Reintegrate - #581

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/2

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzYuNyIsInVwZGF0ZWRJblZlciI6IjQzLjE3Ni43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/4

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/5

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Adoption](https://docs.renovatebot.com/merge-confidence/) | [Passing](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | [`5.55.5` → `5.55.7`](https://renovatebot.com/diffs/npm/svelte/5.55.5/5.55.7) | ![age](https://developer.mend.io/api/mc/badges/age/npm/svelte/5.55.7?slim=true) | ![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/svelte/5.55.7?slim=true) | ![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/svelte/5.55.5/5.55.7?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/svelte/5.55.5/5.55.7?slim=true) |

---

### Svelte: ReDoS in `<svelte:element>` Tag Validation
[CVE-2026-42567](https://nvd.nist.gov/vuln/detail/CVE-2026-42567) / [GHSA-9rmh-mm8f-r9h6](GHSA-9rmh-mm8f-r9h6)

<details>
<summary>More information</summary>

#### Details
An internal regex in the Svelte runtime can take exponential time to test in `<svelte:element this={tag}></svelte:element>`. You are only vulnerable to this if you allow tags of unconstrained length. If your application only allows a predetermined list of tags or trims their length before passing them to `svelte:element`, you are safe.

#### Severity
- CVSS Score: 5.9 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6](https://github.com/sveltejs/svelte/security/advisories/GHSA-9rmh-mm8f-r9h6)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-9rmh-mm8f-r9h6) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte: SSR XSS via Insecure Promise Serialization in hydratable
[GHSA-f3cj-j4f6-wq85](GHSA-f3cj-j4f6-wq85)

<details>
<summary>More information</summary>

#### Details
Contents of `hydratable` promises were not properly stringified, potentially leading to an XSS exploit. You are vulnerable if all of the following is true:
- you are using `hydratable` (an experimental feature at the time of this report)
- you are passing attacker-controlled input such that a synchronous value is hydrated, then a promise value, e.g. `hydratable('someKey', () => [synchronousValue, promiseValue])`

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85](https://github.com/sveltejs/svelte/security/advisories/GHSA-f3cj-j4f6-wq85)
- [https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4](https://github.com/sveltejs/svelte/commit/a16ebc67bbcf8f708360195687e1b2719463e1a4)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](http://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-f3cj-j4f6-wq85) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte SSR vulnerable to cross-site scripting via spread attributes
[CVE-2026-42599](https://nvd.nist.gov/vuln/detail/CVE-2026-42599) / [GHSA-pr6f-5x2q-rwfp](GHSA-pr6f-5x2q-rwfp)

<details>
<summary>More information</summary>

#### Details
When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability _only_ triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires.

This is similar to but different from [CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121).

#### Severity
- CVSS Score: 5.1 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp](https://github.com/sveltejs/svelte/security/advisories/GHSA-pr6f-5x2q-rwfp)
- [https://nvd.nist.gov/vuln/detail/CVE-2026-27121](https://nvd.nist.gov/vuln/detail/CVE-2026-27121)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-pr6f-5x2q-rwfp) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State
[CVE-2026-42573](https://nvd.nist.gov/vuln/detail/CVE-2026-42573) / [GHSA-rcqx-6q8c-2c42](GHSA-rcqx-6q8c-2c42)

<details>
<summary>More information</summary>

#### Details
Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks.

You are vulnerable if all of the following is true:
- you are using attribute spreading on a form element
- you are using attribute spreading or allow a dynamic value for the `name` attribute on an input or button element within that form
- both of these are simultaneously user-controllable

```svelte
<form {...spread1}>
  <input {...spread2}>
</form>
```

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N`

#### References
- [https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42](https://github.com/sveltejs/svelte/security/advisories/GHSA-rcqx-6q8c-2c42)
- [https://github.com/sveltejs/svelte](https://github.com/sveltejs/svelte)
- [https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7](https://github.com/sveltejs/svelte/releases/tag/svelte%405.55.7)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-rcqx-6q8c-2c42) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>sveltejs/svelte (svelte)</summary>

### [`v5.55.7`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5557)

[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.55.6...svelte@5.55.7)

##### Patch Changes

- fix: prevent XSS on `hydratable` from user contents ([`a16ebc67bbcf8f708360195687e1b2719463e1a4`](sveltejs/svelte@a16ebc6))

- chore: bump devalue ([#&#8203;18219](sveltejs/svelte#18219))

- fix: disallow empty attribute names during SSR ([`547853e2406a2147ad7fb5ffeba95b01bd9642da`](sveltejs/svelte@547853e))

- fix: harden regex ([`d2375e2ebcab5c88feb5652f1a9d621b8f06b259`](sveltejs/svelte@d2375e2))

- fix: move Svelte runtime properties to symbols ([`e1cbbd96441e82c9eb8a23a2903c0d06d3cda991`](sveltejs/svelte@e1cbbd9))

### [`v5.55.6`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5556)

[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.55.5...svelte@5.55.6)

##### Patch Changes

- fix: leave stale promises to wait for a later resolution, instead of rejecting ([#&#8203;18180](sveltejs/svelte#18180))

- fix: keep dependencies of `$state.eager/pending` ([#&#8203;18218](sveltejs/svelte#18218))

- fix: reapply context after transforming error during SSR ([#&#8203;18099](sveltejs/svelte#18099))

- fix: don't rebase just-created batches ([#&#8203;18117](sveltejs/svelte#18117))

- chore: allow `null` for `pending` in typings ([#&#8203;18201](sveltejs/svelte#18201))

- fix: flush eager effects in production ([#&#8203;18107](sveltejs/svelte#18107))

- fix: rethrow error of failed iterable after calling `return()` ([#&#8203;18169](sveltejs/svelte#18169))

- fix: account for proxified instance when updating `bind:this` ([#&#8203;18147](sveltejs/svelte#18147))

- fix: ensure scheduled batch is flushed if not obsolete ([#&#8203;18131](sveltejs/svelte#18131))

- fix: resolve stale deriveds with latest value ([#&#8203;18167](sveltejs/svelte#18167))

- chore: remove unnecessary `increment_pending` calls ([#&#8203;18183](sveltejs/svelte#18183))

- fix: correctly compile component member expressions for SSR ([#&#8203;18192](sveltejs/svelte#18192))

- fix: reset `source.updated` stack traces after `flush` ([#&#8203;18196](sveltejs/svelte#18196))

- fix: replacing async 'blocking' strategy with 'merging' ([#&#8203;18205](sveltejs/svelte#18205))

- fix: allow `@debug` tags to reference awaited variables ([#&#8203;18138](sveltejs/svelte#18138))

- fix: re-run fallback props if dependencies update ([#&#8203;18146](sveltejs/svelte#18146))

- fix: abort running obsolete async branches ([#&#8203;18118](sveltejs/svelte#18118))

- fix: ignore comments when reading CSS values ([#&#8203;18153](sveltejs/svelte#18153))

- fix: wrap `Promise.all` in `save` during SSR ([#&#8203;18178](sveltejs/svelte#18178))

- fix: ignore false-positive errors of `$inspect` dependencies ([#&#8203;18106](sveltejs/svelte#18106))

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODAuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4MC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJzZWN1cml0eSJdfQ==-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/6

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xODIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjE4Mi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/8

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on monday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjE5NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/11

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/13

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | pin | [`^25.9.1` → `25.9.1`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.1/25.9.1) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |

⚠️ Renovate's pin functionality [does not currently](renovatebot/renovate#40288) wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset `:preserveSemverRanges` to your config if you don't want to pin your dependencies.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - "before 4am on sunday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDQuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwNC4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/14

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/16

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/17

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/18

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/19

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTQuNiIsInVwZGF0ZWRJblZlciI6IjQzLjIxNC42IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/21

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMjIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIyMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/23

This PR contains the following updates:

| Package | Type | Update | Change | OpenSSF |
|---|---|---|---|---|
| [@sveltejs/kit](https://svelte.dev) ([source](https://github.com/sveltejs/kit/tree/HEAD/packages/kit)) | devDependencies | minor | [`2.66.0` → `2.68.0`](https://renovatebot.com/diffs/npm/@sveltejs%2fkit/2.66.0/2.68.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/kit/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/kit) |
| [@types/luxon](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/luxon) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/luxon)) | devDependencies | patch | [`3.7.1` → `3.7.2`](https://renovatebot.com/diffs/npm/@types%2fluxon/3.7.1/3.7.2) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | patch | [`25.9.3` → `25.9.4`](https://renovatebot.com/diffs/npm/@types%2fnode/25.9.3/25.9.4) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/DefinitelyTyped/DefinitelyTyped/badge)](https://securityscorecards.dev/viewer/?uri=github.com/DefinitelyTyped/DefinitelyTyped) |
| [cookie](https://github.com/jshttp/cookie) | overrides | major | [`1.1.1` → `2.0.0`](https://renovatebot.com/diffs/npm/cookie/1.1.1/2.0.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/jshttp/cookie/badge)](https://securityscorecards.dev/viewer/?uri=github.com/jshttp/cookie) |
| [svelte](https://svelte.dev) ([source](https://github.com/sveltejs/svelte/tree/HEAD/packages/svelte)) | devDependencies | patch | [`5.56.3` → `5.56.4`](https://renovatebot.com/diffs/npm/svelte/5.56.3/5.56.4) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/svelte/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/svelte) |
| [svelte-check](https://github.com/sveltejs/language-tools) | devDependencies | minor | [`4.6.0` → `4.7.1`](https://renovatebot.com/diffs/npm/svelte-check/4.6.0/4.7.1) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sveltejs/language-tools/badge)](https://securityscorecards.dev/viewer/?uri=github.com/sveltejs/language-tools) |
| [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | devDependencies | minor | [`8.0.16` → `8.1.0`](https://renovatebot.com/diffs/npm/vite/8.0.16/8.1.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/vitejs/vite/badge)](https://securityscorecards.dev/viewer/?uri=github.com/vitejs/vite) |
| [wrangler](https://github.com/cloudflare/workers-sdk) ([source](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler)) | devDependencies | minor | [`4.102.0` → `4.105.0`](https://renovatebot.com/diffs/npm/wrangler/4.102.0/4.105.0) | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/cloudflare/workers-sdk/badge)](https://securityscorecards.dev/viewer/?uri=github.com/cloudflare/workers-sdk) |

---

### Release Notes

<details>
<summary>sveltejs/kit (@&#8203;sveltejs/kit)</summary>

### [`v2.68.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2680)

##### Minor Changes

- feat: expose `RemoteFormEnhanceInstance` and `RemoteFormEnhanceCallback` types ([#&#8203;15816](sveltejs/kit#15816))

- feat: set value of `submit` fields when form is submitted ([#&#8203;15979](sveltejs/kit#15979))

##### Patch Changes

- fix: skip `native_navigation` when `__data.json` returns 404 on a static fallback page ([#&#8203;16135](sveltejs/kit#16135))

- fix: ignore third-party monkeypatches in `pushState`/`replaceState` warning detection ([#&#8203;15267](sveltejs/kit#15267))

- fix: snapshot form fields on read ([#&#8203;16150](sveltejs/kit#16150))

- fix: strip field prefix before erroring on duplicates ([#&#8203;16151](sveltejs/kit#16151))

- fix: call reset function via prototype ([#&#8203;16138](sveltejs/kit#16138))

- chore: fix navigation `type` hover info ([#&#8203;16147](sveltejs/kit#16147))

### [`v2.67.0`](https://github.com/sveltejs/kit/blob/HEAD/packages/kit/CHANGELOG.md#2670)

[Compare Source](https://github.com/sveltejs/kit/compare/@sveltejs/kit@2.66.0...@sveltejs/kit@2.67.0)

##### Minor Changes

- feat: add `prerender.handleInvalidUrl` option for invalid URLs discovered while crawling ([#&#8203;16088](sveltejs/kit#16088))

##### Patch Changes

- fix: support `exactOptionalPropertyTypes` for optional form schema fields ([#&#8203;15866](sveltejs/kit#15866))

- fix: avoid unnecessarily overriding a user's Vite 8 `codeSplitting` setting ([#&#8203;16118](sveltejs/kit#16118))

</details>

<details>
<summary>jshttp/cookie (cookie)</summary>

### [`v2.0.0`](https://github.com/jshttp/cookie/releases/tag/v2.0.0)

[Compare Source](jshttp/cookie@v1.1.1...v2.0.0)

**Important:** This release moves the package to ESM only. In node 22+ you can `require(esm)`, and older node versions are not supported.

**Changed**

- Switch to ESM ([#&#8203;273](jshttp/cookie#273))
- Remove deprecated code paths ([#&#8203;272](jshttp/cookie#272))
  - The old `parse` and `stringify` methods have been renamed: `parseCookie` and `stringifySetCookie`
  - `stringifySetCookie` only supports object mode (e.g. `{ name: "", value: "" }`)

**Improvements**

- Faster stringify cookie ([#&#8203;262](jshttp/cookie#262))
- Optimize encode performance ([#&#8203;269](jshttp/cookie#269))
- Apply `encode` to empty cookie values ([#&#8203;277](jshttp/cookie#277))

**Fixed**

- Omit leading semicolon when stringifying cookies with skipped values ([#&#8203;267](jshttp/cookie#267))

</details>

<details>
<summary>sveltejs/svelte (svelte)</summary>

### [`v5.56.4`](https://github.com/sveltejs/svelte/blob/HEAD/packages/svelte/CHANGELOG.md#5564)

[Compare Source](https://github.com/sveltejs/svelte/compare/svelte@5.56.3...svelte@5.56.4)

##### Patch Changes

- fix: include wrapping parentheses in `{@&#8203;const}` declarator `end` position ([#&#8203;18436](sveltejs/svelte#18436))

- fix: always unset reactivity context after restoring it ([#&#8203;18453](sveltejs/svelte#18453))

- fix: don't notify `searchParams` subscribers when the URL changes without affecting the search string ([#&#8203;18425](sveltejs/svelte#18425))

- fix: strip `?` from optional parameters in `<script lang="ts">` so generated JavaScript is valid ([#&#8203;18448](sveltejs/svelte#18448))

</details>

<details>
<summary>sveltejs/language-tools (svelte-check)</summary>

### [`v4.7.1`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.1)

[Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.7.0...svelte-check@4.7.1)

##### Patch Changes

- fix: correctly parse --tsgo-experimental-api flag ([#&#8203;3067](sveltejs/language-tools#3067))

### [`v4.7.0`](https://github.com/sveltejs/language-tools/releases/tag/svelte-check%404.7.0)

[Compare Source](https://github.com/sveltejs/language-tools/compare/svelte-check@4.6.0...svelte-check@4.7.0)

##### Minor Changes

- feat: add `--config` option ([#&#8203;3066](sveltejs/language-tools#3066))

- feat: svelte-check tsgo support with experimental api ([#&#8203;3036](sveltejs/language-tools#3036))

##### Patch Changes

- fix: load esm version of Vite ([#&#8203;3065](sveltejs/language-tools#3065))

- fix: stop excluding workspaces under dot-prefixed ancestors ([#&#8203;3037](sveltejs/language-tools#3037))

- Updated dependencies \[[`7a3464b`](sveltejs/language-tools@7a3464b), [`a2561fc`](sveltejs/language-tools@a2561fc)]:
  - [@&#8203;sveltejs/load-config](https://github.com/sveltejs/load-config)@&#8203;0.2.0

</details>

<details>
<summary>vitejs/vite (vite)</summary>

### [`v8.1.0`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#810-2026-06-23)

[Compare Source](vitejs/vite@v8.0.16...v8.1.0)

##### Features

- extend `server.fs.deny` list with common files ([#&#8203;22707](vitejs/vite#22707)) ([61ba8fd](vitejs/vite@61ba8fd))
- update rolldown to 1.1.2 ([#&#8203;22695](vitejs/vite#22695)) ([4f008a6](vitejs/vite@4f008a6))
- use `~` for Rolldown ([#&#8203;22693](vitejs/vite#22693)) ([9928722](vitejs/vite@9928722))

##### Bug Fixes

- **bundled-dev:** errors should be kept when incremental build fails ([#&#8203;22617](vitejs/vite#22617)) ([9a0dd48](vitejs/vite@9a0dd48))
- cache falsy values in perEnvironmentState ([#&#8203;22715](vitejs/vite#22715)) ([0e91e79](vitejs/vite@0e91e79))
- **glob:** respect caseSensitive option in hmr matcher ([#&#8203;22711](vitejs/vite#22711)) ([65f525e](vitejs/vite@65f525e))
- **html:** omit nonce on import map when cspNonce is unset ([#&#8203;22713](vitejs/vite#22713)) ([8340bb5](vitejs/vite@8340bb5))
- **optimizer:** skip null-valued exports in expandGlobIds glob resolution ([#&#8203;22611](vitejs/vite#22611)) ([8b9f5cd](vitejs/vite@8b9f5cd))
- resolved build options should be kept as a getter ([#&#8203;22691](vitejs/vite#22691)) ([3527191](vitejs/vite@3527191))
- **server:** handle malformed URI in memory files middleware ([#&#8203;22714](vitejs/vite#22714)) ([df9e0a5](vitejs/vite@df9e0a5))
- use literal envPrefix queries for Vite Task ([#&#8203;22706](vitejs/vite#22706)) ([da72733](vitejs/vite@da72733))
- warn on deprecated envFile ([#&#8203;22555](vitejs/vite#22555)) ([ed7b283](vitejs/vite@ed7b283))

##### Code Refactoring

- **client:** inline dev-id value in CSS selector ([#&#8203;22736](vitejs/vite#22736)) ([57f59bc](vitejs/vite@57f59bc))
- remove unused removeRawQuery util ([#&#8203;22724](vitejs/vite#22724)) ([403cc60](vitejs/vite@403cc60))
- use `rolldownOptions` property for chunkImportMap ([#&#8203;22692](vitejs/vite#22692)) ([8e8816c](vitejs/vite@8e8816c))

</details>

<details>
<summary>cloudflare/workers-sdk (wrangler)</summary>

### [`v4.105.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41050)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.104.0...wrangler@4.105.0)

##### Minor Changes

- [#&#8203;14311](cloudflare/workers-sdk#14311) [`34e0cef`](cloudflare/workers-sdk@34e0cef) Thanks [@&#8203;sherryliu-lsy](https://github.com/sherryliu-lsy)! - Add Google Artifact Registry support to `containers registries configure`

  `wrangler containers registries configure` now recognizes `*-docker.pkg.dev` (Google Artifact Registry) domains.

  - The Google service account email is the public credential, supplied with `--gar-email`. It must match the `client_email` in the service account key.
  - The service account JSON key is the private credential. It is provided via stdin (a file path, raw JSON, or base64) or an interactive prompt (a file path or base64) — never as a CLI flag, so it does not appear in shell history. The key is validated against `--gar-email` and stored base64-encoded.
  - Secret reuse inherits the existence-first flow: when the target Secrets Store secret already exists, it is reused by reference and the key is not required. In that case the email cannot be verified locally; it is validated against the key when images are pulled.

  ```sh
  <path-to-key>.json | npx wrangler@latest containers registries configure <region>-docker.pkg.dev --gar-email=<service-account-email> --secret-name=Google_Service_Account_JSON_Key
  ```

##### Patch Changes

- [#&#8203;14424](cloudflare/workers-sdk#14424) [`5f40dd5`](cloudflare/workers-sdk@5f40dd5) Thanks [@&#8203;MattieTK](https://github.com/MattieTK)! - Bump `am-i-vibing` from 0.4.0 to 0.5.0

  This updates the agentic environment detection library to the latest version, which adds detection for the Pi coding agent (`earendil-works/pi`).

- [#&#8203;14406](cloudflare/workers-sdk#14406) [`3b743c1`](cloudflare/workers-sdk@3b743c1) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260623.1 | 1.20260625.1 |

- [#&#8203;14343](cloudflare/workers-sdk#14343) [`daa5389`](cloudflare/workers-sdk@daa5389) Thanks [@&#8203;th0m](https://github.com/th0m)! - Use digest-pinned image references for Dockerfile container deploys

  Dockerfile-backed container deploys now use the pushed image digest when deploying the container application. This lets snapshot-enabled container apps pass Cloudchamber validation while keeping local, non-pushed builds and registry image URI deploys unchanged.

- [#&#8203;14394](cloudflare/workers-sdk#14394) [`8a5cf8c`](cloudflare/workers-sdk@8a5cf8c) Thanks [@&#8203;Partha-Shankar](https://github.com/Partha-Shankar)! - fix(d1): escape `migrationsTableName` and filenames in SQLite queries

  D1 migration commands in both `wrangler` and `@cloudflare/vitest-pool-workers` interpolated the `migrationsTableName` config value and migration filenames directly into SQL strings without any escaping. This meant:

  - A table name such as `my"table` would produce invalid SQL in `CREATE TABLE`, `SELECT`, and `INSERT` statements, and
  - A migration filename containing an apostrophe (e.g. `what's-new.sql`) would break the `INSERT INTO ... VALUES ('...')` statement appended after each migration in `wrangler`.

  Both identifiers are now properly escaped before interpolation: `migrationsTableName` is wrapped in double-quotes with internal double-quotes doubled (SQL-standard identifier quoting), and migration filenames used as string literals have their single-quotes doubled before insertion.

- Updated dependencies \[[`3b743c1`](cloudflare/workers-sdk@3b743c1)]:
  - miniflare\@&#8203;4.20260625.0

### [`v4.104.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41040)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.103.0...wrangler@4.104.0)

##### Minor Changes

- [#&#8203;14369](cloudflare/workers-sdk#14369) [`e312dec`](cloudflare/workers-sdk@e312dec) Thanks [@&#8203;edmundhung](https://github.com/edmundhung)! - Add `getEnv()` to `createTestHarness()` Worker handles

  Tests can now access the full `env` object for a Worker with `await server.getWorker<Env>().getEnv()`, including vars, secrets, and bindings.

##### Patch Changes

- [#&#8203;14364](cloudflare/workers-sdk#14364) [`a085dec`](cloudflare/workers-sdk@a085dec) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260617.1 | 1.20260619.1 |

- [#&#8203;14383](cloudflare/workers-sdk#14383) [`9a0de8f`](cloudflare/workers-sdk@9a0de8f) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260619.1 | 1.20260621.1 |

- [#&#8203;14397](cloudflare/workers-sdk#14397) [`fab565f`](cloudflare/workers-sdk@fab565f) Thanks [@&#8203;dependabot](https://github.com/apps/dependabot)! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  | Dependency | From         | To           |
  | ---------- | ------------ | ------------ |
  | workerd    | 1.20260621.1 | 1.20260623.1 |

- [#&#8203;14388](cloudflare/workers-sdk#14388) [`3f02864`](cloudflare/workers-sdk@3f02864) Thanks [@&#8203;petebacondarwin](https://github.com/petebacondarwin)! - Stop erroring when `find_additional_modules` discovers a file that only matches a inactive module rule

  Module rules assign module *types* to imported files — they are not include/exclude filters. Also, setting `fallthrough: false` in a rule will cause subsequent rules to become inactive. Previously, when `find_additional_modules` walked the filesystem and discovered a file whose only matching rule is inactive, Wrangler would throw an error and fail the build.

  This meant that adding a user rule like the one below would break the build for any `.txt`, `.html`, `.sql`, `.bin` or `.wasm` file that didn't match the user-supplied globs but lived somewhere under the module root:

  ```jsonc
  // wrangler.json
  {
    "rules": [
      {
        "type": "Text",
        "globs": ["html/includeme.html"],
        "fallthrough": false
      }
    ]
  }
  ```

  Discovered files that only match an inactive rule are now silently skipped (a `debug`-level log records each skip for troubleshooting), so users can use `fallthrough: false` to narrow the set of files attached to their Worker without having to delete or move untouched files on disk.

  The direct-import path is unchanged: importing a file in code that only matches an inactive rule is still a hard error, because the imported file genuinely needs a defined module type.

  Fixes [#&#8203;14257](cloudflare/workers-sdk#14257).

- [#&#8203;14358](cloudflare/workers-sdk#14358) [`4ef872f`](cloudflare/workers-sdk@4ef872f) Thanks [@&#8203;gabivlj](https://github.com/gabivlj)! - Fix container egress interception on arm64 Docker runtimes

  Both `wrangler dev` and the Cloudflare Vite plugin no longer force the `proxy-everything` sidecar image to pull as `linux/amd64`, allowing Docker to select the native image from the multi-platform manifest. Set `MINIFLARE_CONTAINER_EGRESS_IMAGE_PLATFORM` to force a specific platform when needed.

- [#&#8203;14362](cloudflare/workers-sdk#14362) [`2a02858`](cloudflare/workers-sdk@2a02858) Thanks [@&#8203;sherryliu-lsy](https://github.com/sherryliu-lsy)! - Don't require the private credential when reusing an existing Secrets Store secret in `containers registries configure`

  `wrangler containers registries configure` now checks whether the target Secrets Store secret already exists before resolving the private credential. When the secret already exists it is reused by reference, so the private credential no longer needs to be supplied (via stdin in non-interactive mode, or via a prompt interactively). This applies to all external registries.

  The new-secret path is unchanged: the credential is still required and stored. The only visible interactive change is that the secret prompt now appears last and only when a new secret is being created.

- Updated dependencies \[[`a085dec`](cloudflare/workers-sdk@a085dec), [`9a0de8f`](cloudflare/workers-sdk@9a0de8f), [`fab565f`](cloudflare/workers-sdk@fab565f)]:
  - miniflare\@&#8203;4.20260623.0

### [`v4.103.0`](https://github.com/cloudflare/workers-sdk/blob/HEAD/packages/wrangler/CHANGELOG.md#41030)

[Compare Source](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.102.0...wrangler@4.103.0)

##### Minor Changes

- [#&#8203;14295](cloudflare/workers-sdk#14295) [`cfd6205`](cloudflare/workers-sdk@cfd6205) Thanks [@&#8203;dario-piotrowicz](https://github.com/dario-piotrowicz)! - Move `unstable_getWorkerNameFromProject` from wrangler to `@cloudflare/workers-utils`

  The `unstable_getWorkerNameFromProject` export has been removed from the `wrangler` package. This function is now available as `getWorkerNameFromProject` (without the `unstable_` prefix) from `@cloudflare/workers-utils`. If you were importing this function from `wrangler`, update your import to use `@cloudflare/workers-utils` instead.

- [#&#8203;14295](cloudflare/workers-sdk#14295) [`cfd6205`](cloudflare/workers-sdk@cfd6205) Thanks [@&#8203;dario-piotrowicz](https://github.com/dario-piotrowicz)! - Remove experimental autoconfig exports

  The experimental autoconfig exports (`experimental_getDetailsForAutoConfig`, `experimental_runAutoConfig`, `experimental_AutoConfigFramework`) have been removed. This logic has been moved to the `@cloudflare/autoconfig` package (without the `experimental_` prefixes since the package itself is pre-v1).

##### Patch Changes

- [#&#8203;14366](cloudflare/workers-sdk#14366) [`c6579d3`](cloudflare/workers-sdk@c6579d3) Thanks [@&#8203;jamesopstad](https://github.com/jamesopstad)! - Resolve relative `cf-worker` entrypoint imports relative to the importing module

  When loading the experimental `cloudflare.config.ts`, a relative entrypoint imported with `import ... with { type: "cf-worker" }` (e.g. `./src/index.ts`) is now anchored to the module where the import is written, rather than being passed through verbatim and later resolved against the top-level config file. This fixes incorrect resolution when the import lives in a file other than the entry config — for example a config that re-exports from a nested file.

  Bare specifiers (such as `@scope/pkg`) and virtual modules (such as `virtual:foo`) are still left unresolved so that consumers can apply their own resolution.

- [#&#8203;14316](cloudflare/workers-sdk#14316) [`444b75e`](cloudflare/workers-sdk@444b75e) Thanks [@&#8203;matingathani](https://github.com/matingathani)! - Prevent `wrangler dev` crash when source-mapping a truncated error chunk

  When a worker logs many errors in quick succession, the stderr chunks received by `wrangler dev` can be truncated mid-stack-frame, leaving a call site with an invalid column number. The source map library throws in that case, which was crashing the wrangler process entirely. The error is now caught and the original (un-source-mapped) text is returned instead.

- [#&#8203;14118](cloudflare/workers-sdk#14118) [`b38823f`](cloudflare/workers-sdk@b38823f) Thanks [@&#8203;aicayzer](https://github.com/aicayzer)! - Fix `Uint8Array` step outputs in local Workflows being persisted with the full backing `ArrayBuffer`

  A `Uint8Array` returned from a Workflows step under `wrangler dev` was serialised together with its full underlying `ArrayBuffer`, causing a raw `SQLITE_TOOBIG` error at view sizes well below the documented 1MiB step-output limit. For example, a 200KB view sliced from an 800KB buffer (a common pattern from `crypto.getRandomValues` or `arr.slice(...)` on a larger pool) would fail. The view's bytes are now copied to a tight buffer before persistence, bringing local behaviour in line with production. Fixes [#&#8203;14101](cloudflare/workers-sdk#14101).

- Updated dependencies \[[`b38823f`](cloudflare/workers-sdk@b38823f)]:
  - miniflare\@&#8203;4.20260617.1

</details>

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDYuMSIsInVwZGF0ZWRJblZlciI6IjQzLjI0Ni4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/25

Correct an issue when there are two alerts with the same properties issued at the same time.  Previously we used the event name and issue date; now let's use event id and issue date as a unique identifier.  This corrects a svelte for_each issue when two alerts have the same index. Basically add the upstream index to keep alerts unique.

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/26

It seems to clamp down in certain cases which isn't desireable.

Co-authored-by: Justin Settle <jus10@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/27

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMyIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4zIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/28

This PR contains the following updates:

| Update | Change |
|---|---|
| lockFileMaintenance | All locks refreshed |

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

### Configuration

📅 **Schedule**: (in timezone America/New_York)

- Branch creation
  - Between 12:00 AM and 03:59 AM, only on Monday (`* 0-3 * * 1`)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzIuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI3Mi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: jquagga-renovate <renovate@partlycloudy.org>
Reviewed-on: https://codeberg.org/jquagga/swa/pulls/34