deps: bump the development-dependencies group with 9 updates

[dependabot]

Bumps the development-dependencies group with 9 updates:

Package	From	To
@angular/core	22.1.0	22.1.4
esbuild	0.28.1	0.28.2
preact	10.29.7	10.29.8
solid-js	1.9.14	1.9.15
svelte	5.56.8	5.56.10
terser	5.49.0	5.51.2
vite	8.2.0	8.2.2
vitest	4.1.10	4.1.11
vue	3.5.40	3.5.42

Updates @angular/core from 22.1.0 to 22.1.4

Release notes

Sourced from @​angular/core's releases.

22.1.4

common

Commit	Description
	avoid prototype member collisions
	use locale NaN symbol in number formatting

compiler

Commit	Description
	scope animations declared in minified nested rules

compiler-cli

Commit	Description
	default template diagnostic related message source file to template
	Produce correct tcb expression for optional chaining
	retain metadata for strict standalone errors

core

Commit	Description
	avoid prototype member collisions
	explicitly reject foreign components in JIT mode
	preserve namespace for dynamic component hosts
	prevent TransferState prototype pollution
	throw coded RuntimeErrors instead of crashing when hydration/rendering can't find an expected DOM node

forms

Commit	Description
	use dot-access for readonly rule configuration

language-service

Commit	Description
	honor quote style preference when generating imports

migrations

Commit	Description
	preserve registerLocaleData calls in standalone bootstrap migration

platform-server

Commit	Description
	avoid stripping unicode whitespace during url resolution

22.1.3

animations

Commit	Description
	detect object trigger values with Object.hasOwn

common

Commit	Description
	preserve literal key union in KeyValuePipe.transform()

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

22.1.4 (2026-08-26)

common

Commit	Type	Description
60a874c3fb	fix	avoid prototype member collisions
e8378dfeab	fix	use locale NaN symbol in number formatting

compiler

Commit	Type	Description
05c7c725a5	fix	scope animations declared in minified nested rules

compiler-cli

Commit	Type	Description
afe8499a14	fix	default template diagnostic related message source file to template
079a846263	fix	Produce correct tcb expression for optional chaining
55eeb46418	fix	retain metadata for strict standalone errors

core

Commit	Type	Description
3da35cbab9	fix	avoid prototype member collisions
b199bdfa2a	fix	explicitly reject foreign components in JIT mode
9a8e4826b9	fix	preserve namespace for dynamic component hosts
7c752d4815	fix	prevent TransferState prototype pollution
7546b7a805	fix	throw coded RuntimeErrors instead of crashing when hydration/rendering can't find an expected DOM node

forms

Commit	Type	Description
c8eb7f0056	fix	use dot-access for readonly rule configuration

language-service

Commit	Type	Description
93d7f718d2	fix	honor quote style preference when generating imports

migrations

Commit	Type	Description
85c8829ac1	fix	preserve registerLocaleData calls in standalone bootstrap migration

platform-server

Commit	Type	Description
71e52d1396	fix	avoid stripping unicode whitespace during url resolution

22.1.3 (2026-08-19)

animations

Commit	Type	Description
d9620e0f1b	fix	detect object trigger values with Object.hasOwn

common

... (truncated)

Commits

• 9bf7113 build: update cross-repo angular dependencies
• 151a8f2 refactor(core): Decouple ɵɵFactoryDeclaration and ɵɵInjectableDeclaration fro...
• b199bdf fix(core): explicitly reject foreign components in JIT mode
• 7546b7a fix(core): throw coded RuntimeErrors instead of crashing when hydration/rende...
• 7c752d4 fix(core): prevent TransferState prototype pollution
• f58f5fd refactor(core): loosen return type of ɵɵFactoryDeclaration to any
• 85c8829 fix(migrations): preserve registerLocaleData calls in standalone bootstrap mi...
• 9a8e482 fix(core): preserve namespace for dynamic component hosts
• 3da35cb fix(core): avoid prototype member collisions
• 7709f2c refactor(core): widen ɵɵclassProp value parameter type to any
• Additional commits viewable in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

• Fix tree shaking bug due to TypeScript import alias (#4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x

... (truncated)

Commits

• 609683d publish 0.28.2 to npm
• 11b1fe4 add to release notes
• ab50d91 css: fix green/blue channel swap in oklch gamut mapping (#4488)
• 04627b6 fix #4498: async TLA checks need a worklist
• 5c15177 disable gopls in the go folder
• fc2ee9b css: adjust parser to allow --foo: {...}
• 209db54 release notes for css nesting bugfix
• c625d31 fix #4497: preserve nested ampersands during minification (#4500)
• 34474e2 better isolation of current part in js parser
• 07f6e8c fix #4507: import assignment tree-shaking bug
• Additional commits viewable in compare view

Updates preact from 10.29.7 to 10.29.8

Release notes

Sourced from preact's releases.

10.29.8

Performance

• Batch updates in flushSync (#5173, thanks @​JoviDeCroock)
• Avoid traversing retained subtrees (#5182, thanks @​JoviDeCroock)

Commits

• 389c7bc Merge pull request #5189 from preactjs/10.29.8
• 39edabf 10.29.8
• f27f3ec Merge pull request #5173 from preactjs/flush-sync-batch
• 84778ce Merge pull request #5182 from preactjs/perf/v10-retained-subtree-bailout
• 8623721 Golf retained-subtree bailout
• 1ab8135 Optimize retained subtree bailouts
• 3393c0b Batch updates in flushSync
• See full diff in compare view

Updates solid-js from 1.9.14 to 1.9.15

Commits

• See full diff in compare view

Updates svelte from 5.56.8 to 5.56.10

Release notes

Sourced from svelte's releases.

svelte@5.56.10

Patch Changes

• fix: preserve CSS escape sequences when printing selectors (#18667)

• fix: parse :nth-child(2n of.foo) where of is not followed by whitespace (#18611)

• fix: transform expressions inside labeled statements during server compilation (#18617)

• docs: clarify that context lookup includes the current component and all ancestors (#18581)

• fix: apply CSS custom properties with falsy values on components (#18634)

• fix: correctly print {#await ... catch x} et al (#18645)

• fix: ignore comments of Program node during migration script (#18656)

• fix: reliably resolve append_style to its correct root (#18614)

• fix: clean up removed capture event handlers from spread attributes (#18618)

• fix: don't corrupt renderer type during SSR's legacy bind: retry loop (#18616)

• fix: treat concise arrow function bodies as implicit returns when calculating blockers (#18613)

• fix: give effect teardowns the value from before the first write in a flush (#18620)

• fix: avoid double-calling a derived reference when destructuring $derived of another $derived during server-side rendering (#18668)

• fix: preserve namespaces in CSS type selectors (#18678)

• fix: increment private state fields through a non-this receiver (#18622)

• chore: deduplicate client and server context helpers (#18580)

• fix: release last_propagated_event after event propagation settles so it no longer retains the last event's target subtree (#18569)

• fix: allow custom elements to receive async values as props (#18661)

• fix: strip comments from inline style values in linear time (#18553)

• fix: prevent declaration comments from breaking server derived references (#18641)

• perf: make async blocker analysis scale linearly with the number of top-level references (#18549)

• fix: preserve short-circuiting for logical assignments to private state fields (#18594)

svelte@5.56.9

Patch Changes

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.10

Patch Changes

• fix: preserve CSS escape sequences when printing selectors (#18667)

• fix: parse :nth-child(2n of.foo) where of is not followed by whitespace (#18611)

• fix: transform expressions inside labeled statements during server compilation (#18617)

• docs: clarify that context lookup includes the current component and all ancestors (#18581)

• fix: apply CSS custom properties with falsy values on components (#18634)

• fix: correctly print {#await ... catch x} et al (#18645)

• fix: ignore comments of Program node during migration script (#18656)

• fix: reliably resolve append_style to its correct root (#18614)

• fix: clean up removed capture event handlers from spread attributes (#18618)

• fix: don't corrupt renderer type during SSR's legacy bind: retry loop (#18616)

• fix: treat concise arrow function bodies as implicit returns when calculating blockers (#18613)

• fix: give effect teardowns the value from before the first write in a flush (#18620)

• fix: avoid double-calling a derived reference when destructuring $derived of another $derived during server-side rendering (#18668)

• fix: preserve namespaces in CSS type selectors (#18678)

• fix: increment private state fields through a non-this receiver (#18622)

• chore: deduplicate client and server context helpers (#18580)

• fix: release last_propagated_event after event propagation settles so it no longer retains the last event's target subtree (#18569)

• fix: allow custom elements to receive async values as props (#18661)

• fix: strip comments from inline style values in linear time (#18553)

• fix: prevent declaration comments from breaking server derived references (#18641)

• perf: make async blocker analysis scale linearly with the number of top-level references (#18549)

• fix: preserve short-circuiting for logical assignments to private state fields (#18594)

5.56.9

... (truncated)

Commits

• 56a036f Version Packages (#18640)
• 545205b perf: make async blocker analysis linear (#18549)
• 950e2a8 fix: strip comments from inline style values in linear time (#18553)
• ffc0e6e fix: release last_propagated_event after event propagation settles (#18569)
• 2f684fe docs: clarify that context lookup includes the current component and all ance...
• 3feb34a chore: deduplicate client/server context helpers (#18580)
• 24130c1 fix: parse nth-child of syntax without whitespace after of (#18611)
• a166761 fix: treat concise arrow function bodies as implicit returns when calculating...
• a4c60cc fix: append_styles resolving to document.head in WC (#18614)
• ee1249b fix: preserve renderer type in copy() during SSR (#18616)
• Additional commits viewable in compare view

Updates terser from 5.49.0 to 5.51.2

Changelog

Sourced from terser's changelog.

v5.51.2

• Roll back fix for ambiguously scoped default args, due to issues that came up without clear reproduction

v5.51.1

• Fix transforming code in dynamic import argument.

v5.51.0

• Pin (deoptimize) functions that use argnames scope in ambiguous way. IE when default args access other args, or variables outside the function.
• Fix nullish coalescing ?? operator being considered a "boolean operator" sometimes causing booleans to be generated in its left side.

v5.50.0

• Experimental TypeScript type stripping
• Fixed a crash in mozilla AST conversion of imports

v5.49.2

• Fixed a crash related to dynamic import expressions

v5.49.1

• Correctly parenthesize tagged template strings where the tag is new something(), which also has parentheses
• Internally changed how import() expression is parsed, it is no longer treated as a function call.

Commits

• 317f449 5.51.2
• de65694 update changelog
• 053a8f3 roll back previous fix for ambiguously scoped default args
• c2bd471 5.51.1
• 791888f update changelog
• 49168cd fix transforms inside dynamic import() arguments. Closes #1723
• b629819 5.51.0
• e215a08 update changelog
• 18db852 pin (deoptimize) functions that use argnames scope in an ambiguous way. Close...
• 9fc8a85 fix nullish coalescing operator being considered boolean
• Additional commits viewable in compare view

Updates vite from 8.2.0 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

• deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

• bundled-dev: handle lazy request error (#23291) (3ba026d)
• bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
• config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
• css: don't pass empty targets to lightningcss (#23295) (2804636)
• define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
• deps: update all non-major dependencies (#23217) (ba958bd)
• deps: update rolldown-related dependencies (#23218) (83ecb2c)
• module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
• optimizer: close custom extension analysis bundles (#23207) (8fb7675)
• reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
• respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
• ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
• vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

• build: note cssTarget precedence (#23200) (a20a35e)

Miscellaneous Chores

• fix ts errors in build test cases (#23209) (a0cfcf7)

Code Refactoring

• use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
• use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

• define: close rolldown bundler after generate (#23231) (b4d66fe)
• module-runner: add TLA circular import case (#23299) (4a261f2)
• module-runner: simplify server-hmr tests (#23300) (599b44b)
• ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

• use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)

... (truncated)

Commits

• de1111a release: v8.2.2
• cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
• 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
• 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
• 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
• 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
• 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
• 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
• 599b44b test(module-runner): simplify server-hmr tests (#23300)
• 4a261f2 test(module-runner): add TLA circular import case (#23299)
• Additional commits viewable in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates vue from 3.5.40 to 3.5.42

Release notes

Sourced from vue's releases.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.42 (2026-08-27)

Bug Fixes

• hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
• hydration: handle moving unresolved async fragment (#15263) (a72036f)
• runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
• runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
• runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
• runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
• server-renderer: reject CR in attribute names (#15266) (a2b40db)
• shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
• suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
• v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

3.5.41 (2026-08-05)

Bug Fixes

• compiler-core: preserve vnode lifecycle in stable v-for (#11682) (02421cd), closes #9239 #12569
• compiler-sfc: handle transformed template AST after cache invalidation (#15136) (a4440c0), closes #15126 #15128
• custom-element: preserve nested async mount order (#15154) (71f9ff5), closes #15153
• custom-element: warn when props override native properties (#12125) (22b53ea), closes #12124
• runtime-core: avoid re-fetching resource props with unchanged values (#15105) (a7513a1)
• runtime-core: restore SSR setup state when handling async setup result (#15114) (b6191cb), closes #15113
• scheduler: avoid stack overflow when flushing very large post cb arrays (#15143) (c04a45d), closes #15142
• slots: handle nullish v-bind slot props (#15177) (2506700)
• ssr: normalize hidden states during hydration (#13125) (4e467d7)
• transition: support transition to teleport component child (#11959) (77061fe), closes #11910
• types: preserve defineModel inference with factory defaults (#15097) (0516c43), closes #15096
• v-model: preserve text input before hydration (#14411) (2468464), closes #14403

Commits

• d63616c release: v3.5.42
• b8543dc Revert "fix(compiler-core): handle invalid static arg in same-name v-bind sho...
• 3857716 fix(compiler-core): handle invalid static arg in same-name v-bind shorthand (...
• 31da934 fix(runtime-dom): support !important on CSS custom properties in style bindin...
• f8d42e1 fix(runtime-core): keep .trim result when combined with .number v-model modif...
• cd19745 fix(suspense): don't treat the leaving branch as the fallback while its mount...
• 8654f35 fix(runtime-core): resolve $el for dev root comment fragment (#15313)
• ef82a26 fix(shared): correctly compare Map and Set values (#15328)
• 6eaecc1 fix(v-model): re-sync select when model is overridden in change handler (#15298)
• b535917 fix(runtime-core): avoid caching unmounted suspense children (#15291)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase ...

Description has been truncated