.4.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: hono
  dependency-version: 4.13.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.65.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: vite
  dependency-version: 8.3.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: vue
  dependency-version: 3.5.45
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: koa
  dependency-version: 3.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@nestjs/common"
  dependency-version: 12.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@nestjs/core"
  dependency-version: 12.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@nestjs/platform-express"
  dependency-version: 12.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@nestjs/platform-fastify"
  dependency-version: 12.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: next
  dependency-version: 15.5.29
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: nitropack
  dependency-version: 2.13.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: nuxt
  dependency-version: 4.6.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: preact
  dependency-version: 11.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: svelte
  dependency-version: 5.57.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@sveltejs/kit"
  dependency-version: 3.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@sveltejs/adapter-node"
  dependency-version: 6.0.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 9, 2026
@coderabbitai

coderabbitai Bot commented Nov 9, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c0ebc0ed-c84f-4974-8e0a-1fe503da4f6d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants