Update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@inlang/paraglide-js (source)	^2.18.0 → ^2.18.1
@sveltejs/kit (source)	^2.60.1 → ^2.61.0
lefthook	^2.1.6 → ^2.1.8
svelte (source)	^5.55.8 → ^5.55.9
tsx (source)	^4.22.2 → ^4.22.3
ua-parser-js (source)	^2.0.9 → ^2.0.10
vite (source)	^8.0.13 → ^8.0.14
vitest (source)	^4.1.6 → ^4.1.7

---

Release Notes

opral/paraglide-js (@​inlang/paraglide-js)

v2.18.1

Patch Changes

• 6eb7d02: Fix input match generation so Infinity selectors match both numeric Infinity values and string "Infinity" values.
• c16730d: Pin default jsDelivr plugin URLs to exact versions in generated project settings.

sveltejs/kit (@​sveltejs/kit)

v2.61.0

Compare Source

Minor Changes

• breaking: the .run() method has been removed from remote queries on both the client and the server. Use await query() directly instead — it now works everywhere (#​15779)

• feat: remote queries can now be awaited in any context (event handlers, module scope, async callbacks), not just inside reactive contexts. The cache is shared across reactive and non-reactive subscribers, so awaiting a query in an event handler will dedupe with components that have already subscribed to the same query. (#​15779)

• feat: live query instances are now themselves async-iterable (#​15878)

• feat: add programmatic submit method to form remote function instances (#​15657)

• feat: pass form remote function instance into enhance callback (#​15657)

Patch Changes

• fix: resolve the app payload without using process.env.NODE_ENV (#​15852)

• fix: support exactOptionalPropertyTypes for optional route params (#​15825)

• fix: correctly send true value to the server for 'submit' and 'hidden' form fields (#​15858)

• fix: avoid build warnings about undefined universal hooks (#​15895)

• fix: prefer default error page when failing to decode the URL pathname (#​15744)

• fix: disable link prefetching on slow internet connections (#​15885)

• fix: allow routes ending with optional parameters next to more specific routes (#​15861)

• fix: remove reliance on Content-Length header in deserialize_binary_form, which caused failures when proxies (e.g. Vercel, Azure) strip the header and use chunked transfer encoding (#​15796)

evilmartians/lefthook (lefthook)

v2.1.8

Compare Source

• fix: do not warn if local hooks path is equal to default hooks path (#​1421) by @​mrexox

v2.1.7

Compare Source

• fix: use contrast colors (#​1420) by @​mrexox
• fix: apply stage_fixed only if it is safe (#​1418) by @​mrexox
• fix: try to always restore unstaged changes (#​1417) by @​mrexox
• fix: always restore unstaged changes (#​1416) by @​mrexox
• refactor: add new logger without a global state (#​1385) by @​mrexox
• fix: linter, sacrifice optimization for readability by @​mrexox
• fix: separate fallback push branch from pathspecs (#​1396) by @​lawrence3699

sveltejs/svelte (svelte)

v5.55.9

Compare Source

Patch Changes

• fix: don't unset batch when calling {#await ...} promise (#​18243)

• fix: promise-ify {#await await ...} expressions on the server and correctly hydrate them on the client (#​18243)

• fix: deduplicate dependencies that are added outside the init/update cycle (#​18243)

• fix: avoid false-positive batch invariant error (#​18246)

• fix: inline primitive constants in attribute values during SSR (#​18232)

privatenumber/tsx (tsx)

v4.22.3

Compare Source

faisalman/ua-parser-js (ua-parser-js)

v2.0.10

Compare Source

• Fix ReDoS vulnerability by limiting Client Hints input length (GHSA-9h5v-pfqq-x599)
• Add new method useExtension() in UAParser to extend custom detection rules
• Add new device vendor: Blackview, Coolpad, CUBOT, T-Mobile
• Improve browser detection: Huawei Browser, UCBrowser
• Improve OS detection: iOS
• Identify WebView user-agent as inapp browser
• extensions submodule:
  • Add new crawler: atlassian-bot, Audisto Crawler, AwarioBot, AwarioRssBot, AwarioSmartBot, BrightEdge Crawler, HubSpot Crawler, Meta-ExternalAds, Meta-WebIndexer, proximic, yacybot
  • Add new fetcher: Feedly, GoogleDocs, UptimeBot, virustotal
  • Add new library: phpcrawl
• helpers submodule:
  • Fix isElectron() function return itself

vitejs/vite (vite)

v8.0.14

Compare Source

Features

• update rolldown to 1.0.2 (#​22484) (96efc88)

Bug Fixes

• deps: update all non-major dependencies (#​22471) (98b8163)
• dev: handle errors when sending messages to vite server (#​22450) (e8e9a34)
• html: handle trailing slash paths in transformIndexHtml (#​22480) (5d94d1b)
• optimizer: pass oxc jsx options to transformSync in dependency scan (#​22342) (b3132da)

Miscellaneous Chores

• deps: update rolldown-related dependencies (#​22470) (7cb728e)
• remove irrelevant commits from changelog (2c69495)

Code Refactoring

• glob: do not rewrite import path for absolute base (#​22310) (0ae2844)

Tests

• css: sass does not use main field (#​22449) (ebf39a0)

vitest-dev/vitest (vitest)

v4.1.7

Compare Source

   🐞 Bug Fixes

• runner: Limit concurrency per task branch in addition to per leaf callbacks (backport)  -  by @​hi-ogawa in #​10384 (4f0f2)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for pauseai canceled.

Name	Link
🔨 Latest commit	ee36834
🔍 Latest deploy log	https://app.netlify.com/projects/pauseai/deploys/6a12553f44c7af000864a6e8