[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: @microsoft/api-extractor, nuxt, preact and svelte.

Updates @microsoft/api-extractor from 7.59.4 to 7.60.0

Changelog

Sourced from @​microsoft/api-extractor's changelog.

7.60.0

Tue, 27 Oct 2026 00:20:25 GMT

Minor changes

• Upgrade the bundled compiler engine to TypeScript 6.0.3

Commits

• See full diff in compare view

Updates nuxt from 4.6.2 to 4.6.3

Release notes

Sourced from nuxt's releases.

v4.6.3

v4.6.3 is the next patch release.

👉 Changelog

compare changes

🚨 Security fixes

• vite: do not read files named in client error reports (63299e13c) - GHSA-x287-wcfc-q46c
• vite: deny dev server access to nitro dev output (c7e204ec6) - GHSA-648h-gw55-m2g7
• vite: deny serving generated app secret in dev (16dfdc2a9) - GHSA-3xf4-9g3c-4h4w
• nitro,nuxt: handle dot segments in request paths (440250d97) - GHSA-9v7c-q64q-vv33
• nuxt: apply redirect route rules to page islands (b20372dbe) - GHSA-2fxj-c3j7-rr69

🔥 Performance

• vite: skip compiling plain style blocks in the server build (#36711)
• nitro,nuxt,rspack,webpack: bundle esm vue + reuse caches (#36710)
• vite: avoid quadratic nested dir check for fs.allow (#36702)
• nuxt: server render internal custom links without RouterLink (#36707)
• nuxt: skip unneeded typed routes generation (#36645)

🩹 Fixes

• nitro: don't share prerender hints with self-fetched requests (#36705)
• nuxt: defer app scope cleanup on external navigation (#36713)
• nuxt: prevent useCookie CookieStore sync from rewriting with refresh (#36673)
• nuxt: only return redirects from navigateTo while middleware runs (#36650)
• nuxt: remove purged entries from _asyncData (#36709)
• vite: skip quoted import.meta keys + limit replace to client dev (#36703)
• nuxt: hide RouteLocationRaw from navigateTo's public return type (#36691)
• nuxt: tree-shake auto-imported #app composables (#36696)
• nuxt: don't treat constrained route rules as covering dynamic pages (#36701)
• nuxt: include shared/ in build cache hash (#36704)
• nuxt: hash keyed function ids + page import names relative to rootDir (#36697)
• nuxt: encode page paths before matching route rule keys (#36683)
• nuxt: handle rejected updateCallbackDone of aborted view transition (#36639)
• ui-templates: keep loading shader proportions on narrow screens (#36654)
• nuxt: reject case-dependent route rule constraints w/ sensitive: false (#36708)
• nuxt: don't case-fold regex constraints in route rule keys (#36694)
• nuxt: normalise page prefix when finding route rule exceptions (#36685)
• vite: mirror ssr invalidations for created and deleted files (634cba64c)
• nitro: keep noScripts wildcard patterns single-segment (fa323db7d)
• deps: update unrouting to v0.3.1 (#36663)
• nuxt: avoid self-referencing nuxt/schema augmentation (#36633)
• nuxt: let nightly runtime resolve its own nuxt/* imports (#36632)
• nuxt: don't warn for vite+ vite.config files (#36628)

... (truncated)

Commits

• 1b09d0c v4.6.3 (#36651)
• 4fd54ff test: list NUXT_B4023 as main-only
• 45463f8 fix(nitro,nuxt): handle dot segments in request paths
• 57da2ae fix(nuxt): apply redirect route rules to page islands
• c655a32 fix(nuxt): defer app scope cleanup on external navigation (#36713)
• e2179ce fix(nuxt): prevent useCookie CookieStore sync from rewriting with refresh (#3...
• f818b2e fix(nuxt): only return redirects from navigateTo while middleware runs (#36...
• f5ae355 perf(nitro,nuxt,rspack,webpack): bundle esm vue + reuse caches (#36710)
• 6761ca2 fix(nuxt): remove purged entries from _asyncData (#36709)
• 8ef5ede fix(nuxt): hide RouteLocationRaw from navigateTo's public return type (#36691)
• Additional commits viewable in compare view

Updates preact from 11.1.0 to 11.0.2

Release notes

Sourced from preact's releases.

11.0.2

Fixes

• Keep queued components updating and finish act() cleanup after an uncaught render error (#5265, thanks @​JoviDeCroock)
• Correct the browser ESM entry point for preact/compat/server (#5304, thanks @​rschristian)
• Retain deferred hydration ranges through suspension, resumption, and unmounting (#5315, thanks @​JoviDeCroock)
• Leave non-plain style objects untouched in compat, preserving string-valued signal styles (#5318, thanks @​JoviDeCroock)
• Prevent duplicate DOM after an uncaught render error (#5328, thanks @​brevin-aq and @​JoviDeCroock)

Types

• Improve accessibility discriminated unions for dynamic input and select props (#5311, thanks @​rschristian)
• Make accessible element attribute types the default (#5312, thanks @​rschristian)
• Correct createRef nullability and remove its default any type (#5326, thanks @​rschristian)

Performance

• Reduce core diff bundle size (#5316, thanks @​JoviDeCroock)
• Trim core scheduling and DOM bookkeeping (#5317, thanks @​JoviDeCroock)
• Reduce core bundle size (#5319, thanks @​JoviDeCroock)

Maintenance

• Add a Drydock badge and remove the broken Brotli badge (#5307, thanks @​JoviDeCroock)

Commits

• ba2598a Let setStyle default removed style values
• 3532483 Decide error boundaries once in _catchError
• b13a013 Merge pull request #5315 from preactjs/JoviDeCroock/streamed-range-ownership
• e4c2527 Merge branch 'main' into JoviDeCroock/streamed-range-ownership
• f1e2327 Golf: collect a pending range's nodes through rangeEnd() on unmount
• bd05a02 Merge pull request #5318 from preactjs/JoviDeCroock/compat-signal-style
• 9301dc0 Only append px to plain style objects in compat
• 17196e5 Merge branch 'main' into JoviDeCroock/streamed-range-ownership
• e736c2d Merge pull request #5265 from preactjs/JoviDeCroock/rerender-queue-throw
• 76aaf5a Merge branch 'main' into JoviDeCroock/rerender-queue-throw
• Additional commits viewable in compare view

Updates svelte from 5.57.2 to 5.57.3

Release notes

Sourced from svelte's releases.

svelte@5.57.3

Patch Changes

• fix: use the first valid fallback role in role for a11y checks (#19045)

• chore: remove obsolete code (#19051)

• fix: keep creating state sources for property checks during component init (#18949)

• fix: skip redundant attribute writes during hydration (#18869)

• fix: track missing state property checks in unowned deriveds (#18944)

• fix: devalue link in hydratable_serialization_failed error (#18999)

Changelog

Sourced from svelte's changelog.

5.57.3

Patch Changes

• fix: use the first valid fallback role in role for a11y checks (#19045)

• chore: remove obsolete code (#19051)

• fix: keep creating state sources for property checks during component init (#18949)

• fix: skip redundant attribute writes during hydration (#18869)

• fix: track missing state property checks in unowned deriveds (#18944)

• fix: devalue link in hydratable_serialization_failed error (#18999)

Commits

• 23bb146 Version Packages (#18947)
• 356c876 chore: better async derived labels (#19068)
• 3c032ad chore: DRY out batch intersection logic (#19061)
• 5bd3e3c chore: add new batch.#is_skipped method (#19058)
• 91b5110 fix: use the first valid fallback role in role for a11y checks (#19045)
• 50e3d28 chore: remove obsolete code (#19051)
• bd762fb fix: skip redundant attribute writes during hydration (#18869)
• 40bb084 chore: more passing async tests (#19014)
• a841a29 chore: bring over passing async-eager tests (#19011)
• 4473857 chore: bring over more tests that already pass on main (#19007)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6718ba92-2a9f-48d7-ae5a-a61455277df9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}