[dependabot]

Bumps the production-dependencies group with 12 updates in the / directory:

Package	From	To
@napi-rs/simple-git	1.1.0	1.2.0
isomorphic-git	1.42.2	1.44.3
preact	10.29.8	11.0.1
preact-render-to-string	6.7.0	6.8.1
pretty-bytes	7.1.3	7.2.0
sharp	0.35.4	0.35.5
ws	8.21.3	8.22.0
@types/ws	8.18.1	8.18.2
yargs	18.1.0	18.2.0
@types/node	26.5.1	26.6.5
@types/ws	8.18.1	8.18.2
prettier	3.9.6	3.9.10
tsx	4.23.13	4.23.15

Updates @napi-rs/simple-git from 1.1.0 to 1.2.0

Commits

• 0cdb713 1.2.0
• 6b4bb97 chore(deps): upgrade @​napi-rs/cli to ^3.10.4 and regenerate bindings (#169)
• 070f312 feat: add diffBuffers, TreeBuilder, diffTreeToTree, findBlob and Diff.toPatch...
• a4ac3d2 fix(deps): update void to v0.10.13 (#166)
• ba11abe chore(deps): update cross-platform-actions/action action to v1.5.0 (#165)
• d38ce7d chore(deps): update cross-platform-actions/action action to v1.4.0 (#164)
• 3986d54 fix(deps): update void to v0.10.12 (#163)
• 28a312a chore(deps): lock file maintenance (#162)
• 8de48ea fix(deps): update void to v0.10.11 (#161)
• 4d58fa1 chore(deps): update yarn to v4.18.0 (#160)
• Additional commits viewable in compare view

Updates isomorphic-git from 1.42.2 to 1.44.3

Release notes

Sourced from isomorphic-git's releases.

v1.44.3

1.44.3 (2026-10-17)

Bug Fixes

• rethrow read and readdir errors other than file-not-found (#2461) (2e87526)

v1.44.2

1.44.2 (2026-10-12)

Bug Fixes

• preserve Pako decompression errors when reading objects (#2451) (b75230a)

v1.44.1

1.44.1 (2026-10-12)

Bug Fixes

• return absent from status for case-mismatched paths on case-insensitive filesystems (#2454) (c8f4687)

v1.44.0

1.44.0 (2026-10-12)

Features

• log: add author filter (#2456) (c5916f4)

v1.43.3

1.43.3 (2026-10-09)

Bug Fixes

• verify each packfile checksum once under concurrent reads (#2453) (909b97b)

v1.43.2

1.43.2 (2026-10-08)

Bug Fixes

• parse config variable names with digits and tabs around the equal sign (#2452) (90c5773)

v1.43.1

1.43.1 (2026-10-06)

... (truncated)

Commits

• 2e87526 fix: rethrow read and readdir errors other than file-not-found (#2461)
• b75230a fix: preserve Pako decompression errors when reading objects (#2451)
• c8f4687 fix: return absent from status for case-mismatched paths on case-insensitive ...
• c5916f4 feat(log): add author filter (#2456)
• 909b97b fix: verify each packfile checksum once under concurrent reads (#2453)
• 90c5773 fix: parse config variable names with digits and tabs around the equal sign (...
• ed2af40 fix: peel annotated tags to commits in checkout, branch, merge and commit (#2...
• 563848e feat(remove): accept an array of filepaths (#2449)
• 149de87 fix: write the index once per walk instead of once per file (#2448)
• 431453f fix: refuse to cherry-pick over local changes (#2444)
• Additional commits viewable in compare view

Updates preact from 10.29.8 to 11.0.1

Release notes

Sourced from preact's releases.

11.0.1

Fixes

• Keep suspended hydration within a component's own $s range (#5300, thanks @​JoviDeCroock)
• Keep ref cleanups on the element instead of the ref function (#5290, thanks @​JoviDeCroock)
• Unmount parked Suspense children when the boundary unmounts (#5295, thanks @​gengjiawen)

DX

• Log the component stack of errors no boundary handles (#5297, thanks @​JoviDeCroock)

Performance

• Key event listeners by prop name and stamp attach times per listener (#5272, thanks @​JoviDeCroock)

Maintenance

• Change repository field to object format (#5292, thanks @​piotr-cz)
• Fix the types of preact/compat/server and preact/compat/scheduler (#5282, thanks @​JoviDeCroock)

11.0.0

https://preactjs.com/blog/preact-11

Read the upgrade-guide over at https://preactjs.com/guide/v11/upgrade-guide

All other release notes can be seen at

• https://github.com/preactjs/preact/releases/tag/11.0.0-rc.2
• https://github.com/preactjs/preact/releases/tag/11.0.0-rc.1
• https://github.com/preactjs/preact/releases/tag/11.0.0-rc.0
• https://github.com/preactjs/preact/releases/tag/11.0.0-beta.2
• https://github.com/preactjs/preact/releases/tag/11.0.0-beta.1
• https://github.com/preactjs/preact/releases/tag/11.0.0-beta.0

Fixes

• Re-attach refs when a suspended subtree reveals (#5258, thanks @​JoviDeCroock)
• Map imageRendering to image-rendering (#5270, thanks @​kwy404)
• Append when the insertion reference node lives in another container (#5252, thanks @​JoviDeCroock)
• Only drop the insertion cursor when it's detached (#5273, thanks @​JoviDeCroock)
• Fall back to the global document for containers without an ownerDocument (#5274, thanks @​JoviDeCroock)
• Check for moveBefore() on the container instead of globally (#5275, thanks @​JoviDeCroock)
• Fix resuming into the DOM kept while a component was suspended (#5276, thanks @​JoviDeCroock)
• Stop DOM nesting validation at portal boundaries (#5277, thanks @​JoviDeCroock)
• Preserve the casing of camelCase custom event names (#5278, thanks @​JoviDeCroock)

Performance

• Remove cloneNode for top-level Fragments (#5271, thanks @​JoviDeCroock)

... (truncated)

Commits

• 04074e2 Merge pull request #5302 from preactjs/11.0.1
• 231d163 11.0.1
• f6c09df Merge pull request #5300 from preactjs/JoviDeCroock/suspense-hydration-siblin...
• 67a88d5 Keep suspended hydration within a component's own $s range
• f9facd3 Merge pull request #5297 from preactjs/JoviDeCroock/debug-uncaught-component-...
• e984524 Merge branch 'main' into JoviDeCroock/debug-uncaught-component-stack
• 5fd81d2 Merge pull request #5272 from preactjs/perf/event-listener-keys
• 66f38b7 Keep listener attach times outside _listeners
• 74e6239 Stamp the attach time per listener instead of per handler
• 7ed4fac Skip event name normalization when swapping handlers
• Additional commits viewable in compare view

Updates preact-render-to-string from 6.7.0 to 6.8.1

Release notes

Sourced from preact-render-to-string's releases.

v6.8.1

Patch Changes

• #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

Changelog

Sourced from preact-render-to-string's changelog.

6.8.1

Patch Changes

• #482 a4b9e49 Thanks @​JoviDeCroock! - Encode attribute values after string coercion so arrays and objects are serialized consistently with string attributes.

6.8.0

Minor Changes

• #472 2dff53d Thanks @​jacob-ebey! - Replaces the second context argument in our streaming functions with an options object, the context moves to the third position.

  Streaming is considered alpha so we're making this breaking change deliberately as part of a minor.

Patch Changes

• #464 455daf5 Thanks @​JoviDeCroock! - Call options._root before the render-to-string invocation

• #475 4e92059 Thanks @​JoviDeCroock! - Use Node's Writable type for renderToPipeableStream destinations.

• #444 e5ff19f Thanks @​dsherret! - fix: use cjs types instead of esm for jsx export to fix default export from esm

• #477 4b80672 Thanks @​JoviDeCroock! - Preserve client-rendered content when delayed streaming chunks arrive after hydration.

• #471 0ce2b84 Thanks @​JoviDeCroock! - Keep Preact option hooks isolated for the lifetime of asynchronous renders.

• #476 5b1d509 Thanks @​JoviDeCroock! - Replace streamed Suspense fallbacks when the resolved content is empty.

Commits

• 0519dc8 Merge pull request #483 from preactjs/changeset-release/main
• 7277e10 Version Packages
• 75291f2 Merge pull request #482 from preactjs/fix/escape-coerced-attribute-values
• a4b9e49 fix: encode attribute values after string coercion
• 55804f3 Merge pull request #481 from preactjs/fix/release-tag-git-identity
• 085ec2e fix: don't create a local git tag when staging a release
• 601e6c8 Merge pull request #465 from preactjs/changeset-release/main
• 1c9c381 Version Packages
• f26bd8c Merge pull request #479 from preactjs/fix/changesets-format
• 3ecaa75 Fix Changesets release formatting
• Additional commits viewable in compare view

Updates pretty-bytes from 7.1.3 to 7.2.0

Release notes

Sourced from pretty-bytes's releases.

v7.2.0

• Fix formatting edge cases and validate options 4e800a3

---

sindresorhus/pretty-bytes@v7.1.3...v7.2.0

Commits

• a35ed21 7.2.0
• 4e800a3 Fix formatting edge cases and validate options
• 1d517bb Meta tweaks
• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates ws from 8.21.3 to 8.22.0

Release notes

Sourced from ws's releases.

8.22.0

Features

• Introduced the protocols option (8b918b01).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the state to WebSocket.CLOSING (#2337).

Commits

• 297202c [dist] 8.22.0
• 8b918b0 [feature] Introduce the protocols option
• 73e03eb [ci] Update actions/setup-node action to v7
• d9b8954 [fix] Change the ready state after validating the arguments (#2337)
• See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

• See full diff in compare view

Updates yargs from 18.1.0 to 18.2.0

Changelog

Sourced from yargs's changelog.

18.2.0 (2026-09-20)

Features

• support creating completions for fish shell (#2568) (34d833a)

Bug Fixes

• completion: remove spurious single-quote in zsh loadautofunc detection (#2548) (224e285)

Commits

• e49b60a chore(main): release 18.2.0 (#2569)
• 3ed7095 Set up staged trusted publishing, and remove stale deno workflow (#2591)
• 224e285 fix(completion): remove spurious single-quote in zsh loadautofunc detection (...
• fb9c055 Add SECURITY.md
• 2a4378b Add FUNDING.yml with funding sources
• 34d833a feat: support creating completions for fish shell (#2568)
• 3a49608 Remove copy-pasted email address (#2566)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for yargs since your current version.

Updates @types/node from 26.5.1 to 26.6.5

Commits

• See full diff in compare view

Updates @types/ws from 8.18.1 to 8.18.2

Commits

• See full diff in compare view

Updates prettier from 3.9.6 to 3.9.10

Release notes

Sourced from prettier's releases.

3.9.10

• Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

🔗 Changelog

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.10

diff

Markdown: Update micromark-extension-gfm-table to fix the table parse issue on performance (#20266 by @​fisker)

See micromark/micromark-extension-gfm-table@4f43ead for details.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

... (truncated)

Commits

• 1172b82 Release 3.9.10
• d014227 Update micromark-extension-gfm-table to fix the table parse issue on perfor...
• 953b908 Bump Prettier dependency to 3.9.9
• ad8a6bf Clean changelog_unreleased
• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml