[antonstefer]

Summary

Replaces the open Dependabot security PRs #29, #31, #32, #33, #34, #35, #36 and #37 with one in-range refresh, and adds .github/dependabot.yml so updates stop piling up.

• In-range updates. Every outdated dependency moves to the newest version its range allows, the ranges' floors move up to match, and package-lock.json is regenerated: wrangler 4.78 → 4.156, @sveltejs/kit 2.57 → 2.70, svelte 5.55 → 5.57, vite 8.0 → 8.3, vitest 4.1.2 → 4.1.12, typescript-eslint 8.57 → 8.72 and prettier 3.8 → 3.9. Also updated: svelte-check, eslint-plugin-svelte, svelte-eslint-parser, @sveltejs/vite-plugin-svelte, @sveltejs/adapter-cloudflare 7.2.9, prettier-plugin-svelte 3.5.2, eslint and @types/node. Majors stay out (see below).
• Alerts. This resolves 55 of the 62 open Dependabot alerts. npm audit drops from 22 findings (11 high, 7 moderate, 4 low) to 6 low, and runtime dependencies stay at 0. The undici, sharp and ws alerts could only clear through wrangler: miniflare pins all three exactly, and the miniflare in wrangler 4.156 ships undici 7.30.1, sharp 0.35.5 and ws 8.21.0.
• Lockfile. The old lockfile listed only darwin-arm64 binaries for workerd and sharp. The regenerated one lists every platform again, and records the versions released in chore: release logic-grid 3.0.0 #22 and chore: release logic-grid-ai 2.0.0 #24 (logic-grid 3.0.0, logic-grid-ai 2.0.0).
• Two code-neutral changes in packages/logic-grid, required by the new tooling. typescript-eslint 8.72 flags the two as Category assertions in sliceCategory as unnecessary, and prettier 3.9 puts one union type on a single line.
• .github/dependabot.yml. npm runs weekly from the root, which covers every workspace. GitHub Actions also runs weekly. Each has an open-PR limit of 3.
  • Grouping: dev dependencies' minor and patch updates share one PR, and their security updates share another. Majors get their own PR, in npm and in GitHub Actions. The exception is vitest and @vitest/coverage-v8: coverage-v8 pins its vitest peer exactly, so a vitest-major group moves their majors together.
  • Runtime bumps: these get their own fix(deps) PR, so release-please ships them in a logic-grid-ai release. Today that's only logic-grid-ai's @anthropic-ai/sdk.
  • Hidden commit types: dev bumps use chore(deps-dev) and Actions bumps use ci(deps). release-please-config.json hides both.
  • Ignored majors: the @sveltejs/kit, @sveltejs/adapter-cloudflare and typescript majors are ignored until they're migrated by hand, so they can't fill the open-PR slots. Ignore rules cover security updates too.

New in the lockfile: rollup ≥ 4.64 declares an optional @napi-rs/lzma-linux-x64-gnu. Rollup's code never loads it, it has no install script, and both packages publish with provenance.

Remaining alerts (7, all low)

None of them can be reached in the deployed demo or the published packages.

Alerts	Advisory	Clears with	Why it doesn't apply
#81, #82, #93, #94	@sveltejs/kit < 3.0.0: open redirect through use:enhance (GHSA-pfhg-q3qv-9q6r); XSS from an untrusted cache-control passed to setHeaders on a prerendered page (GHSA-27mw-82g8-phjj)	kit 3	The demo has no forms and never calls setHeaders
#1	cookie < 0.7.0, via kit 2's cookie ^0.6	kit 3	The demo sets no cookies
#17	esbuild < 0.28.1, via tsup 8's esbuild ^0.27: file read through the dev server on Windows	tsup 9	tsup doesn't run esbuild's dev server
#92	deepmerge ≤ 4.3.1, via @sveltejs/vite-plugin-svelte	nothing yet (no patched release)	Only merges config at build time

Majors left for follow-up PRs

• @sveltejs/kit 3 with @sveltejs/adapter-cloudflare 8. These have to land together, since adapter 8 requires kit 3 and wrangler ≥ 4.118. Kit 3 also needs TypeScript 6 across the repo (typescript-eslint 8.72 supports < 6.1) and Node 22.17+. In the demo:

  • svelte.config.js moves into the sveltekit() options in vite.config.ts.
  • The 12 $lib imports become #lib, declared in package.json imports and written with file extensions.
  • $env/dynamic/private becomes $app/env/private.
  • The API routes swap the deprecated json() for Response.json().
  • ServerInit moves to @sveltejs/kit/hooks.

  The demo doesn't use platform, which adapter 8 removes. The sv migrate sveltekit-3 codemod covers much of this. Clears feat: add deduction engine with step-by-step solving #1, #81, #82, #93 and #94.

• vitest 5 with @vitest/coverage-v8 5, bumped together for the root and the demo. Dependabot proposes them as one PR through the vitest-major group. clearMocks now defaults to true, and coverage.include/exclude match paths strictly, so the files counted by the 100% thresholds need re-checking. The bench suite uses plain tests, so the removal of the bench API doesn't touch it. Clears no alerts.

• prettier-plugin-svelte 4 requires Svelte 5 and drops svelteBracketNewLine and svelteStrictMode, neither of which the demo sets. It's the smallest of the three and clears no alerts.

• Dependabot will also propose two more majors:

  • tsup 9 clears chore: bump GitHub Actions to Node 24 compatible majors #17; diff the published dist output.
  • @types/node 26.

  TypeScript majors are ignored: typescript-eslint doesn't support 7 yet, and kit 3 needs 6.

After merging

• Dependabot should close chore(deps-dev): bump svelte from 5.55.0 to 5.55.7 #29 and chore(deps-dev): bump vite from 8.0.5 to 8.0.16 #31–chore(deps): bump postcss from 8.5.12 to 8.5.25 #37 as their alerts resolve. chore(deps): bump form-data from 4.0.5 to 4.0.6 #33's form-data already left the tree in feat(logic-grid-ai)!: move to @anthropic-ai/sdk 1.x and Claude Sonnet 5.5 #39.
• The SvelteKit 3 PR should drop the @sveltejs/kit and @sveltejs/adapter-cloudflare entries from ignore. The typescript entry stays until typescript-eslint supports TypeScript 7.

Test plan

• wrangler deploy --dry-run bundles the demo Worker at 269.6 KiB gzipped, against 267 KiB after feat(logic-grid-ai)!: move to @anthropic-ai/sdk 1.x and Claude Sonnet 5.5 #39.
• wrangler dev served the production build in local workerd. / renders and hydrates, and the three API routes return their validation errors without contacting the API.
• In vite dev, switching presets, generating puzzles and marking grid cells (cross-outs propagate) logged no console errors.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	logic-grid	317dfb6	Commit Preview URL Branch Preview URL	Oct 30 2026, 10:44 AM