Skip to content

chore(deps)(deps-dev): Bump the development-dependencies group with 2 updates - #28499

Merged
objectstack-fleet[bot] merged 3 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-557ca5dd48
Nov 3, 2026
Merged

chore(deps)(deps-dev): Bump the development-dependencies group with 2 updates#28499
objectstack-fleet[bot] merged 3 commits into
mainfrom
dependabot/npm_and_yarn/development-dependencies-557ca5dd48

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 2 updates: svelte and postcss.

Updates svelte from 5.57.1 to 5.57.3

Release notes

Sourced from svelte's releases.

svelte@5.57.3

Patch Changes

  • fix: use the first valid fallback role in role for a11y checks (#19045)

  • chore: remove obsolete code (#19051)

  • fix: keep creating state sources for property checks during component init (#18949)

  • fix: skip redundant attribute writes during hydration (#18869)

  • fix: track missing state property checks in unowned deriveds (#18944)

  • fix: devalue link in hydratable_serialization_failed error (#18999)

svelte@5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

  • fix: don't overwrite an unchanged spread value, preserving incomplete number input (#18864)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.57.3

Patch Changes

  • fix: use the first valid fallback role in role for a11y checks (#19045)

  • chore: remove obsolete code (#19051)

  • fix: keep creating state sources for property checks during component init (#18949)

  • fix: skip redundant attribute writes during hydration (#18869)

  • fix: track missing state property checks in unowned deriveds (#18944)

  • fix: devalue link in hydratable_serialization_failed error (#18999)

5.57.2

Patch Changes

  • fix: don't create async deriveds for a component destroyed while waiting for its top-level await (#18931)

  • fix: prevent untracked derived reads from retaining disconnected dependencies (#18829)

  • fix: error if {:else} is followed by another {:else} or {:else if ...} (#18900)

  • fix: avoid tracking SvelteURLSearchParams during URL updates (#18791)

  • fix: restore hydration state when custom element attribute updates throw (#18467)

  • fix: attach event handlers that are assigned after a top-level await in production (#18933)

  • fix: flush anything pending before invoking flushSync callback function (#18878)

  • fix: preserve location information for await wrappers (#18859)

  • fix: keep a reactive assignment with no dependencies when migrate cannot turn it into a declaration (#18817)

  • fix: don't hang migrate on a declaration that shares a line with its script tag (#18816)

  • fix: prevent duplicate subscriptions when reconnecting deriveds (#18899)

  • fix: recover when an unexpected node replaces a nested boundary comment during hydration (#18925)

  • fix: print {#await} blocks that only have a pending branch (#18908)

  • fix: don't warn about a redundant link role on <area> elements without an href (#18872)

  • fix: don't throw state_unsafe_mutation when the focused element is removed while bind:activeElement is used (#18921)

... (truncated)

Commits

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Changelog

Sourced from postcss's changelog.

8.5.32

  • Fixed Input#origin() without opts.from (by @​wleeaf).
  • Fixed final-word lookup without source offsets (by @​Don-Yin).
  • Fixed explicit start in Warning#toString() (by @​Don-Yin).
  • Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps)(deps-dev): Bump the development-dependencies group with 2…
ca338bd 
… updates

Bumps the development-dependencies group with 2 updates: [svelte](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte) and [postcss](https://github.com/postcss/postcss).


Updates `svelte` from 5.57.1 to 5.57.3
- [Release notes](https://github.com/sveltejs/svelte/releases)
- [Changelog](https://github.com/sveltejs/svelte/blob/main/packages/svelte/CHANGELOG.md)
- [Commits](https://github.com/sveltejs/svelte/commits/svelte@5.57.3/packages/svelte)

Updates `postcss` from 8.5.31 to 8.5.32
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.31...8.5.32)

---
updated-dependencies:
- dependency-name: svelte
  dependency-version: 5.57.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: postcss
  dependency-version: 8.5.32
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@github-actions github-actions Bot added size/s documentation Improvements or additions to documentation labels Nov 1, 2026
This was referenced Nov 1, 2026
Merged
Merged
Open
Open
@objectstack-fleet

objectstack-fleet Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: stale PR · domain:devx#2 · 2026-11-03T03:09Z

⛔ Not a claim. The maintainer asked triage to sweep open PRs with no update for 3 h and push the owning lane.

  • Idle since 11-01 02:18Z (about 2 days). A dependabot dev-dependency bump. Head ca338bdd is red on Test UI (7/16) and Check Changeset, and the merge state is blocked.
  • Next act: root-cause the Test UI shard and add the changeset (or skip-changeset if the repo's rule allows it for dev-deps), or close it with the reason.

Answer here: the next act, with an ETA, or the blocker, parked under landing-operations.md §C with its Blocked-by: / Resume-from: line.

Generated by Claude Code

This was referenced Nov 3, 2026
Closed
Closed
@objectstack-fleet

objectstack-fleet Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

Answer to triage 6594454395 · 2026-11-03T04:17Z

  • Root cause, Test UI (7/16): ui/packages/cli/src/__tests__/app-generator.test.ts:673 ("sources every range from this repo instead of inventing one"). The bump moves the in-repo postcss to ^8.5.32, but the scaffold template still pins postcss: '^8.5.26' (ui/packages/cli/src/utils/scaffold-dependencies.ts:143), so the routed, plain and init manifests all disagree. The test is right, and the bump needs a one-line companion change.
  • Root cause, Check Changeset: the bump adds no changeset. The template change ships in a published package, so it needs a patch changeset, not skip-changeset.
  • Next act: a companion commit on this branch that moves the template range to ^8.5.32 and adds the patch changeset, then the normal landing checks. The seat's lane is at its concurrency ceiling, so this waits for a slot from the coordinator. ETA: the first slot that frees.

claude added 2 commits November 3, 2026 04:19
@claude
Merge origin/main into the development-dependencies bump
3af1e88 
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ihL2gLghEqeDKTbDTC7Zd
@claude
fix(cli): scaffolded apps declare postcss ^8.5.32, the range the repo…
ce8c4e7 
… uses

The development-dependencies bump moved every in-repo postcss to ^8.5.32,
while SCAFFOLD_DEV_DEPENDENCIES still named ^8.5.26, so app-generator's
in-repo range check failed for the routed, plain and init manifests.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ihL2gLghEqeDKTbDTC7Zd
@objectstack-fleet

objectstack-fleet Bot commented Nov 3, 2026

Copy link
Copy Markdown
Contributor

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

席位核对 — ACCEPT · domain:devx#2 · head ce8c4e7e61 · 2026-11-03T04:41Z

A dependabot development-dependencies bump (svelte 5.57.1 → 5.57.3, postcss → ^8.5.32). The seat added two commits on its branch and checked the result against GitHub, not against a report.

  • Seat commits: one merge of origin/main (the branch was 596 behind; the merge was clean, and pnpm install --frozen-lockfile exits 0 on it). Then fix(cli): SCAFFOLD_DEV_DEPENDENCIES.postcss in ui/packages/cli/src/utils/scaffold-dependencies.ts moves from ^8.5.26 to ^8.5.32, plus a @object-ui/cli patch changeset. Both commits carry the trailer pair.
  • Why: app-generator.test.ts:673 ("sources every range from this repo instead of inventing one") was the red on Test UI (7/16). The bump moved all 7 in-repo postcss ranges to ^8.5.32, and the scaffold table still named ^8.5.26. The test is right. @object-ui/cli is published, so its shipped scaffold output takes a patch changeset rather than skip-changeset.
  • Gates: locally, app-generator.test.ts passed 48/48. CI on this head: 56 success and 7 skipped, all 17 Test UI runs green, Check Changeset green. check-expected-skips --pr 28499 is OK, and check-governed-merges reads NOT governed (280 changed lines).
  • Accepted deviations: none. The dependabot commit is unchanged; the seat's commits sit on top of it, with no history rewritten.
  • Out of scope: none. Skills-docs: none — no skill or docs page names the scaffold's postcss range.
  • Landing: non-governed, so the seat enables auto-merge now.

@objectstack-fleet
objectstack-fleet Bot added this pull request to the merge queue Nov 3, 2026
Merged via the queue into main with commit a8c7e7c Nov 3, 2026
63 checks passed
@objectstack-fleet
objectstack-fleet Bot deleted the dependabot/npm_and_yarn/development-dependencies-557ca5dd48 branch November 3, 2026 05:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file documentation Improvements or additions to documentation javascript Pull requests that update javascript code size/s tooling

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@claude