Bump the npm group across 1 directory with 12 updates

[dependabot]

Bumps the npm group with 12 updates in the /themes/develop directory:

Package	From	To
@ablogcms/pdf	3.2.29	3.2.35
@ablogcms/validator	3.2.32	3.2.35
alpinejs	3.16.3	3.17.3
query-string	9.5.0	9.5.1
smartphoto	2.1.8	2.1.17
browserslist	4.28.8	4.29.0
eslint	10.9.1	10.11.0
globals	17.11.0	17.12.0
prettier	3.9.6	3.9.8
stylelint	17.14.1	17.15.0
vite	8.2.2	8.3.0
@rollup/rollup-linux-x64-gnu	4.63.1	4.63.3

Updates @ablogcms/pdf from 3.2.29 to 3.2.35

Commits

• See full diff in compare view

Updates @ablogcms/validator from 3.2.32 to 3.2.35

Commits

• See full diff in compare view

Updates alpinejs from 3.16.3 to 3.17.3

Release notes

Sourced from alpinejs's releases.

v3.17.3

What's Changed

• Bump js-yaml from 3.14.1 to 3.15.2 by @​dependabot[bot] in alpinejs/alpine#4896
• Change x-for to allow loops like (foo)in(bar) by @​ColonelThirtyTwo in alpinejs/alpine#4897
• Fix(CspParser): accept reserved words as property/method names and object keys by @​MaxencePaulin in alpinejs/alpine#4905
• Fix: $watch and x-modelable can fire after being unwatched/released by @​MaxencePaulin in alpinejs/alpine#4903
• Fix: skip init() in x-data during clone, matching x-init behavior by @​MaxencePaulin in alpinejs/alpine#4901
• Bump @​vitest/mocker and vitest by @​dependabot[bot] in alpinejs/alpine#4898
• Stop x-on and x-model's own modifiers from being read as key names by @​dylanpulver in alpinejs/alpine#4891
• Fix CI compatibility after the Vitest 5 upgrade by @​calebporzio in alpinejs/alpine#4906

New Contributors

• @​ColonelThirtyTwo made their first contribution in alpinejs/alpine#4897
• @​MaxencePaulin made their first contribution in alpinejs/alpine#4905
• @​dylanpulver made their first contribution in alpinejs/alpine#4891

Full Changelog: alpinejs/alpine@v3.17.2...v3.17.3

v3.17.2

What's Changed

• Fix decode-uri-component Dependabot alert by @​calebporzio in alpinejs/alpine#4889
• Bump browserslist from 4.21.5 to 4.28.8 by @​dependabot[bot] in alpinejs/alpine#4890
• Fix CSP initialization in sandboxed iframes by @​calebporzio in alpinejs/alpine#4893

Full Changelog: alpinejs/alpine@v3.17.1...v3.17.2

v3.17.1

What's Changed

• Add dwell timing to the intersect plugin by @​cyppe in alpinejs/alpine#4884
• Bump brace-expansion from 1.1.11 to 1.1.18 by @​dependabot[bot] in alpinejs/alpine#4882
• Docs: clarify how Alpine effects track reactive dependencies by @​MuslumYilmaz in alpinejs/alpine#4883

New Contributors

• @​cyppe made their first contribution in alpinejs/alpine#4884
• @​MuslumYilmaz made their first contribution in alpinejs/alpine#4883

Full Changelog: alpinejs/alpine@v3.17.0...v3.17.1

v3.17.0

What's Changed

• Fix Unicode escapes in CSP string literals by @​dawNotPoi in alpinejs/alpine#4881
• Add Alpine.deferInit() — suspend a tree until an async prerequisite settles by @​calebporzio in alpinejs/alpine#4887

New Contributors

• @​dawNotPoi made their first contribution in alpinejs/alpine#4881

Full Changelog: alpinejs/alpine@v3.16.3...v3.17.0

Commits

• edb3702 Stop x-on and x-model's own modifiers from being read as key names (#4891)
• 636c78c Fix: skip init() in x-data during clone, matching x-init behavior (#4901)
• 404af5f Fix: $watch and x-modelable can fire after being unwatched/released (#4903)
• 9eef245 Bump version to 3.17.3
• fd2658a Change x-for to allow loops like (foo)in(bar) (#4897)
• 25afc62 Bump version to 3.17.2
• 8579eab Bump version to 3.17.1
• b2ead0b Bump version to 3.17.0
• 886d655 Add Alpine.deferInit() for suspending a tree on an async prerequisite (#4887)
• See full diff in compare view

Updates query-string from 9.5.0 to 9.5.1

Release notes

Sourced from query-string's releases.

v9.5.1

• Fix stringifyUrl() dropping a leading # in the fragment identifier and throwing on some absolute URLs 47b5b30

---

sindresorhus/query-string@v9.5.0...v9.5.1

Commits

• 7fd8133 9.5.1
• 47b5b30 Fix stringifyUrl() dropping a leading # in the fragment identifier and th...
• See full diff in compare view

Updates smartphoto from 2.1.8 to 2.1.17

Release notes

Sourced from smartphoto's releases.

v2.1.17

Full Changelog: appleple/SmartPhoto@v2.1.16...v2.1.17

v2.1.16

Full Changelog: appleple/SmartPhoto@v2.1.15...v2.1.16

v2.1.15

Full Changelog: appleple/SmartPhoto@v2.1.14...v2.1.15

v2.1.14

Full Changelog: appleple/SmartPhoto@v2.1.13...v2.1.14

v2.1.13

Full Changelog: appleple/SmartPhoto@v2.1.12...v2.1.13

v2.1.12

Full Changelog: appleple/SmartPhoto@v2.1.11...v2.1.12

v2.1.11

Full Changelog: appleple/SmartPhoto@v2.1.10...v2.1.11

v2.1.10

What's Changed

• chore(deps-dev): bump the patch-and-minor group with 2 updates by @​dependabot[bot] in appleple/SmartPhoto#97

Full Changelog: appleple/SmartPhoto@v2.1.9...v2.1.10

v2.1.9

Full Changelog: appleple/SmartPhoto@v2.1.8...v2.1.9

Commits

• 293a833 chore(release): v2.1.17
• f32a200 fix: 横向き回転時に写真がサムネイル一覧へ重なって見える不具合を修正
• ed090ce chore(release): v2.1.16
• c046f9f test: カバレッジを100%に引き上げ、防御的分岐と不安定テストを固定
• acfc7f0 feat: ピンチ操作を業界標準(PhotoSwipe / iOS 写真)の仕様に刷新
• b82203a chore(release): v2.1.15
• b868d11 feat: 既定の animationSpeed を 450ms から 300ms へ短縮
• 7f81cdd fix: ズーム中のパンで拡大が勝手に解除・跳ね戻りする不具合を修正
• 8085451 chore(release): v2.1.14
• 4e654f9 fix: 送り直後の逆送りが範囲外 index に飛びスライドが壊れる競合を修正
• Additional commits viewable in compare view

Updates browserslist from 4.28.8 to 4.29.0

Release notes

Sourced from browserslist's releases.

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from browserslist's changelog.

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

Commits

• e6dd578 Release 4.29.0 version
• 8987b7d Typo
• 47fefe6 Move from actions-up to pnpm
• 17b1e23 Update dependencies
• df16b26 Merge pull request #944 from fzlzjerry/fix/757-query-continuations
• a2673d7 Support query continuations across entries
• f46a5b7 Merge pull request #942 from agilgur5/fix-docs-typo-security-table
• 989c8c9 docs: fix typo in table rendering for SECURITY.md
• 12ed525 Release 4.28.9 version
• b1d8cf9 Update dependencies
• Additional commits viewable in compare view

Updates eslint from 10.9.1 to 10.11.0

Release notes

Sourced from eslint's releases.

v10.11.0

Features

• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21271) (Pavel)
• 397b3b8 feat: report unsafe labeled continue in no-unsafe-finally rule (#21316) (electrohyun)
• d3dd47f feat: only exempt new-cap built-ins that reference the global (#21290) (sethamus)

Bug Fixes

• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311) (xbinaryx)
• b684bb1 fix: make TimePass.parse optional in types and docs (#21313) (ntnyq)
• 26d11bc fix: don't report __proto__ properties in object-shorthand (#21310) (xbinaryx)

Documentation

• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312) (bytedoe)
• 6c789ff docs: Update README (GitHub Actions Bot)
• 5997825 docs: clarify preserve-caught-error known limitation (#21294) (Akinyemi Toluwalase)

Chores

• 520dd77 perf: Implement fast paths in critical areas (#21210) (Nicholas C. Zakas)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330) (Francesco Trotta)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331) (renovate[bot])
• 24310e3 chore: update ecosystem plugins (#21324) (ESLint Bot)
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318) (dependabot[bot])
• ac74e37 chore: Add AGENTS.md with AI disclosure requirements (#21221) (Nicholas C. Zakas)
• c832660 chore: Upgrade Stylelint to the latest version in docs (#21245) (Jung Hyeon Jun)
• f9f88fc chore: update ecosystem plugins (#21308) (ESLint Bot)
• fc81076 ci: add more types integration tests (#20395) (Nitin Kumar)

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))

... (truncated)

Commits

• 3c0b7c6 10.11.0
• 321f0a7 Build: changelog update for 10.11.0
• 520dd77 perf: Implement fast paths in critical areas (#21210)
• 9ecfdc5 docs: note that --cache can serve stale results for cross-file rules (#21312)
• 92086c8 test: update EMFILE error generation for Node.js 26.9.0 compatibility (#21330)
• 9ac7eb6 chore: update github/codeql-action action to v4.38.0 (#21331)
• 22b09f5 fix: ignore __proto__ properties in prefer-object-spread (#21311)
• 24310e3 chore: update ecosystem plugins (#21324)
• d136fa4 feat: object-shorthand handle quoted properties for ignoreConstructors (#21...
• 45ad79e ci: bump pnpm/action-setup from 6.0.10 to 6.1.0 (#21318)
• Additional commits viewable in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• See full diff in compare view

Updates prettier from 3.9.6 to 3.9.8

Release notes

Sourced from prettier's releases.

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

... (truncated)

Commits

• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• 0df8eb8 Bump Prettier dependency to 3.9.7
• 3cf6c8c Clean changelog_unreleased
• 0449af3 Release 3.9.7
• 43cd5b0 Allow verify markdown test with mdx parser
• ab8c911 Fix test on Node.js v26 (#19927)
• 4a5adf9 Fix tests
• Additional commits viewable in compare view

Updates stylelint from 17.14.1 to 17.15.0

Release notes

Sourced from stylelint's releases.

17.15.0

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

• Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
• Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
• Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
• Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
• Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
• Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

Changelog

Sourced from stylelint's changelog.

17.15.0 - 2026-09-04

It adds 1 new rule and 2 new rule options, and fixes 4 bugs.

• Added: selector-no-unmatchable rule (#9451) (@​jeddy3).
• Added: ignoreFunctions: [] to color-named and color-no-hex (#9463) (@​jsmitty12).
• Fixed: custom-property-no-missing-var-function false positives for anchor positioning (#9466) (@​giaBaoJS).
• Fixed: declaration-block-no-redundant-longhand-properties autofix for font shorthand (#9402) (@​sarathfrancis90).
• Fixed: declaration-property-max-values false positives for interpolated inline expressions (#9437) (@​alexchen-sys).
• Fixed: selector-no-invalid false negatives for pseudo-elements, combinators and nested :has() (#9452) (@​jeddy3).

Commits

• 0547bff Release 17.15.0 (#9484)
• ac19a3c Fix custom-property-no-missing-var-function false positives for anchor posi...
• 23947ae Bump @​humanfs/node from 0.16.6 to 0.16.8 (#9480)
• 53c74f7 Bump fast-uri from 3.1.5 to 3.1.7 (#9481)
• 26856e6 Bump the jest group across 1 directory with 2 updates (#9476)
• b90ecd8 Bump browserslist from 4.28.4 to 4.28.8 (#9479)
• 70072c0 Add ignoreFunctions: [] to color-named and color-no-hex (#9463)
• f0ac642 Bump postcss-import from 16.1.1 to 16.2.0 in the postcss group (#9477)
• fc8db57 Bump globby from 16.2.3 to 16.2.4 (#9478)
• aec96b0 Bump @​csstools/css-syntax-patches-for-csstree from 1.1.8 to 1.1.9 in the csst...
• Additional commits viewable in compare view

Updates vite from 8.2.2 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (#23364) (41f3c6f)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)
• delete unused PluginContainerOptions (#23382) (ee64401)
• use oxfmt sortImports (#23319) (97ad042)

... (truncated)

Commits

• 95e8923 release: v7.3.1
• 9d39d37 feat: add ignoreOutdatedRequests option to optimizeDeps (#21364)
• acf7e05 release: v7.3.0
• cff26ec feat(deps): update esbuild from ^0.25.0 to ^0.27.0 (#21183)
• 317b3b2 release: v7.2.7
• 721f163 fix: plugin shortcut support (#21211)
• bda5dbb release: v7.2.6
• 3aa7527 release: v7.2.5
• 72e398a fix(deps): update all non-major dependencies (#21175)
• 3765f7b fix: shortcuts not rebound after server restart (#21166)
• Additional commits viewable in compare view

Updates @rollup/rollup-linux-x64-gnu from 4.63.1 to 4.63.3

Release notes

Sourced from @​rollup/rollup-linux-x64-gnu's releases.

v4.63.3

4.63.3

2026-09-14

Bug Fixes

• Make sure that the internal shims for basename and extname in the browser build fully match NodeJS (#6473)
• Always report and recover from failures on invalidation in watch mode (#6506)
• Respect windows line terminators when tree-shaking in situations where line-breaks need to be removed to prevent automatic semicolon insertion (#6514)

Pull Requests

• #6473: fix(browser): match node's basename and extname (@​luantaraschi, @​lukastaegert)
• #6506: fix(watch): await the rerun so listener failures surface as ERROR events (@​yoominho91, @​irontaek, @​lukastaegert)
• #6514: Remove the whole CRLF pair when suppressing ASI (@​NgoQuocViet2001)
• #6515: chore(deps): lock file maintenance (@​renovate[bot])

v4.63.2

4.63.2

2026-09-12<...

Description has been truncated