[dependabot]

Bumps the npm-development-minor-patch group with 5 updates:

Package	From	To
obsidian-e2e	0.14.0	0.15.0
oxfmt	0.74.0	0.75.0
oxlint	1.89.0	1.90.0
postcss	8.5.31	8.5.32
svelte	5.57.2	5.57.3

Updates obsidian-e2e from 0.14.0 to 0.15.0

Release notes

Sourced from obsidian-e2e's releases.

v0.15.0

Breaking changes

• The optional vitest peer is now ^5.0.0 (was >=3). The matcher typings augment Vitest 5's Assertion, so older Vitest versions silently lost type checking on expect(). The vitest/suite fallback for Vitest < 4.1 is removed. (#49)
• Node 22.12 or later is required (was ^20.19.0 || >=22.12.0). Node 20 is end of life, and Vitest 5 requires 22.12. (#49)

Minor changes

• The yaml dependency now requires 2.9.1 or later. 2.9.1 counts aliases resolved through merge keys against maxAliasCount (default 100), so frontmatter that leans very heavily on merge keys can now throw "Excessive alias count". (#49)
• Every dependency, the package manager and the GitHub Actions are upgraded as part of a supply-chain sweep. yaml is still the only runtime dependency. (#49)

Upgrading

Move to Vitest 5 and Node 22.12 or later, then bump obsidian-e2e to ^0.15.0 and reinstall.

Commits

• e994a0c chore: version packages (#50)
• 0ec3855 chore: upgrade every dependency for the October 2026 security sweep (#49)
• See full diff in compare view

Updates oxfmt from 0.74.0 to 0.75.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.75.0

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• See full diff in compare view

Updates oxlint from 1.89.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• See full diff in compare view

Updates postcss from 8.5.31 to 8.5.32

Release notes

Sourced from postcss's releases.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Changelog

Sourced from postcss's changelog.

8.5.32

• Fixed Input#origin() without opts.from (by @​wleeaf).
• Fixed final-word lookup without source offsets (by @​Don-Yin).
• Fixed explicit start in Warning#toString() (by @​Don-Yin).
• Fixed Promise semantics in LazyResult#finally() (by @​Don-Yin).

Commits

• 2455ac8 Release 8.5.32 version
• e367106 Update dependencies
• f70f586 Fix Input#origin() without from or with relative sourceRoot (#2179)
• eb28619 Fix final-word lookup without source offsets (#2178)
• 095654b Preserve explicit start in Warning#toString() (#2177)
• 9b3d8b8 Preserve Promise semantics in result finally() (#2176)
• See full diff in compare view

Updates svelte from 5.57.2 to 5.57.3

Release notes

Sourced from svelte's releases.

svelte@5.57.3

Patch Changes

• fix: use the first valid fallback role in role for a11y checks (#19045)

• chore: remove obsolete code (#19051)

• fix: keep creating state sources for property checks during component init (#18949)

• fix: skip redundant attribute writes during hydration (#18869)

• fix: track missing state property checks in unowned deriveds (#18944)

• fix: devalue link in hydratable_serialization_failed error (#18999)

Changelog

Sourced from svelte's changelog.

5.57.3

Patch Changes

• fix: use the first valid fallback role in role for a11y checks (#19045)

• chore: remove obsolete code (#19051)

• fix: keep creating state sources for property checks during component init (#18949)

• fix: skip redundant attribute writes during hydration (#18869)

• fix: track missing state property checks in unowned deriveds (#18944)

• fix: devalue link in hydratable_serialization_failed error (#18999)

Commits

• 23bb146 Version Packages (#18947)
• 356c876 chore: better async derived labels (#19068)
• 3c032ad chore: DRY out batch intersection logic (#19061)
• 5bd3e3c chore: add new batch.#is_skipped method (#19058)
• 91b5110 fix: use the first valid fallback role in role for a11y checks (#19045)
• 50e3d28 chore: remove obsolete code (#19051)
• bd762fb fix: skip redundant attribute writes during hydration (#18869)
• 40bb084 chore: more passing async tests (#19014)
• a841a29 chore: bring over passing async-eager tests (#19011)
• 4473857 chore: bring over more tests that already pass on main (#19007)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying podnotes with    Cloudflare Pages

Latest commit:	3281e6b
Status:	✅  Deploy successful!
Preview URL:	https://a23706de.podnotes.pages.dev
Branch Preview URL:	https://dependabot-npm-and-yarn-npm-hssw.podnotes.pages.dev

View logs

[cursor]

Dependabot build(deps-dev) group bump. Diff is package.json + package-lock.json only (native @oxfmt / @oxlint bindings plus the five requested packages). Title will not cut a release.

Package	From	To	Notes
obsidian-e2e	0.14.0	0.15.0	Documented breaks already satisfied: Vitest peer ^5 (repo is ^5.0.5), Node >=22.12 (.nvmrc is 22.23.4). yaml stays 2.9.1. Harness exports used by tests/e2e/harness.ts (createPluginHarness, lock helpers, client/sandbox) are unchanged.
oxfmt	0.74.0	0.75.0	Formatter bugfixes / display-width heuristics. format:check 450 files clean.
oxlint	1.89.0	1.90.0	New Oxlintrc type export and type-aware no-unsafe-enum-assignment unused (.oxlintrc.json is categories.correctness + hand-picked rules, no tsgolint). lint --deny-warnings clean.
postcss	8.5.31	8.5.32	Patch (Input#origin, warning/LazyResult fixes). Build-time only.
svelte	5.57.2	5.57.3	Patch (a11y role fallback, state-source init, skip redundant hydration attribute writes). Compiles into main.js; production still one CJS bundle (require("obsidian") / module.exports).

Local (Node 22.23.4): npm ci frozen; lint, format:check, typecheck, build, size (318892 raw / 103371 gzip, 629 remaining), svelte-check, test (128 files / 2826), test:tooling (7 / 47) all pass. npm audit --omit=dev 0. Remaining full-audit lows/moderates (deepmerge, minimatch via eslint-plugin-obsidianmd) are pre-existing and not from this bump.

GitHub: Test (lint, unit, svelte/tooling, build/sizes), Docs, Validate PR title, Dependency Review, Platforms (macOS + Windows), and Cloudflare Pages are green. CodeQL is neutral/skip on this lockfile-only SHA (configurations not found), same as #528.

Obsidian E2E not required: lint/typecheck/build passed, and obsidian-e2e 0.15.0 does not change the harness APIs PodNotes uses.

Approving and squash-merging.

  

_{Sent by Cursor Automation: Dependabot PRs}