chore(deps): bump the npm-version-updates group across 1 directory with 22 updates

[dependabot]

Bumps the npm-version-updates group with 21 updates in the / directory:

Package	From	To
@zitadel/sveltekit-auth	1.1.5	1.1.6
openid-client	6.8.4	6.8.8
@commitlint/config-conventional	20.5.3	21.2.2
@eslint/compat	1.4.1	2.1.1
@eslint/js	9.39.4	10.0.1
@playwright/test	1.61.1	1.63.0
@sveltejs/adapter-auto	6.1.1	7.0.1
@sveltejs/vite-plugin-svelte	7.1.2	7.3.0
@tailwindcss/vite	4.3.1	4.3.3
@types/node	22.20.0	26.5.1
eslint	9.39.4	10.10.0
eslint-plugin-svelte	3.19.0	3.23.0
globals	16.5.0	17.12.0
knip	5.88.1	6.35.1
prettier	3.8.4	3.9.6
prettier-plugin-tailwindcss	0.8.0	0.8.1
svelte	5.56.4	5.57.0
svelte-check	4.7.1	4.7.6
typescript	5.9.3	7.0.2
typescript-eslint	8.62.0	8.70.0
vite	8.1.0	8.3.0

Updates @zitadel/sveltekit-auth from 1.1.5 to 1.1.6

Release notes

Sourced from @​zitadel/sveltekit-auth's releases.

v1.1.6

1.1.6 (2026-09-10)

Bug Fixes

• deps: resolve npm audit vulnerabilities (8bcb3b7)

Commits

• cd21804 chore(release): 1.1.6 [skip ci]
• 8bcb3b7 fix(deps): resolve npm audit vulnerabilities
• See full diff in compare view

Updates openid-client from 6.8.4 to 6.8.8

Release notes

Sourced from openid-client's releases.

v6.8.8

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

v6.8.7

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

v6.8.6

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

v6.8.5

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Changelog

Sourced from openid-client's changelog.

6.8.8 (2026-09-05)

Fixes

• apply the default HTTP request timeout (af32783)
• calculate token lifetimes using elapsed time (e816bf0)
• isolate lazy client authentication handler caches (d687796)
• passport: handle rejected async verification callbacks (d730f80)
• preserve clock settings across DCR nonce retries (5433d68)
• release: separate changelog sections (57fcbc6)
• retain polling abort signals through response processing (b26170e)
• select a unique decryption key when kid is omitted (10ba026)

Refactor

• share grant polling lifecycle and retry handling (b931c40)

6.8.7 (2026-08-20)

Fixes

• allow destructuring the claims helper (38bd8c0), references #887

6.8.6 (2026-08-18)

Fixes

• avoid undefined user-agent in fetchProtectedResource (492c3c3), references #885

6.8.5 (2026-08-11)

Fixes

• types: expose custom fetch duplex option (a125bc8)
• types: use portable oauth4webapi declarations (2cab98f)

Documentation

• improve API index tables (c6e4ae3)
• update README.md and SECURITY.md to reflect passed EOL dates (d3721c2)

Commits

• 04c5982 chore(release): 6.8.8
• 5eccf2e chore: bump packages
• d730f80 fix(passport): handle rejected async verification callbacks
• b931c40 refactor: share grant polling lifecycle and retry handling
• d687796 fix: isolate lazy client authentication handler caches
• e816bf0 fix: calculate token lifetimes using elapsed time
• 10ba026 fix: select a unique decryption key when kid is omitted
• b26170e fix: retain polling abort signals through response processing
• af32783 fix: apply the default HTTP request timeout
• 5433d68 fix: preserve clock settings across DCR nonce retries
• Additional commits viewable in compare view

Updates @commitlint/config-conventional from 20.5.3 to 21.2.2

Release notes

Sourced from @​commitlint/config-conventional's releases.

v21.2.2

21.2.2 (2026-08-13)

Bug Fixes

• parse: require colon after note keywords (conventional-commits-parser 7.1.2) (#4927) (b83c515), closes conventional-changelog/conventional-changelog#1517
• fix(container): resolve packages from TypeScript configs by @​Guflly in conventional-changelog/commitlint#4914
• fix(resolve-extends): support Yarn Plug'n'Play by @​Guflly in conventional-changelog/commitlint#4933

Chore, docs, etc.

• docs: fix typos in comments and JSDoc by @​maxtaran2010 in conventional-changelog/commitlint#4880
• docs: fix Deno setup without package.json by @​awnoa in conventional-changelog/commitlint#4896
• chore: repair broken lockfile from #4939 and add merge queue CI support by @​escapedcat in conventional-changelog/commitlint#4941
• docs(config-conventional): document rules that go beyond the spec by @​escapedcat in conventional-changelog/commitlint#4910

New Contributors

• @​maxtaran2010 made their first contribution in conventional-changelog/commitlint#4880
• @​awnoa made their first contribution in conventional-changelog/commitlint#4896
• @​Guflly made their first contribution in conventional-changelog/commitlint#4914

Full Changelog: conventional-changelog/commitlint@v21.2.1...v21.2.2

v21.2.1

21.2.0 (2026-06-30)

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

Chore, doc, etc.

• chore(read): replace deprecated git-raw-commits with git-client by @​igordanchenko in conventional-changelog/commitlint#4860
• docs(issue-template): ask for package manager and version by @​escapedcat in conventional-changelog/commitlint#4867

New Contributors

• @​igordanchenko made their first contribution in conventional-changelog/commitlint#4860

Full Changelog: conventional-changelog/commitlint@v21.2.0...v21.2.1

v21.2.0

21.2.0 (2026-06-30)

... (truncated)

Changelog

Sourced from @​commitlint/config-conventional's changelog.

21.2.2 (2026-08-13)

Note: Version bump only for package @​commitlint/config-conventional

21.2.0 (2026-06-30)

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#4859) (fdb566f)

21.1.0 (2026-06-23)

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

21.0.0 (2026-05-08)

• chore!: minimum node version v22 (#4679) (ac2b3f4), closes #4679

BREAKING CHANGES

... (truncated)

Commits

• d00d190 v21.2.2
• 3146d04 docs(config-conventional): document rules that go beyond the spec (#4910)
• f2e8dae chore: update dependency typescript to v7 (#4886)
• 1b4e5bc v21.2.0
• fdb566f feat(resolve-extends): resolve pure-ESM presets (conventional-changelog v7/v9...
• 6f1c0af v21.1.0
• 8069048 v21.0.2
• db8d7d6 v21.0.1
• 1329a25 chore: migrate to pnpm (#4762)
• 6099ae5 chore: replace eslint with oxlint (#4756)
• Additional commits viewable in compare view

Updates @eslint/compat from 1.4.1 to 2.1.1

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.1

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

compat: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

migrate-config: v2.1.0

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/config-helpers bumped from ^0.5.5 to ^0.6.0

migrate-config: v2.0.7

2.0.7 (2026-05-01)

Bug Fixes

• update espree to the latest (#437) (a8ff72f)

migrate-config: v2.0.6

2.0.6 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/compat bumped from ^2.0.4 to ^2.0.5
  • devDependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

... (truncated)

Changelog

Sourced from @​eslint/compat's changelog.

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

2.1.0 (2026-05-08)

Features

• Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

2.0.5 (2026-04-08)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.2.0 to ^1.2.1

2.0.4 (2026-04-03)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.1 to ^1.2.0

2.0.3 (2026-03-06)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​eslint/core bumped from ^1.1.0 to ^1.1.1

2.0.2 (2026-01-29)

Bug Fixes

• add eslint 10 as peer dependency (#361) (ecb37dc)

Dependencies

... (truncated)

Commits

• a4466ca chore: release main (#504)
• 714ffde docs: Update README sponsors
• 66d9790 fix: preserve markVariableAsUsed return value in compat context (#503)
• caffae7 docs: Update README sponsors
• ae1ba25 docs: Update README sponsors
• 50051c6 docs: Update README sponsors
• ea83524 docs: Update README sponsors
• 29956ae docs: Update README sponsors
• f6d5bdf docs: Update README sponsors
• 8b71ed3 chore: restore eslint-plugin-jsdoc rules (#316)
• Additional commits viewable in compare view

Updates @eslint/js from 9.39.4 to 10.0.1

Release notes

Sourced from @​eslint/js's releases.

v10.0.1

Bug Fixes

• c87d5bd fix: update eslint (#20531) (renovate[bot])
• d841001 fix: update minimatch to 10.2.1 to address security vulnerabilities (#20519) (루밀LuMir)
• 04c2147 fix: update error message for unused suppressions (#20496) (fnx)
• 38b089c fix: update dependency @​eslint/config-array to ^0.23.1 (#20484) (renovate[bot])

Documentation

• 5b3dbce docs: add AI acknowledgement section to templates (#20431) (루밀LuMir)
• 6f23076 docs: toggle nav in no-JS mode (#20476) (Tanuj Kanti)
• b69cfb3 docs: Update README (GitHub Actions Bot)

Chores

• e5c281f chore: updates for v9.39.3 release (Jenkins)
• 8c3832a chore: update @​typescript-eslint/parser to ^8.56.0 (#20514) (Milos Djermanovic)
• 8330d23 test: add tests for config-api (#20493) (Milos Djermanovic)
• 37d6e91 chore: remove eslint v10 prereleases from eslint-config-eslint deps (#20494) (Milos Djermanovic)
• da7cd0e refactor: cleanup error message templates (#20479) (Francesco Trotta)
• 84fb885 chore: package.json update for @​eslint/js release (Jenkins)
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467) (Milos Djermanovic)

v10.0.0

Breaking Changes

• f9e54f4 feat!: estimate rule-tester failure location (#20420) (ST-DDT)
• a176319 feat!: replace chalk with styleText and add color to ResultsMeta (#20227) (루밀LuMir)
• c7046e6 feat!: enable JSX reference tracking (#20152) (Pixel998)
• fa31a60 feat!: add name to configs (#20015) (Kirk Waiblinger)
• 3383e7e fix!: remove deprecated SourceCode methods (#20137) (Pixel998)
• 501abd0 feat!: update dependency minimatch to v10 (#20246) (renovate[bot])
• ca4d3b4 fix!: stricter rule tester assertions for valid test cases (#20125) (唯然)
• 96512a6 fix!: Remove deprecated rule context methods (#20086) (Nicholas C. Zakas)
• c69fdac feat!: remove eslintrc support (#20037) (Francesco Trotta)
• 208b5cc feat!: Use ScopeManager#addGlobals() (#20132) (Milos Djermanovic)
• a2ee188 fix!: add uniqueItems: true in no-invalid-regexp option (#20155) (Tanuj Kanti)
• a89059d feat!: Program range span entire source text (#20133) (Pixel998)
• 39a6424 fix!: assert 'text' is a string across all RuleFixer methods (#20082) (Pixel998)
• f28fbf8 fix!: Deprecate "always" and "as-needed" options of the radix rule (#20223) (Milos Djermanovic)
• aa3fb2b fix!: tighten func-names schema (#20119) (Pixel998)
• f6c0ed0 feat!: report eslint-env comments as errors (#20128) (Francesco Trotta)
• 4bf739f fix!: remove deprecated LintMessage#nodeType and TestCaseError#type (#20096) (Pixel998)
• 523c076 feat!: drop support for jiti < 2.2.0 (#20016) (michael faith)
• 454a292 feat!: update eslint:recommended configuration (#20210) (Pixel998)
• 4f880ee feat!: remove v10_* and inactive unstable_* flags (#20225) (sethamus)
• f18115c feat!: no-shadow-restricted-names report globalThis by default (#20027) (sethamus)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160) (Milos Djermanovic)

Features

• bff9091 feat: handle Array.fromAsync in array-callback-return (#20457) (Francesco Trotta)
• 290c594 feat: add self to no-implied-eval rule (#20468) (sethamus)
• 43677de feat: fix handling of function and class expression names in no-shadow (#20432) (Milos Djermanovic)

... (truncated)

Commits

• 84fb885 chore: package.json update for @​eslint/js release
• 1f66734 chore: add eslint to peerDependencies of @eslint/js (#20467)
• f3fbc2f chore: set @eslint/js version to 10.0.0 to skip releasing it (#20466)
• b4b3127 chore: package.json update for @​eslint/js release
• 0b14059 chore: package.json update for @​eslint/js release
• fa31a60 feat!: add name to configs (#20015)
• 1e2cad5 chore: package.json update for @​eslint/js release
• 454a292 feat!: update eslint:recommended configuration (#20210)
• c6358c3 feat!: Require Node.js ^20.19.0 || ^22.13.0 || >=24 (#20160)
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @sveltejs/adapter-auto from 6.1.1 to 7.0.1

Changelog

Sourced from @​sveltejs/adapter-auto's changelog.

7.0.1

Patch Changes

• feat: update adapter-netlify to version 6 (77ab341)

7.0.0

Major Changes

• feat: update adapter-vercel to version 6 (#14737)

Commits

• c727a90 Version Packages (#15309)
• 77ab341 feat: update adapter-netlify to version 6
• 1d2be12 chore: update suggestion message (#15165)
• 0da365a chore(deps): update vitest monorepo to v4 (major) (#14789)
• 6f13d2b Version Packages (#14738)
• c710a39 breaking: update to adapter-vercel to version 6 (#14737)
• See full diff in compare view

Updates @sveltejs/vite-plugin-svelte from 7.1.2 to 7.3.0

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.3.0

Minor Changes

• feat: pass environment to dynamicCompileOptions (#1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#1376)

@​sveltejs/vite-plugin-svelte@​7.2.0

Minor Changes

• feat(inspector): add a context menu with current component stack (#1370)

@​sveltejs/vite-plugin-svelte@​7.1.4

Patch Changes

• fix: enforce ltr styles for inspector (#1324)

@​sveltejs/vite-plugin-svelte@​7.1.3

Patch Changes

• fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.3.0

Minor Changes

• feat: pass environment to dynamicCompileOptions (#1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#1376)

7.2.0

Minor Changes

• feat(inspector): add a context menu with current component stack (#1370)

7.1.4

Patch Changes

• fix: enforce ltr styles for inspector (#1324)

7.1.3

Patch Changes

• fix: ensure the inspector is injected into the client correctly for Vite+ projects (#1355)

Commits

• e6a89fc Version Packages (#1377)
• 2eeef7e feat: pass environment to dynamicCompileOptions (#1386)
• f92b24a fix(deps): update dependency magic-string to v1 (#1381)
• d3d4052 fix: don't log inline config when encountering unexpected options (#1376)
• c9feef6 chore: add type annotations to Inspector.svelte (#1372)
• 02981fd Version Packages (#1371)
• 4158aa2 feat: context menu with component stack (#1370)
• c867a3a Version Packages (#1368)
• dbdb255 fix: inspector rtl host styles (#1324)
• 694bc95 chore(deps): update dependency typescript to v6 (#1315)
• Additional commits viewable in compare view

Updates @tailwindcss/vite from 4.3.1 to 4.3.3

Release notes

Sourced from @​tailwindcss/vite's releases.

v4.3.3

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#20336)

v4.3.2

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#20289)

Changelog

Sourced from @​tailwindcss/vite's changelog.

[4.3.3] - 2026-07-16

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#20299)
• Ensure fractional opacit...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.