chore: update dependencies

[dobby-coder]

Security vulnerabilities (fix first)

CVE / Advisory	Package	Sub-project	Severity	Current	Fixed in
GHSA-fx2h-pf6j-xcff	vite	pg-sveltekit	high	8.0.14	>=8.1.0
GHSA-v6wh-96g9-6wx3	vite (launch-editor)	pg-sveltekit	high	8.0.14	>=8.1.0
GHSA-96hv-2xvq-fx4p	ws (via webpack-dev-server)	pg-manual	high	ws 8.x (<8.21.0)	ws >=8.21.0 (via webpack-dev-server >=5.2.5)
GHSA-mx8g-39q3-5c79	webpack-dev-server	pg-manual	moderate	5.2.4	>=5.2.5
GHSA-v6wh-96g9-6wx3	launch-editor (via webpack-dev-server)	pg-manual	moderate	<=2.14.0	>=2.14.1 (via webpack-dev-server >=5.2.5)
GHSA-64mm-vxmg-q3vj	http-proxy-middleware (via webpack-dev-server)	pg-manual	moderate	<2.0.10	>=2.0.10 (via webpack-dev-server >=5.2.5)

Outdated packages

Package	Sub-project	Current	Latest	Bump type	Notes
@e4a/pg-js	pg-sveltekit, pg-node	1.10.0	2.1.0	major	runtime dep; review changelog before bumping
@sveltejs/kit	pg-sveltekit	2.61.1	2.68.0	minor	devDependency
svelte	pg-sveltekit	5.55.9	5.56.4	patch	devDependency
svelte-check	pg-sveltekit	4.4.8	4.7.1	minor	devDependency
vite	pg-sveltekit	8.0.14	8.1.0	minor	also fixes high CVEs above
typescript-eslint	pg-sveltekit	8.59.4	8.62.1	patch	devDependency
eslint	pg-sveltekit	10.4.0	10.6.0	minor	devDependency
eslint-plugin-svelte	pg-sveltekit	3.17.1	3.20.0	minor	devDependency
prettier	pg-sveltekit	3.8.3	3.9.3	minor	devDependency
prettier-plugin-svelte	pg-sveltekit	4.0.1	4.1.1	minor	devDependency
globals	pg-sveltekit	17.6.0	17.7.0	patch	devDependency
@types/node	pg-sveltekit	25.9.1	26.0.1	major	devDependency
webpack-dev-server	pg-manual	5.2.4	5.2.5	patch	also fixes moderate CVEs above
webpack	pg-manual	5.107.1	5.108.3	minor	devDependency
webpack-cli	pg-manual	7.0.2	7.1.0	minor	devDependency
@privacybydesign/yivi-popup	pg-manual	1.0.1	1.0.2	patch	devDependency

Worker instructions

1. CVEs first — address all security advisories in a single PR:

   • pg-sveltekit: bump vite to ^8.1.0 (fixes GHSA-fx2h-pf6j-xcff + GHSA-v6wh-96g9-6wx3)
   • pg-manual: bump webpack-dev-server to ^5.2.5 (fixes GHSA-mx8g-39q3-5c79, GHSA-96hv-2xvq-fx4p, GHSA-v6wh-96g9-6wx3, GHSA-64mm-vxmg-q3vj transitively)
   • Run npm audit in each dir to confirm 0 high/critical remain; open PR ready (not draft), reviewer rubenhensen, body must include Closes #<this issue> on its own line, and note: "no CI build gate, please review manually"

2. Minor/patch batch (second PR after CVE PR merges): all remaining minor and patch bumps above except @types/node and @e4a/pg-js

3. Major bumps individually (separate PRs):

   • @e4a/pg-js 1.10.0 → 2.1.0 in both pg-sveltekit and pg-node (review changelog; runtime dep)
   • @types/node 25.x → 26.x in pg-sveltekit (devDependency, lower risk)

Build after each batch; no CI build gate on this repo — reviewer must verify manually.

[dobby-coder]

/dobby

[dobby-coder]

Dobby looked at this but isn't routing it anywhere: Event is a bare /dobby command from the bot itself with no actionable content or flag If that's wrong, ping Dobby again or be explicit with /dobby review, /dobby fix, or /dobby ask.

[dobby-coder]

Dobby looked at this but isn't routing it anywhere: Bot comment from dobby-coder itself with no actionable content — pure noise. If that's wrong, ping Dobby again or be explicit with /dobby review, /dobby fix, or /dobby ask.

[dobby-coder]

/dobby fix — Resolve the dependency updates in this issue: apply the security bumps first (vite, ws, and any other flagged CVEs) then the remaining outdated packages, following the table and worker instructions in the issue body. Run the build/tests for each affected sub-project and open a draft PR.

[dobby-coder]

On it! I'''ll update the dependencies and open a draft PR for this, then loop through review/fixes before marking it ready for review.

[dobby-coder]

All green on PR #62 — I ran the gatekeeper check (dep CVE fixes + minor/patch bumps) and found no code or build issues. The only real gap was a missing reviewer, so I fixed that inline and assigned @rubenhensen per your request in #61. Verified the cookie/uuid overrides are intact and the ws/http-proxy-middleware/launch-editor CVE fixes are in place (majors left deferred as before). Submitted my sign-off as a review comment (GitHub won't let me self-approve) and flipped the PR out of draft — ready for review here.