build(deps): bump the bun group across 1 directory with 28 updates

[dependabot]

Bumps the bun group with 28 updates in the / directory:

Package	From	To
@capacitor/core	8.2.0	8.3.4
i18next	25.8.18	26.1.0
lodash-es	4.17.23	4.18.1
lucide	0.575.0	1.16.0
semver	7.7.4	7.8.0
svelte	5.53.11	5.55.5
ts-essentials	10.1.1	10.2.0
@changesets/cli	2.30.0	2.31.0
@commitlint/cli	20.4.4	21.0.1
@commitlint/config-conventional	20.4.4	21.0.1
@eslint/compat	2.0.3	2.1.0
@types/node	25.5.0	25.8.0
esbuild	0.27.4	0.28.0
esbuild-node-externals	1.20.1	1.22.0
esbuild-svelte	0.9.4	0.9.5
eslint	10.0.3	10.3.0
eslint-plugin-svelte	3.15.2	3.17.1
globals	17.4.0	17.6.0
happy-dom	20.8.4	20.9.0
lint-staged	16.3.3	17.0.4
markdownlint-cli2	0.21.0	0.22.1
prettier	3.8.1	3.8.3
prettier-plugin-svelte	3.5.1	3.5.2
typescript	5.9.3	6.0.3
typescript-eslint	8.57.0	8.59.3
vitest	4.1.0	4.1.6
which	6.0.1	7.0.0
yaml	2.8.2	2.9.0

Updates @capacitor/core from 8.2.0 to 8.3.4

Release notes

Sourced from @​capacitor/core's releases.

8.3.4

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)
• cli: add system framework and weak framework support in SPM Package.swift (#8447) (3232f0f)
• cli: correct Capacitor plugin SPM compat check (#8440) (e5ccc45)
• cli: generate binaryTarget entries for custom xcframeworks in Package.swift (#8445) (1f7e33f)
• cli: generate resource entries in Package.swift (#8455) (790bd27)
• cli: handle Cordova plugins without iOS source files (#8443) (0da130e)
• cli: link plugin dependencies in Package.swift (#8457) (b3c769e)
• ios: support Cordova plugins with Package.swift (#8438) (139943b)
• SystemBars: avoid extra view padding on API <= 34 (#8439) (5b135a7)

8.3.1

8.3.1 (2026-04-16)

Bug Fixes

• android: handle null versionName in isNewBinary() (#8397) (aa1a660)
• boundary value extraction for form-data requests (#7518) (64ab854)
• cli: check CAPACITOR_COCOAPODS_PATH in determinePackageManager (#8407) (acb64ab)
• system-bars: use separate current styles (#8409) (3d1f8d1)

8.3.0

8.3.0 (2026-03-25)

Bug Fixes

• android: correctly parsing server.url when they include paths (#8391) (a9f2181)

... (truncated)

Changelog

Sourced from @​capacitor/core's changelog.

8.3.4 (2026-05-12)

Note: Version bump only for package capacitor

8.3.3 (2026-05-08)

Bug Fixes

• cli: copy plugin files in CocoaPods projects (#8467) (b2d7719)

8.3.2 (2026-05-07)

Bug Fixes

• cli: add cSettings support for compiler flags in generated Package.swift (#8448) (0bd0676)
• cli: add system framework and weak framework support in SPM Package.swift (#8447) (3232f0f)
• cli: correct Capacitor plugin SPM compat check (#8440) (e5ccc45)
• cli: generate binaryTarget entries for custom xcframeworks in Package.swift (#8445) (1f7e33f)
• cli: generate resource entries in Package.swift (#8455) (790bd27)
• cli: handle Cordova plugins without iOS source files (#8443) (0da130e)
• cli: link plugin dependencies in Package.swift (#8457) (b3c769e)
• ios: support Cordova plugins with Package.swift (#8438) (139943b)
• SystemBars: avoid extra view padding on API <= 34 (#8439) (5b135a7)

8.3.1 (2026-04-16)

Bug Fixes

• android: handle null versionName in isNewBinary() (#8397) (aa1a660)
• boundary value extraction for form-data requests (#7518) (64ab854)
• cli: check CAPACITOR_COCOAPODS_PATH in determinePackageManager (#8407) (acb64ab)
• system-bars: use separate current styles (#8409) (3d1f8d1)

8.3.0 (2026-03-25)

Bug Fixes

• android: correctly parsing server.url when they include paths (#8391) (a9f2181)
• cli: inline CSS sourcemaps in addition to JS sourcemaps (#8377) (69476ab)
• http: handle URL objects on fetch (#8386) (003099a)
• ios: make getArray accesible on Objective-C plugins (#8392) (afb80f2)
• SystemBars: use native safe area insets on Android (#8384) (4e99598)

Features

• cli: Experimental config for swift-tools-version in SPM apps (#8372) (d2ee84f)
• cli: support SPM package traits in generated Package.swift (#8351) (27e6aa8)

Commits

• de1e506 Release 8.3.4
• b7e167b chore(cli): update telemetry endpoint (#8464)
• 76ff70e Release 8.3.3
• b2d7719 fix(cli): copy plugin files in CocoaPods projects (#8467)
• 23ad7f8 Release 8.3.2
• b3c769e fix(cli): link plugin dependencies in Package.swift (#8457)
• 560fd84 docs: Update Contributing guide branches (#8425)
• 790bd27 fix(cli): generate resource entries in Package.swift (#8455)
• 1f7e33f fix(cli): generate binaryTarget entries for custom xcframeworks in Package.sw...
• 3232f0f fix(cli): add system framework and weak framework support in SPM Package.swif...
• Additional commits viewable in compare view

Updates i18next from 25.8.18 to 26.1.0

Release notes

Sourced from i18next's releases.

v26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

v26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

v26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

v26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

v26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

v26.0.6

Security release — all issues found via an internal audit. GHSA advisory filed after release.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security docs for mitigation guidance (GHSA-TBD)
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

v26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

v26.0.4

• fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

v26.0.3

• fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

v26.0.2

• fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

v26.0.1

• fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)
• fix: Formatter now returns undefined/null values as-is instead of producing NaN when the value is missing

v26.0.0

This is a major breaking release:

Breaking Changes

• Remove deprecated initImmediate option — the backward-compatibility mapping from initImmediate to initAsync (introduced in v24) has been removed. Use initAsync instead.
• Remove legacy interpolation.format function — the old monolithic format function (interpolation: { format: (value, format, lng) => ... }) is no longer supported. The built-in Formatter (or a custom Formatter module via .use()) is now always used. Migrate to the new formatting approach using i18next.services.formatter.add() or .addCached() for custom formatters.
• Remove console support notice — the console support notice introduced in v25.8.0 has been removed, along with the showSupportNotice option and all related internal suppression logic (globalThis.__i18next_supportNoticeShown, I18NEXT_NO_SUPPORT_NOTICE env var). See our blog post for the full story.
• Remove simplifyPluralSuffix option — this option was unused by the core PluralResolver (which relies entirely on Intl.PluralRules). It only had an effect in the old v1/v2/v3 compatibility layer. The v4 test compatibility layer now defaults to true internally.

... (truncated)

Changelog

Sourced from i18next's changelog.

26.1.0

• feat: enableSelector: 'strict' (TypeOptions + runtime option). Opt-in mode that drops the flattened-primary form from NsResource at the type level — every namespace (primary included) is exposed only under its own key on $, uniformly across single- and multi-ns hooks. At runtime, a leading selector path segment matching the scope's namespace list is always rewritten as a namespace prefix, including the primary. Eliminates the silent-miss surface area where t($ => $.primary.foo) typechecks but doesn't resolve under the default mode (see #2429). Backward-compatible: default enableSelector: false | true | 'optimize' behavior is unchanged. Note: strict mode is incompatible with the #2405 pattern (keys whose names match sibling namespaces) — those users should stay on default mode.

26.0.10

• feat: getFixedT accepts a fourth optional fixedOpts argument carrying scopeNs — the full namespace list the bound t was created for. The selector API uses scopeNs to detect when a path's first segment is a namespace prefix, without changing resolution scope. Resolution still uses the bound ns (a single primary string in the typical react-i18next setup), so plain t('key') lookups stay isolated to the primary namespace exactly as before — only t($ => $.secondaryNs.foo) selectors now route correctly under useTranslation([nsA, nsB]). Fixes the runtime side of #2429 for the react-i18next default-nsMode case. The 4th argument is opt-in: existing 3-arg getFixedT(lng, ns, keyPrefix) callers see no behavior change.

26.0.9

• fix(types): unformatted interpolation values are now typed as string | number (was string). i18next stringifies values at runtime, so requiring callers to wrap numbers in String(...) for plain {{var}} placeholders was unnecessary friction — and could mask the real problem when a non-string value was passed alongside multiple interpolation slots (the t() overload resolution would fall through to the 3-arg form and report a confusing "not assignable to string" error against the options object). Typed format specifiers like {{x, number}}, {{x, currency}}, {{x, datetime}}, etc. keep their precise types; this only relaxes the no-format default. The count variable remains number-only

26.0.8

• fix(types): restore the pre-v25.10.4 ExistsFunction shape so plain arrow functions can again be assigned to ExistsFunction-typed variables (TypeScript cannot infer type predicates through multi-overload assignment). Direct i18next.exists(key) calls still narrow key to SelectorKey — the predicate is now declared inline on i18n.exists. Custom wrappers that want the narrowing can type themselves as typeof i18next.exists 2425

26.0.7

• fix: when a plural lookup misses, the missingKey debug log now shows the actual plural-resolved key (e.g. foo.bar_many for Polish count: 14) instead of the base key — making it obvious which plural category was expected and missing 2423
• chore: drop @babel/runtime runtime dependency. The build no longer generates any @babel/runtime imports, so the package is unused by consumers. Rollup now uses babelHelpers: 'bundled' so any helpers that are ever needed in the future will be inlined rather than imported externally 2424
• chore: stop emitting dist/esm/i18next.bundled.js. It was byte-identical to dist/esm/i18next.js because no helpers were being imported 2424

26.0.6

Security release — all issues found via an internal audit.

• security: warn when a translation string combines escapeValue: false with interpolated variables inside a $t(key, { ... "{{var}}" ... }) nesting-options block. In that narrow combination, attacker-controlled string values containing " can break out of the JSON options literal and inject additional nesting options (e.g. redirect lng/ns). The default escapeValue: true configuration is unaffected because HTML-escaping neutralises the quote before JSON.parse. See the security note in the Nesting docs for the full pattern and mitigations
• security: apply regexEscape to unescapePrefix / unescapeSuffix on par with the other interpolation delimiters. Prevents ReDoS (catastrophic-backtracking) when a misconfigured delimiter contains regex metacharacters, and fixes silent breakage of the {{- var}} syntax when the delimiter contains characters like (, [, .
• security: strip CR/LF/NUL and other C0/C1 control characters from string log arguments to prevent log forging via user-controlled translation keys, language codes, namespaces, or interpolation variable names (CWE-117)
• chore: ignore .env* and *.pem/*.key files in .gitignore

26.0.5

• fix: cloneInstance().changeLanguage() no longer fails to update language state when the target language is not yet loaded — a race between init()'s deferred load() and the user's changeLanguage() could overwrite isLanguageChangingTo, causing setLngProps to be skipped 2422

26.0.4

• fix(types): inline formatting options like {{price, currency(EUR)}} are now correctly resolved to their base format type (e.g. number for currency) instead of falling back to string 2378

26.0.3

• fix(types): addResourceBundle now accepts an optional 6th options parameter ({ silent?: boolean; skipCopy?: boolean }) matching the runtime API 2419

26.0.2

• fix(types): t("key", {} as TOptions) no longer produces a type error — the context constraint now bypasses strict checking when context is unknown (e.g. from TOptions) 2418

26.0.1

• fix: Formatter no longer crashes when alwaysFormat is true and no format specifier is present (format is undefined)

... (truncated)

Commits

• 5af0475 26.1.0
• 85c0951 feat: enableSelector: 'strict' — explicit-ns selector mode, no flattened prim...
• 8fec684 docs(types): clarify ExistsFunction note re: narrowing through wrappers
• 61eaf5b 26.0.10
• 47fd92f feat: getFixedT 4th-arg scopeNs decouples selector ns-detection from resoluti...
• caf33f6 26.0.9
• eed0146 fix(types): relax unformatted interpolation values to string | number
• 170fb0a Modernize locize.com URLs and refresh UTM tags
• 3ea438f 26.0.8
• 5176bbd retry version bump
• Additional commits viewable in compare view

Updates lodash-es from 4.17.23 to 4.18.1

Release notes

Sourced from lodash-es's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates lucide from 0.575.0 to 1.16.0

Release notes

Sourced from lucide's releases.

Version 1.16.0

What's Changed

• feat(icons): added blender icon by @​rrod497 in lucide-icons/lucide#3884

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

Version 1.15.0

What's Changed

• fix: remove 'less' from brand stopwords by @​jguddas in lucide-icons/lucide#4331
• fix(@​lucide/vue): Clone slots before passing to icon by @​axtho in lucide-icons/lucide#4339
• fix(icons): changed text-cursor icon by @​jamiemlaw in lucide-icons/lucide#4340
• fix(icons): changed landmark icon by @​jamiemlaw in lucide-icons/lucide#4334
• chore(deps-dev): bump nitropack from 2.13.1 to 2.13.4 by @​dependabot[bot] in lucide-icons/lucide#4352
• chore(deps-dev): bump simple-git from 3.33.0 to 3.36.0 by @​dependabot[bot] in lucide-icons/lucide#4349
• fix(icons): changed candy-cane icon by @​jguddas in lucide-icons/lucide#4148
• fix(icons): changed volleyball icon by @​jamiemlaw in lucide-icons/lucide#4338
• fix(icons): changed chart-no-axes-combined icon by @​jguddas in lucide-icons/lucide#3567
• feat(icon): added broccoli icon by @​swastik7805 in lucide-icons/lucide#4263
• chore(site): Updates to site and updated carbon ads by @​ericfennis in lucide-icons/lucide#4359
• feat(icons): added sticky note variants by @​Barakudum in lucide-icons/lucide#4348
• chore(deps-dev): bump astro from 6.1.6 to 6.1.10 by @​dependabot[bot] in lucide-icons/lucide#4361

New Contributors

• @​axtho made their first contribution in lucide-icons/lucide#4339
• @​Barakudum made their first contribution in lucide-icons/lucide#4348

Full Changelog: lucide-icons/lucide@1.14.0...1.15.0

Version 1.14.0

What's Changed

• feat(icons): added repeat-off icon by @​jguddas in lucide-icons/lucide#3102

Full Changelog: lucide-icons/lucide@1.13.0...1.14.0

Version 1.13.0

What's Changed

• fix(docs): sync URL params with UI state on categories page by @​taimar in lucide-icons/lucide#4111
• feat(icons): add waves-vertical icon by @​jamiemlaw in lucide-icons/lucide#3867

Full Changelog: lucide-icons/lucide@1.12.0...1.13.0

Version 1.12.0

What's Changed

• feat(icon): add folder-bookmark icon by @​swastik7805 in lucide-icons/lucide#4262
• docs(readme): Update readme files by @​ericfennis in lucide-icons/lucide#4320
• feat(icons): added astroid icon by @​whoisBugsbunny in lucide-icons/lucide#4217

... (truncated)

Commits

• 07c885e fix(docs): fix zephyr-cloud URL in readmes
• 50d8af5 docs(readme): Update readme files (#4320)
• 653e44b feat(packages): use .mjs for ESM bundles (#4285)
• 7623e23 feat(docs): add Zephyr Cloud to Hero Backers tier & rework updateSponsors scr...
• 484f2c9 docs(version-1): Version 1 website (#4142)
• a0e202d feat(packages/angular): add new @​lucide/angular package (#3897)
• f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
• See full diff in compare view

Updates semver from 7.7.4 to 7.8.0

Release notes

Sourced from semver's releases.

v7.8.0

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

Changelog

Sourced from semver's changelog.

7.8.0 (2026-05-08)

Features

• 0d0a0a2 #855 Add truncate function (#855) (@​pjohnmeyer, @​owlstronaut)

Bug Fixes

• 3905343 #859 Warn when defaulting to --inc=patch in CLI (@​pjohnmeyer)

Documentation

• c368af6 #853 fix typos in documentation (#853) (@​ankitkumar572005)
• 37776c3 #846 fix BNF grammar to distinguish prerelease from build identifiers (#846) (@​abhu85, @​claude)

Chores

• 9542e09 #860 template-oss-apply (@​owlstronaut)
• 937bc2c #860 template-oss-apply@5.0.0 (@​owlstronaut)
• 6946fef #852 bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852) (@​dependabot[bot], @​npm-cli-bot)

Commits

• efa4be6 chore: release 7.8.0 (#847)
• 9542e09 chore: template-oss-apply
• 937bc2c chore: template-oss-apply@5.0.0
• 3905343 fix: Warn when defaulting to --inc=patch in CLI
• 0d0a0a2 feat: Add truncate function (#855)
• c368af6 docs: fix typos in documentation (#853)
• 6946fef chore: bump @​npmcli/template-oss from 4.29.0 to 4.30.0 (#852)
• 37776c3 docs: fix BNF grammar to distinguish prerelease from build identifiers (#846)
• See full diff in compare view

Updates svelte from 5.53.11 to 5.55.5

Release notes

Sourced from svelte's releases.

svelte@5.55.5

Patch Changes

• fix: don't mark deriveds while an effect is updating (#18124)

• fix: do not dispatch introstart event with animation of animate directive (#18122)

svelte@5.55.4

Patch Changes

• fix: never mark a child effect root as inert (#18111)

• fix: reset context after waiting on blockers of @const expressions (#18100)

• fix: keep flushing new eager effects (#18102)

svelte@5.55.3

Patch Changes

• fix: ensure proper HMR updates for dynamic components (#18079)

• fix: correctly calculate @const blockers (#18039)

• fix: freeze deriveds once their containing effects are destroyed (#17921)

• fix: defer error boundary rendering in forks (#18076)

• fix: avoid false positives for reactivity loss warning (#18088)

svelte@5.55.2

Patch Changes

• fix: invalidate @const tags based on visible references in legacy mode (#18041)

• fix: handle parens in template expressions more robustly (#18075)

• fix: disallow -- in idPrefix (#18038)

• fix: correct types for ontoggle on <details> elements (#18063)

• fix: don't override $destroy/set/on instance methods in dev mode (#18034)

• fix: unskip branches of earlier batches after commit (#18048)

• fix: never set derived.v inside fork (#18037)

• fix: skip rebase logic in non-async mode (#18040)

• fix: don't reset status of uninitialized deriveds (#18054)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.55.5

Patch Changes

• fix: don't mark deriveds while an effect is updating (#18124)

• fix: do not dispatch introstart event with animation of animate directive (#18122)

5.55.4

Patch Changes

• fix: never mark a child effect root as inert (#18111)

• fix: reset context after waiting on blockers of @const expressions (#18100)

• fix: keep flushi...

  Description has been truncated