Skip to content

build(deps): bump the runtime-dependencies group across 1 directory with 7 updates - #15

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-dependencies-e3cda29f2d
Closed

build(deps): bump the runtime-dependencies group across 1 directory with 7 updates#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-dependencies-e3cda29f2d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 13, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the runtime-dependencies group with 7 updates in the / directory:

Package From To
svelte 5.55.5 5.56.3
svelte-dnd-action 0.9.69 0.9.70
@anthropic-ai/sdk 0.91.1 0.104.1
hono 4.12.15 4.12.25
yaml 2.8.3 2.9.0
electron-updater 6.8.3 6.8.9
openapi-fetch 0.13.8 0.17.0

Updates svelte from 5.55.5 to 5.56.3

Release notes

Sourced from svelte's releases.

svelte@5.56.3

Patch Changes

  • fix: ignore errors that occur in destroyed effects (#18384)

  • fix: type BigInts in $state.snapshot(...) return values (#18388)

svelte@5.56.2

Patch Changes

  • fix: properly track effect end node for async sibling component (#18371)

  • fix: prevent false-positive reactivity loss warning (#18373)

  • chore: bump esrap dependency (#18372)

  • fix: ignore declaration tags for animation directive (#18366)

  • fix: reject pending async deriveds on discard (#18308)

svelte@5.56.1

Patch Changes

  • fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

  • fix: parse declaration tag contents more robustly (#18353)

  • fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

  • fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

  • fix: tolerate whitespace before let/const in declaration tags (#18348)

  • fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

  • fix: more robust parsing of declaration tags with regards to type (#18330)

  • fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

  • fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

  • fix: check references for blockers on server, too (#18352)

svelte@5.56.0

Minor Changes

  • feat: allow declarations in the template (#18282)

Patch Changes

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.3

Patch Changes

  • fix: ignore errors that occur in destroyed effects (#18384)

  • fix: type BigInts in $state.snapshot(...) return values (#18388)

5.56.2

Patch Changes

  • fix: properly track effect end node for async sibling component (#18371)

  • fix: prevent false-positive reactivity loss warning (#18373)

  • chore: bump esrap dependency (#18372)

  • fix: ignore declaration tags for animation directive (#18366)

  • fix: reject pending async deriveds on discard (#18308)

5.56.1

Patch Changes

  • fix: error at compile time on duplicate snippet/declaration tag definitions (#18351)

  • fix: parse declaration tag contents more robustly (#18353)

  • fix: correctly transform references to earlier declarators in a declaration tag (e.g. {let a = $state(0), b = $derived(a * 2)}) (#18348)

  • fix: avoid spurious state_referenced_locally warnings for $derived declarations in declaration tags (#18348)

  • fix: tolerate whitespace before let/const in declaration tags (#18348)

  • fix: prevent infinite loop when a tag's expression ends with a trailing / at the end of the input (#18350)

  • fix: more robust parsing of declaration tags with regards to type (#18330)

  • fix: preserve newlines in spread input values when the type attribute is applied after value (#18345)

  • fix: update SvelteURLSearchParams when setting duplicate keys to the same joined value (#18336)

  • fix: check references for blockers on server, too (#18352)

5.56.0

Minor Changes

... (truncated)

Commits

Updates svelte-dnd-action from 0.9.69 to 0.9.70

Changelog

Sourced from svelte-dnd-action's changelog.

0.9.70

Bugfix: stop the keepOriginalElementInDom animation-frame loop after a drag is finalized, preventing a delayed crash when the original element leaves the DOM.

Commits

Updates @anthropic-ai/sdk from 0.91.1 to 0.104.1

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk: v0.104.1

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

Bug Fixes

  • api: add frontier_llm refusal category (465e686)

sdk: v0.104.0

0.104.0 (2026-06-09)

Full Changelog: sdk-v0.103.0...sdk-v0.104.0

Features

  • api: add support for Managed Agents deployments and environment variable credentials (d01e38b)

sdk: v0.103.0

0.103.0 (2026-06-09)

Full Changelog: sdk-v0.102.0...sdk-v0.103.0

Features

  • api: add support for claude-mythos-5 and claude-fable-5, with support for server-side fallbacks on refusal (cc337f7)
  • client: adds client-side fallbacks middleware for API providers that do not support server-side fallbacks (cc337f7)
  • middleware: add ctx.logger (#55) (edd1454)

Bug Fixes

sdk: v0.102.0

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

sdk: v0.101.0

0.101.0 (2026-06-05)

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

0.104.1 (2026-06-09)

Full Changelog: sdk-v0.104.0...sdk-v0.104.1

Bug Fixes

  • api: add frontier_llm refusal category (465e686)

0.104.0 (2026-06-09)

Full Changelog: sdk-v0.103.0...sdk-v0.104.0

Features

  • api: add support for Managed Agents deployments and environment variable credentials (d01e38b)

0.103.0 (2026-06-09)

Full Changelog: sdk-v0.102.0...sdk-v0.103.0

Features

  • api: add support for claude-mythos-5 and claude-fable-5, with support for server-side fallbacks on refusal (cc337f7)
  • client: adds client-side fallbacks middleware for API providers that do not support server-side fallbacks (cc337f7)
  • middleware: add ctx.logger (#55) (edd1454)

Bug Fixes

0.102.0 (2026-06-06)

Full Changelog: sdk-v0.101.0...sdk-v0.102.0

Features

  • api: small updates to Managed Agents types (8ba4f92)

Bug Fixes

  • client: run middleware before request signing (#45) (95f1a4a)

0.101.0 (2026-06-05)

Full Changelog: sdk-v0.100.1...sdk-v0.101.0

Features

... (truncated)

Commits
  • 9a0442d chore: release main
  • 1ccd401 fix(api): add frontier_llm refusal category
  • 8be0232 chore: release main
  • 813af32 feat(api): add support for Managed Agents deployments and environment variabl...
  • 589eed1 chore: release main
  • a785874 feat(api): add support for claude-mythos-5 and claude-fable-5, with support f...
  • 6322a4f fix(client): 3p middleware ordering (#53)
  • c2e94fc feat(middleware): add ctx.logger (#55)
  • f7dfb97 chore: release main
  • a3f3c97 feat(api): small updates to Managed Agents types
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​anthropic-ai/sdk since your current version.


Updates hono from 4.12.15 to 4.12.25

Release notes

Sourced from hono's releases.

v4.12.25

Security fixes

This release includes fixes for the following security issues:

CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard

Affects: hono/cors. Fixes the wildcard origin reflecting the request Origin and sending Access-Control-Allow-Credentials: true when credentials: true is set without an explicit origin, where any site a logged-in user visited could make credentialed cross-origin requests and read responses from cookie-authenticated endpoints. GHSA-88fw-hqm2-52qc

Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length

Affects: hono/body-limit on AWS Lambda (hono/aws-lambda, hono/lambda-edge). Fixes the request being built with the client-declared Content-Length while the body is delivered fully buffered, where a client could declare a small Content-Length with a much larger body and slip past the configured size limit. GHSA-rv63-4mwf-qqc2

Path traversal in serve-static on Windows via encoded backslash (%5C)

Affects: serveStatic on Windows (Node, Bun, Deno adapters). Fixes the path guard allowing a lone backslash, where an encoded backslash (%5C) decoded to \ was treated as a separator by the Windows path resolver, letting a single URL segment escape into a middleware-guarded subtree. GHSA-wwfh-h76j-fc44

AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice

Affects: hono/aws-lambda. Fixes multiple Set-Cookie response headers being joined into one comma-separated value for ALB single-header responses and VPC Lattice v2, where the value could not be split back into individual cookies and clients silently dropped or misparsed them. GHSA-j6c9-x7qj-28xf

Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest

Affects: hono/lambda-edge. Fixes repeated request headers being written with overwrite instead of append, where only the last value of a header such as X-Forwarded-For reached the application and the remaining values were silently dropped. GHSA-wgpf-jwqj-8h8p

v4.12.24

What's Changed

Full Changelog: honojs/hono@v4.12.23...v4.12.24

v4.12.23

What's Changed

Full Changelog: honojs/hono@v4.12.22...v4.12.23

v4.12.22

What's Changed

... (truncated)

Commits

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

  • Disable alias resolution with maxAliasCount:0 (#677)
  • Handle invalid unicode escapes (e1a1a77)
  • Apply minFractionDigits only to decimal strings (#676)
Commits
  • ddb21b0 2.9.0
  • 167365b docs: Clarify that not all errors can be avoided
  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
  • ccdf743 2.8.4
  • f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
  • e1a1a77 fix: Handle invalid unicode escapes
  • a163ea0 style: Satify Prettier
  • b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
  • 93c951b chore: Bump JSR version to v2.8.3 (#673)
  • Additional commits viewable in compare view

Updates electron-updater from 6.8.3 to 6.8.9

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

electron-updater@6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

electron-updater@6.8.7

Patch Changes

d6a5aee 4866737

  • builder-util-runtime@9.6.2

... (truncated)

Changelog

Sourced from electron-updater's changelog.

6.8.9

Patch Changes

198c10c 22a7532

  • builder-util-runtime@9.7.0

6.8.8

Patch Changes

59efef1

  • builder-util-runtime@9.6.3

6.8.7

Patch Changes

d6a5aee 4866737

... (truncated)

Commits
  • bed3a9c chore(deploy): Release v26.15.0 (electron-updater@6.8.9) (#9825)
  • 22a7532 fix: holistic field detection for \<text> (sha256 hash) redaction (#9834)
  • ffd11c7 chore(deploy): Release v26.13.0 (electron-updater@6.8.8) (#9793)
  • ac45083 fix(updater): ensure full changelog includes only release notes up to the lat...
  • d664ed0 chore: expand test coverage for updater and Windows build targets (#9794)
  • 2dc409f fix: harden the auto-update flow from relative paths and env var intercepts (...
  • 2c8c71a chore(deploy): Release v26.12.1 (electron-updater@6.8.7) (#9782)
  • 9120507 chore(deploy): Release v26.11.0 (electron-updater@6.8.6) (#9726)
  • d846315 chore(docs): docusaurus migration (#9744)
  • bea19a5 chore(deps): update dependency electron to v39 [security] (#9693)
  • Additional commits viewable in compare view

Updates openapi-fetch from 0.13.8 to 0.17.0

Release notes

Sourced from openapi-fetch's releases.

openapi-fetch@0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0

openapi-fetch@0.16.0

Minor Changes

  • #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

openapi-fetch@0.15.2

Patch Changes

  • #2508 89843b0 Thanks @​srbarba! - Use text() when no content-length is provided to avoid errors parsing empty bodies (200 with no content)

openapi-fetch@0.15.0

Minor Changes

openapi-fetch@0.14.1

Patch Changes

openapi-fetch@0.14.0

Minor Changes

  • #2310 e66b5ce Thanks @​drwpow! - Build package with unbuild. Also remove the minified version (openapi-fetch is only useful in a TypeScript/bundler environment, so there’s no sense in loading it from a CDN clientside).
Changelog

Sourced from openapi-fetch's changelog.

0.17.0

Minor Changes

  • #2549 a690e52 Thanks @​abumalick! - Add readOnly/writeOnly support via --read-write-markers flag. When enabled, readOnly properties are wrapped with $Read<T> and writeOnly properties with $Write<T>. openapi-fetch uses Readable<T> and Writable<T> helpers to exclude these properties from responses and request bodies respectively.

Patch Changes

  • #2572 9350ddf Thanks @​luis-guideti! - Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked

  • Updated dependencies [a690e52]:

    • openapi-typescript-helpers@0.1.0

0.16.0

Minor Changes

  • #2362 9002418 Thanks @​luxass! - Added support for setting a custom path serializers either globally or per request. This allows you to customize how path parameters are serialized in the URL. E.g. you can use a custom serializer to prevent encoding of a path parameter, if you need to pass a value that should not be encoded.

0.15.2

Patch Changes

  • #2508 89843b0 Thanks @​srbarba! - Use text() when no content-length is provided to avoid errors parsing empty bodies (200 with no content)

0.15.1

Patch Changes

0.15.0

Minor Changes

0.14.1

Patch Changes

0.14.0

Minor Changes

  • #2310 e66b5ce Thanks @​drwpow! - Build package with unbuild. Also remove the minified version (openapi-fetch is only useful in a TypeScript/bundler environment, so there’s no sense in loading it from a CDN clientside).
Commits
  • 5709d33 [ci] release (#2611)
  • 9350ddf Do not treat Content-Length=0 as empty when Transfer-Encoding is chunked (#2572)
  • a690e52 feat(openapi-typescript): add readOnly/writeOnly support via markers (#2549)
  • a06e6c3 chore(deps): update dependency superagent to v10.3.0 (#2595)
  • 7318f82 [ci] release (#2604)
  • 33b83c4 chore(deps): update dependency express to v5.2.1 (#2591)
  • 66556d0 chore(deps): update dependency axios to v1.13.5 (#2590)
  • 9002418 feat(openapi-fetch): add support for pathSerializer option (#2362)
  • ed0c26c feat(openapi-fetch): enable middleware request param module augmentation (#2527)
  • 47ba213 ci: fix npm publish permissions (#2601)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for openapi-fetch since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the runtime-dependencies group across 1 directory w…
d3ade6d 
…ith 7 updates

Bumps the runtime-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) | `5.55.5` | `5.56.3` |
| [svelte-dnd-action](https://github.com/isaacHagoel/svelte-dnd-action) | `0.9.69` | `0.9.70` |
| [@anthropic-ai/sdk](https://github.com/anthropics/anthropic-sdk-typescript) | `0.91.1` | `0.104.1` |
| [hono](https://github.com/honojs/hono) | `4.12.15` | `4.12.25` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` |
| [electron-updater](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater) | `6.8.3` | `6.8.9` |
| [openapi-fetch](https://github.com/openapi-ts/openapi-typescript/tree/HEAD/packages/openapi-fetch) | `0.13.8` | `0.17.0` |



Updates `svelte` from 5.55.5 to 5.56.3
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.56.3/packages/svelte)

Updates `svelte-dnd-action` from 0.9.69 to 0.9.70
- [Changelog](https://github.com/isaacHagoel/svelte-dnd-action/blob/master/release-notes.md)
- [Commits](https://github.com/isaacHagoel/svelte-dnd-action/commits)

Updates `@anthropic-ai/sdk` from 0.91.1 to 0.104.1
- [Release notes](https://github.com/anthropics/anthropic-sdk-typescript/releases)
- [Changelog](https://github.com/anthropics/anthropic-sdk-typescript/blob/main/CHANGELOG.md)
- [Commits](anthropics/anthropic-sdk-typescript@sdk-v0.91.1...sdk-v0.104.1)

Updates `hono` from 4.12.15 to 4.12.25
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.15...v4.12.25)

Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.3...v2.9.0)

Updates `electron-updater` from 6.8.3 to 6.8.9
- [Release notes](https://github.com/electron-userland/electron-builder/releases)
- [Changelog](https://github.com/electron-userland/electron-builder/blob/master/packages/electron-updater/CHANGELOG.md)
- [Commits](https://github.com/electron-userland/electron-builder/commits/electron-updater@6.8.9/packages/electron-updater)

Updates `openapi-fetch` from 0.13.8 to 0.17.0
- [Release notes](https://github.com/openapi-ts/openapi-typescript/releases)
- [Changelog](https://github.com/openapi-ts/openapi-typescript/blob/main/packages/openapi-fetch/CHANGELOG.md)
- [Commits](https://github.com/openapi-ts/openapi-typescript/commits/openapi-fetch@0.17.0/packages/openapi-fetch)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.56.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: svelte-dnd-action
  dependency-version: 0.9.70
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: "@anthropic-ai/sdk"
  dependency-version: 0.104.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: hono
  dependency-version: 4.12.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
- dependency-name: electron-updater
  dependency-version: 6.8.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime-dependencies
- dependency-name: openapi-fetch
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026
@dependabot
dependabot Bot requested a review from jimdou as a code owner June 13, 2026 09:24
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 27, 2026

Copy link
Copy Markdown
Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Jun 27, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/runtime-dependencies-e3cda29f2d branch June 27, 2026 09:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jimdou jimdou Awaiting requested review from jimdou jimdou is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants