Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@iconify-json/lucide	1.2.115 → 1.2.121
@iconify-json/simple-icons	1.2.88 → 1.2.92
@unocss/preset-icons (source)	66.7.4 → 66.7.5
@unocss/preset-uno (source)	66.7.4 → 66.7.5
@unocss/preset-web-fonts (source)	66.7.4 → 66.7.5
@unocss/reset (source)	66.7.4 → 66.7.5
@unocss/transformer-directives (source)	66.7.4 → 66.7.5
@unocss/vite (source)	66.7.4 → 66.7.5
pnpm (source)	10.34.4 → 10.34.5
prettier (source)	3.9.4 → 3.9.6
prettier-plugin-tailwindcss	0.8.0 → 0.8.1
svelte (source)	5.56.4 → 5.56.8
svelte-check	4.7.1 → 4.7.4
svelte-multiselect (source)	11.7.2 → 11.8.0

---

Release Notes

unocss/unocss (@​unocss/preset-icons)

v66.7.5

Compare Source

   🚀 Features

• preset-wind4: New rule for gap decorations  -  by @​zyyv in #​5241 (30fce)

   🐞 Bug Fixes

• transformer-compile-class: Update explicit shortcuts > Co-authored-by: LevDomasnih resolve #​4926, close #​5239  -  by @​zyyv in #​4926 and #​5239 (b5338)
• transformer-directive: Prehandle properties layer to skip apply css transform  -  by @​zyyv in #​5240 (67220)
• virtual-shared: Remove unnecessary envMode assignment in createContext close #​5243  -  by @​zyyv in #​5243 (d78d3)

    View changes on GitHub

pnpm/pnpm (pnpm)

v10.34.5: pnpm 10.34.5

Compare Source

Patch Changes

• 78e29fe: Prevent a crafted pnpm-lock.yaml from writing package content outside the virtual store. A dependency path key whose name reconstructs to a path-traversal sequence (e.g. ../../../tmp/x@1.0.0) is now rejected by the isolated (virtual-store) linker and the Plug'n'Play resolver map, matching the containment already applied to the hoisted linker. Under the global virtual store, a traversal in the version-derived path segment (e.g. a snapshot version: "../../x") is now rejected at iterateHashedGraphNodes, the single point every global-virtual-store slot path funnels through.
• 78e29fe: Fixed a path traversal vulnerability where a dependency whose manifest name was a scoped path traversal (e.g. @x/../../../<path>) could be written outside node_modules to an attacker-controlled location during pnpm install, even with --ignore-scripts. The isolated linker now validates the package name before using it as a directory name, matching the existing protection in the hoisted linker.
• 47ef6f0: Fixed switching to and self-updating to pnpm v12. pnpm v12 (the Rust port) ships as the pnpm and @pnpm/exe npm packages whose bins are placeholders replaced at install time by the host's native binary from a @pnpm/exe.<platform>-<arch>[-musl] optional dependency. Because pnpm installs its own engine with --ignore-scripts, that relinking never ran, leaving a non-executable placeholder. pnpm now relinks the native binary itself for v12 (recognizing the new platform-package naming scheme and the native pnpm package), and verifies the native binary's npm registry signature before running it.
• 36928be: ${...} environment-variable placeholders in the httpProxy, httpsProxy, noProxy, proxy, and noproxy settings are no longer expanded when these settings come from a project's pnpm-workspace.yaml. They now receive the same protection already applied to registry.

Platinum Sponsors

Gold Sponsors

prettier/prettier (prettier)

v3.9.6

Compare Source

v3.9.5

Compare Source

diff

Markdown: Cap ordered list mark at 999,999,999 (#​19351 by @​tats-u)

CommonMark parsers only support ordered list item numbers up to 999,999,999.

With this change, Prettier now caps the ordered list item number at 999,999,999 to ensure that the output is correctly parsed as an ordered list by CommonMark parsers. Numbers larger than 999,999,999 are not parsed as list item numbers and are left unchanged in the output:

<!-- Input -->
999999998. text
999999998. text
999999998. text
999999998. text

1234567890123456789012) text

<!-- Prettier 3.9.4 -->
999999998. text
999999999. text
1000000000. text
1000000001. text

1234567890123456789012) text

<!-- Prettier 3.9.5 -->
999999998. text
999999999. text
999999999. text
999999999. text

1234567890123456789012) text

Markdown: Avoid corrupting empty link with title (#​19487 by @​andersk)

Do not remove <> from an inline link or image with an empty URL and a title, as this removal would change its interpretation.

<!-- Input -->
[link](<> "title")

<!-- Prettier 3.9.4 -->
[link]( "title")

<!-- Prettier 3.9.5 -->
[link](<> "title")

Less: Remove extra spaces after [ in map lookups (#​19503 by @​kovsu)

// Input
.foo {
  color: #theme[ primary];
  color: #theme[@​name];
  color: #theme[@​@​name];
}

// Prettier 3.9.4
.foo {
  color: #theme[ primary];
  color: #theme[ @​name];
  color: #theme[ @​@​name];
}

// Prettier 3.9.5
.foo {
  color: #theme[primary];
  color: #theme[@​name];
  color: #theme[@​@​name];
}

CSS: Prevent addition space in type() with + (#​19516 by @​bigandy)

This fixes the addition space before + in CSS type() declaration. For example type(<number>+) was being converted into type(<number> +) which is invalid CSS and does not work.

/* Input */
div {
  border-radius: attr(br type(<length>+));
}

/* Prettier 3.9.4 */
div {
  border-radius: attr(br type(<length> +));
}

/* Prettier 3.9.5 */
div {
  border-radius: attr(br type(<length>+));
}

Less: Remove spaces between merge markers and colons (#​19517 by @​kovsu)

// Input
a {
  box-shadow  +  : 0 0 1px #​000;
}

// Prettier 3.9.4
a {
  box-shadow+  : 0 0 1px #​000;
}

// Prettier 3.9.5
a {
  box-shadow+: 0 0 1px #​000;
}

Markdown: Preserve wiki links with aliases (#​19527 by @​kovsu)

<!-- Input -->
[[Foo:Bar]]

<!-- Prettier 3.9.4 -->
[[Foo]]

<!-- Prettier 3.9.5 -->
[[Foo:Bar]]

TypeScript: Fix comments being dropped on shorthand type import/export specifiers (#​19565 by @​kirkwaiblinger)

// Input
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

// Prettier 3.9.4
Error: Comment "comment" was not printed. Please report this error!

// Prettier 3.9.5
export { type /* comment */ T } from "foo";
import { type /* comment */ T } from "foo";

Miscellaneous: Preserving comments' placement property (#​19567 by @​Janther)

Prettier@​3.9.0 deleted an undocumented property on comments, which was already used by plugins, comment.placement is now available again after comment attach.

Flow: Stop enforcing empty module declaration to break (#​19568 by @​fisker)

// Input
declare module "foo" {}

// Prettier 3.9.4
declare module "foo" {
}

// Prettier 3.9.5
declare module "foo" {}

Angular: Support expression for exhaustive typechecking (#​19571 by @​fisker)

<!-- Input -->
@&#8203;switch (state.mode) {
  @&#8203;default never(state);
}

<!-- Prettier 3.9.4 -->
@&#8203;switch (state.mode) {
  @&#8203;default never;
}

<!-- Prettier 3.9.5 -->
@&#8203;switch (state.mode) {
  @&#8203;default never(state);
}

TypeScript: Ignore comments inside mapped type when checking type parameter comments (#​19572 by @​fisker)

// Input
foo<{
  // comment
  [key in keyof Foo]: number
}>();

// Prettier 3.9.4
foo<
  {
    // comment
    [key in keyof Foo]: number;
  }
>();

// Prettier 3.9.5
foo<{
  // comment
  [key in keyof Foo]: number;
}>();

Less: Fix adjacent block comments being corrupted (#​19574 by @​kovsu)

// Input
/* a *//* b */
/* a */* {
  color: red;
}

// Prettier 3.9.4
/* a */
/* b */
/* a * {
  color: red;
}

// Prettier 3.9.5
/* a */ /* b */
/* a */
* {
  color: red;
}

JavaScript: Handle dangling comments in SwitchStatement (#​19581 by @​fisker)

// Input
switch (foo) {
 // comment
}

// Prettier 3.9.4
switch (
  foo
  // comment
) {
}

// Prettier 3.9.5
switch (foo) {
  // comment
}

TypeScript: Remove space in comment-only object type (#​19583 by @​fisker)

// Input
var foo = {
  /* comment */
};
type Foo = {
  /* comment */
};

// Prettier 3.9.4
var foo = {/* comment */};
type Foo = { /* comment */ };

// Prettier 3.9.5
var foo = {/* comment */};
type Foo = {/* comment */};

tailwindlabs/prettier-plugin-tailwindcss (prettier-plugin-tailwindcss)

v0.8.1

Compare Source

Fixed

• Don't remove escape sequences when sorting classes in JavaScript string literals, which could produce invalid code in Vue attribute expressions (#​461)
• Restore class sorting in Svelte markup and dynamic class={...} expressions when using prettier-plugin-svelte v4 (#​462)

sveltejs/svelte (svelte)

v5.56.8

Compare Source

Patch Changes

• fix: call onerror and provide a working reset when hydrating a failed boundary (#​18556)

• fix: preserve select selection when spread attributes omit value (#​18561)

v5.56.7

Compare Source

Patch Changes

• chore: provide indent option for print (#​18474)

v5.56.6

Compare Source

Patch Changes

• perf: skip unnecessary blocker analysis when compiling components without top-level await (#​18548)

• fix: rerun derived that had an abort controller on reconnection (#​18551)

v5.56.5

Compare Source

Patch Changes

• chore: drop dead code that make TSGO fail (#​18496)

• fix: don't (re)connect deriveds when read inside branch/root effects (#​18527)

• fix: skip unnecessary derived effect in earlier batch (#​18525)

• fix: avoid declaration tag warning in event handlers (#​18500)

• fix: abort deriveds own AbortSignal when it disconnects (#​18400)

• fix: ensure $state.eager() is correctly transormed for SSR output (#​18530)

• fix: correctly transform declaration tags during SSR (#​18492)

• fix: transform computed keys in keyed {#each} destructuring patterns (#​18521)

• fix: chain preprocessor sourcemaps with an empty sources[0] instead of dropping them (#​18518)

• fix: clear previous_task reference after abort in Tween to prevent memory leak on interrupted tweens (#​18541)

• fix: don't treat declaration tags as parts inside each blocks (#​18507)

sveltejs/language-tools (svelte-check)

v4.7.4

Compare Source

Patch Changes

• fix: support TypeScript 7 Stable under npm alias (#​3073)

v4.7.3

Compare Source

Patch Changes

• feat: zero-config +error.svelte props (#​3076)

v4.7.2

Compare Source

Patch Changes

• fix: resolve tsgo bin path with package.json (#​3074)

• fix: report tsconfig errors in --tsgo-experimental-api (#​3070)

janosh/svelte-multiselect (svelte-multiselect)

v11.8.0

Compare Source

9 July 2026

• Add async oncreate support: return a Promise (or thenable) to persist user-created options before they're added; spinner + aria-busy while pending, rejections abort the add #427
• Add virtualList prop for windowed dropdown rendering of large flat option lists (tunable itemHeight/overscan) #427
• Add portal placement param: auto (new default) flips the dropdown above the input when it would overflow the viewport bottom #427
• Fix 19 bugs across MultiSelect, attachments, CmdPalette, CodeExample, and heading-anchors, incl. falsy options (0) unselectable via keyboard, foreign drag-drops corrupting selected, keyboard nav escaping maxOptions, group deselect bypassing minSelect, missing IME composition guard, duplicate options crashing the keyed each, sortable destroying header markup, cross-instance tooltip clearing, and Unicode highlight offsets #427
• Give tooltips a visible theme-aware default border and audit the test suite (~58 redundant tests removed, ~50 regression tests added) #427
• Fix schemeless-page tooltip readability and support partial OptionStyle objects #426
• Fix tooltip, focus, and shortcut edge cases #425
• Fix retain-focus dropdown behavior #424
• Clean up Svelte formatting, types, and low-value tests #422
• Simplify Vite/Svelte setup and tighten tests #421

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.