Major dependency updates

.github/workflows/dependency-review.yml

@@ -18,3 +18,6 @@ jobs:
         uses: actions/checkout@v4
       - name: "Dependency Review"
         uses: actions/dependency-review-action@v4
+        with:
+          # Fail the PR when a newly introduced dependency has this severity or higher
+          fail-on-severity: moderate

README.md

@@ -65,6 +65,10 @@ Before creating a new release update the semver versions on the package.json, ca
 
 After the release has been published with the appropiate change notes, build artifacts and update signatures the final step is to update the [GitHub Gist with the current version information](https://gist.githubusercontent.com/DoodlesEpic/e19632f3fe451cd9a14f9322880d8ebf/raw/6ac23f0bbc0b6f798897a9fec8ae86237577c8c8/GraphPrimeUpdater.json) at https://gist.github.com/DoodlesEpic/e19632f3fe451cd9a14f9322880d8ebf as that is where the updater looks at to see what is the latest version of the software.
 
+### Dependency review policy
+
+Pull requests are protected by the `Dependency Review` GitHub Action workflow, and this check should remain enabled and required for protected branches. If dependency review fails due to a vulnerable transitive dependency, first update the direct parent dependency or lockfile to a patched version where possible. If no upstream fix is available yet, document the transitive exposure and open a follow-up issue for tracking rather than broadening policy exceptions.
+
 ## License
 
 This project is licensed under the GNU GPL v3 free software license. Read the LICENSE file for more information.

package.json

@@ -14,41 +14,41 @@
     "test": "echo 'No tests'"
   },
   "devDependencies": {
-    "@eslint/compat": "^1.3.1",
+    "@eslint/compat": "^1.4.1",
     "@fortawesome/free-solid-svg-icons": "^6.7.2",
-    "@rollup/plugin-commonjs": "^28.0.6",
-    "@rollup/plugin-node-resolve": "^16.0.1",
+    "@rollup/plugin-commonjs": "^28.0.9",
+    "@rollup/plugin-node-resolve": "^16.0.3",
     "@rollup/plugin-terser": "^0.4.4",
-    "@rollup/plugin-typescript": "^12.1.4",
-    "@tauri-apps/api": "^2.6.0",
-    "@tauri-apps/cli": "^2.6.2",
-    "@tauri-apps/plugin-clipboard-manager": "~2.3.0",
-    "@tsconfig/svelte": "^5.0.4",
-    "@types/codemirror": "^5.60.16",
-    "@types/dygraphs": "^2.1.10",
-    "@typescript-eslint/eslint-plugin": "^8.37.0",
-    "@typescript-eslint/parser": "^8.37.0",
+    "@rollup/plugin-typescript": "^12.3.0",
+    "@tauri-apps/api": "^2.10.1",
+    "@tauri-apps/cli": "^2.10.0",
+    "@tauri-apps/plugin-clipboard-manager": "~2.3.2",
+    "@tsconfig/svelte": "^5.0.8",
+    "@types/codemirror": "^5.60.17",
+    "@types/dygraphs": "^2.1.11",
+    "@typescript-eslint/eslint-plugin": "^8.56.0",
+    "@typescript-eslint/parser": "^8.56.0",
     "codemirror": "^6.0.2",
     "dygraphs": "^2.2.1",
-    "eslint": "^9.31.0",
-    "eslint-config-prettier": "^10.1.5",
-    "eslint-plugin-svelte": "^3.11.0",
-    "prettier": "^3.6.2",
-    "prettier-plugin-svelte": "^3.4.0",
-    "rollup": "^4.45.1",
-    "rollup-plugin-css-only": "^4.5.2",
+    "eslint": "^9.39.3",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-plugin-svelte": "^3.15.0",
+    "frappe-charts": "^1.6.2",
+    "prettier": "^3.8.1",
+    "prettier-plugin-svelte": "^3.5.0",
+    "rollup": "^4.58.0",
+    "rollup-plugin-css-only": "^4.5.5",
     "rollup-plugin-livereload": "^2.0.5",
-    "rollup-plugin-svelte": "^7.2.2",
+    "rollup-plugin-svelte": "^7.2.3",
     "sirv-cli": "^3.0.1",
-    "svelte": "^5.36.6",
-    "svelte-check": "^4.2.2",
-    "svelte-eslint-parser": "^1.3.0",
+    "svelte": "^5.53.0",
+    "svelte-check": "^4.4.3",
+    "svelte-eslint-parser": "^1.4.1",
     "svelte-fa": "^4.0.4",
-    "svelte-frappe-charts": "^1.10.0",
     "svelte-preprocess": "^6.0.3",
     "tslib": "^2.8.1",
-    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.37.0"
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.56.0"
   },
   "engines": {
     "node": ">=22"