chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #72 · iberi22/synapse-protocol

dependabot · 2025-12-10T21:20:37Z

Bumps the npm_and_yarn group with 1 update in the /apps/desktop directory: @sveltejs/kit.

Updates @sveltejs/kit from 1.30.4 to 2.20.6

Changelog

Sourced from @sveltejs/kit's changelog.

2.20.6

Patch Changes

fix: escape names of tracked search parameters (d3300c6a67908590266c363dba7b0835d9a194cf)

2.20.5

Patch Changes

allow HandleServerError hook to access getRequestEvent (#13666)

fix: prevent Rollup warnings for undefined hooks (#13687)

2.20.4

Patch Changes

chore: remove internal class-replacement hack that isn't needed anymore (#13664)

2.20.3

Patch Changes

fix: only call afterNavigate once on app start when SSR is disabled (#13593)

2.20.2

Patch Changes

fix: allow non-prerendered API endpoint calls during reroute when prerendering (#13616)

2.20.1

Patch Changes

fix: avoid using top-level await (#13607)

2.20.0

Minor Changes

feat: add getRequestEvent to $app/server (#13582)

2.19.2

Patch Changes

fix: lazily load CSS for dynamically imported components (#13564)

... (truncated)

Commits

711d37a Version Packages (#13706)
d3300c6 Merge commit from fork
a4acd47 Version Packages (#13685)
dd5381a Squelch rollup warnings (#13687)
99b8079 fix: allow HandleServerError hook to access the getRequestEvent (#13666)
1fc4ed9 Version Packages (#13672)
7fd7bcb chore: get rid of class-replacement hack (#13664)
aefa5b1 chore: tweak tsconfig includes (#13663)
fa29a79 Version Packages (#13632)
370e9f9 fix: only call afterNavigate once on start when SSR is disabled (#13593)
Additional commits viewable in compare view

Updates vite from 4.5.14 to 6.4.1

Release notes

Sourced from vite's releases.

create-vite@6.4.1

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

create-vite@6.4.0

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

v6.3.7

Please refer to CHANGELOG.md for details.

v6.3.6

Please refer to CHANGELOG.md for details.

v6.3.5

Please refer to CHANGELOG.md for details.

v6.3.4

Please refer to CHANGELOG.md for details.

v6.3.3

Please refer to CHANGELOG.md for details.

v6.3.2

Please refer to CHANGELOG.md for details.

v6.3.1

Please refer to CHANGELOG.md for details.

v6.3.0

Please refer to CHANGELOG.md for details.

v6.3.0-beta.2

Please refer to CHANGELOG.md for details.

v6.3.0-beta.1

Please refer to CHANGELOG.md for details.

v6.2.7

Please refer to CHANGELOG.md for details.

v6.2.6

Please refer to CHANGELOG.md for details.

v6.2.5

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.0.0-beta.1 (2025-12-08)

Features

add a warning that is output when a plugin sets esbuild related options (#21218) (200646b)

highly experimental full bundle mode (#21235) (83d8c99)

print esbuild options when both esbuild and oxc options are set (#21216) (08ae87b)

Bug Fixes

allow exiting process before optimizer cleanup is done (#21170) (55ceffc)

plugin shortcut support (#21211) (6a3aca0)

Miscellaneous Chores

cleanup changelog (#21202) (8c8c56e)

deps: update rolldown-related dependencies (#21230) (9349446)

fix spelling error (#21223) (cc10e20)

8.0.0-beta.0 (2025-12-03)

⚠ BREAKING CHANGES

update default browser target (#21193)

the epic rolldown-vite merge (#21189)

Features

update default browser target (#21193) (8c3dd06)

the epic rolldown-vite merge (#21189) (4a7f8d4)

Rolldown-Vite changelogs

See rolldown-vite changelog

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

config: handle shebang properly (#21158) (df5a30d)

deps: update all non-major dependencies (#21146) (a3cd262)

deps: update all non-major dependencies (#21175) (72e398a)

fix external: true merging (#21164) (5ef557a)

shortcuts not rebound after server restart (#21166) (3765f7b)

Performance Improvements

deps: replace debug with obug (#21137) (203a551)

Documentation

clarify manifest.json imports field is JS chunks only (#21136) (46d3077)

... (truncated)

Commits

a7349ef release: v6.3.1
a152b7c fix: backward compat for internal plugin transform calls (#19878)
35c7f35 fix: avoid using Promise.allSettled in preload function (#19805)
5fdcfe7 release: v6.3.0
d4ee5e8 fix(hmr): avoid infinite loop happening with hot.invalidate in circular dep...
5003434 fix(preview): use host url to open browser (#19836)
bf9728e release: v6.3.0-beta.2
380c10e fix(hmr): run HMR handler sequentially (#19793)
8bed1de fix: addWatchFile doesn't work if base is specified (fixes #19792) (#19794)
0a0c50a refactor: simplify pluginFilter implementation (#19828)
Additional commits viewable in compare view

Updates cookie from 0.5.0 to 0.6.0

Release notes

Sourced from cookie's releases.

0.6.0

Add partitioned option

Changelog

Sourced from cookie's changelog.

0.6.0 / 2023-11-06

Add partitioned option

Commits

38323ba 0.6.0
7560154 build: top-sites@1.1.194
c45b52d docs: switch badges to badgen
84a1567 Add partitioned option
c67a478 docs: fix typos in HISTORY
52a76c1 docs: fix typo in HISTORY
5f22857 Fix typo in JSDoc
da7e44e build: mocha@10.2.0
936036a build: eslint-plugin-markdown@3.0.1
197f670 build: eslint@8.53.0
Additional commits viewable in compare view

Updates devalue from 4.3.3 to 5.6.0

Release notes

Sourced from devalue's releases.

v5.6.0

Minor Changes

a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses

a3d09d4: feat: add value and root properties in DevalueError instances

v5.5.0

Minor Changes

828fa1c: Enable support for custom reducer/reviver for "function" values

v5.4.2

Patch Changes

5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

v5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

v5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

v5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

v5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

v5.3.0

Minor Changes

2896e7b: feat: support Temporal

fec694d: feat: support URL and URLSearchParams objects

Changelog

Sourced from devalue's changelog.

5.6.0

Minor Changes

a3d09d4: feat: expose DevalueError for instanceof checks in catch clauses

a3d09d4: feat: add value and root properties in DevalueError instances

5.5.0

Minor Changes

828fa1c: Enable support for custom reducer/reviver for "function" values

5.4.2

Patch Changes

5c26c0d: fix: allow custom revivers to revive things serialized by builtin reducers

5.4.1

Patch Changes

ca3c7b6: chore: Remove impossible void type from replacer's uneval

5.4.0

Minor Changes

9306d09: feat: pass uneval to replacer, for handling nested custom types

Patch Changes

b617c7c: perf: shrink uneval output with null-proto objects

5.3.2

Patch Changes

0623a47: fix: disallow array method access when parsing

0623a47: fix: disallow __proto__ properties on objects

5.3.1

Patch Changes

ae904c5: fix: correctly differentiate between +0 and -0

5.3.0

... (truncated)

Commits

83de81d Version Packages (#127)
a3d09d4 Add value and root properties in DevalueError instances (#126)
f4b37f3 Version Packages (#124)
828fa1c Enable support for custom reducer/reviver for "function" values (#123)
6f4eb8b Version Packages (#119)
5c26c0d fix: allow custom revivers to revive things serialized by buitin reducers (#118)
8b0c28d Version Packages (#117)
ca3c7b6 chore: Remove impossible void type from replacer's uneval (#116)
8fb152e Version Packages (#115)
9306d09 feat: pass uneval to replacer, for handling nested custom types (#114)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for devalue since your current version.

Updates esbuild from 0.18.20 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2023

This changelog documents all esbuild versions published in the year 2023 (versions 0.16.13 through 0.19.11).

0.19.11
Fix TypeScript-specific class transform edge case (#3559)

The previous release introduced an optimization that avoided transforming super() in the class constructor for TypeScript code compiled with useDefineForClassFields set to false if all class instance fields have no initializers. The rationale was that in this case, all class instance fields are omitted in the output so no changes to the constructor are needed. However, if all of this is the case and there are #private instance fields with initializers, those private instance field initializers were still being moved into the constructor. This was problematic because they were being inserted before the call to super() (since super() is now no longer transformed in that case). This release introduces an additional optimization that avoids moving the private instance field initializers into the constructor in this edge case, which generates smaller code, matches the TypeScript compiler's output more closely, and avoids this bug:
// Original code
class Foo extends Bar {
  #private = 1;
  public: any;
  constructor() {
    super();
  }
}
// Old output (with esbuild v0.19.9)
class Foo extends Bar {
constructor() {
super();
this.#private = 1;
}
#private;
}
// Old output (with esbuild v0.19.10)
class Foo extends Bar {
constructor() {
this.#private = 1;
super();
}
#private;
}
// New output
class Foo extends Bar {
#private = 1;
constructor() {
super();
}
}
Minifier: allow reording a primitive past a side-effect (#3568)

The minifier previously allowed reordering a side-effect past a primitive, but didn't handle the case of reordering a primitive past a side-effect. This additional case is now handled:

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 1 update in the /apps/desktop directory: [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit). Updates `@sveltejs/kit` from 1.30.4 to 2.20.6 - [Release notes](https://github.com/sveltejs/kit/releases) - [Changelog](https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md) - [Commits](https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.20.6/packages/kit) Updates `vite` from 4.5.14 to 6.4.1 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/create-vite@6.4.1/packages/vite) Updates `cookie` from 0.5.0 to 0.6.0 - [Release notes](https://github.com/jshttp/cookie/releases) - [Changelog](https://github.com/jshttp/cookie/blob/v0.6.0/HISTORY.md) - [Commits](jshttp/cookie@v0.5.0...v0.6.0) Updates `devalue` from 4.3.3 to 5.6.0 - [Release notes](https://github.com/sveltejs/devalue/releases) - [Changelog](https://github.com/sveltejs/devalue/blob/main/CHANGELOG.md) - [Commits](sveltejs/devalue@v4.3.3...v5.6.0) Updates `esbuild` from 0.18.20 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md) - [Commits](evanw/esbuild@v0.18.20...v0.25.12) --- updated-dependencies: - dependency-name: "@sveltejs/kit" dependency-version: 2.20.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.1 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: cookie dependency-version: 0.6.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: devalue dependency-version: 5.6.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2025-12-10T21:20:42Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-12-10T21:21:28Z

🛡️ Dependency Sentinel Check

This dependency update has been received and will follow the Git-Core Protocol lifecycle:

📋 Quarantine Protocol (14 Days)

Phase	Status	Date
🔬 Quarantine Start	✅ NOW	2025-12-10
🧠 AI Analysis	🔄 Pending	-
🔍 Community Monitoring	🔄 Active	-
🎓 Graduation	⏳ Scheduled	2025-12-24

🤖 AI Analysis Queue

The following AI agents will analyze this update:

Gemini 3 Pro - Risk assessment, breaking changes
CodeRabbit - Code patterns, best practices
Copilot - Final meta-analysis (post-bots)

⚠️ Architecture Check

Before adoption, this update will be validated against:

.✨/ARCHITECTURE.md - Critical decisions
docs/agent-docs/RESEARCH_STACK_CONTEXT.md - Living context

📖 Protocol Reference

Dependency Quarantine Rule: Versions < 2 weeks old are in quarantine. Never use bleeding-edge dependencies in production.

Managed by Git-Core Protocol Dependency Sentinel

socket-security · 2025-12-10T21:22:35Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@sveltejs/kit@2.49.2 ⏵ 2.20.6	⁺¹
npm/@sveltejs/vite-plugin-svelte@6.2.1 ⏵ 5.1.1
npm/vite@7.2.7 ⏵ 6.4.1	^-1	⁺¹
npm/svelte-preprocess@5.1.4 ⏵ 6.0.3	⁺¹
npm/typescript@5.9.3 ⏵ 5.6.3	⁺¹
npm/svelte-check@3.8.6 ⏵ 4.3.4			⁺³

View full report

dependabot · 2025-12-13T14:40:22Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot bot added dependencies Dependency updates from Dependabot javascript Pull requests that update javascript code labels Dec 10, 2025

github-actions bot added the quarantine Dependency in quarantine period label Dec 10, 2025

dependabot bot closed this Dec 13, 2025

dependabot bot deleted the dependabot/npm_and_yarn/apps/desktop/npm_and_yarn-fd703ec409 branch December 13, 2025 14:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates#72

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates#72
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/apps/desktop/npm_and_yarn-fd703ec409

dependabot bot commented on behalf of github Dec 10, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 10, 2025

Review skipped

Uh oh!

github-actions bot commented Dec 10, 2025

Uh oh!

socket-security bot commented Dec 10, 2025

Uh oh!

dependabot bot commented on behalf of github Dec 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.20.6

Patch Changes

2.20.5

Patch Changes

2.20.4

Patch Changes

2.20.3

Patch Changes

2.20.2

Patch Changes

2.20.1

Patch Changes

2.20.0

Minor Changes

2.19.2

Patch Changes

create-vite@6.4.1

v6.4.1

create-vite@6.4.0

v6.4.0

v6.3.7

v6.3.6

v6.3.5

v6.3.4

v6.3.3

v6.3.2

v6.3.1

v6.3.0

v6.3.0-beta.2

v6.3.0-beta.1

v6.2.7

v6.2.6

v6.2.5

8.0.0-beta.1 (2025-12-08)

Features

Bug Fixes

Miscellaneous Chores

8.0.0-beta.0 (2025-12-03)

⚠ BREAKING CHANGES

Features

Rolldown-Vite changelogs

7.2.6 (2025-12-01)

7.2.5 (2025-12-01)

Bug Fixes

Performance Improvements

Documentation

0.6.0

0.6.0 / 2023-11-06

v5.6.0

Minor Changes

v5.5.0

Minor Changes

v5.4.2

Patch Changes

v5.4.1

Patch Changes

v5.4.0

Minor Changes

Patch Changes

v5.3.2

Patch Changes

v5.3.1

Patch Changes

v5.3.0

Minor Changes

5.6.0

Minor Changes

5.5.0

Minor Changes

5.4.2

Patch Changes

5.4.1

Patch Changes

5.4.0

Minor Changes

Patch Changes

5.3.2

dependabot bot commented on behalf of github Dec 10, 2025 •

edited

Loading