[dependabot]

Bumps the production-dependencies group with 6 updates:

Package	From	To
d3	7.9.0	7.9.2
minimatch	11.0.3	11.0.5
rehype-pretty-code	0.14.5	0.14.6
serve-handler	6.1.7	6.1.8
shiki	4.5.0	4.6.0
ws	8.22.0	8.22.1

Updates d3 from 7.9.0 to 7.9.2

Release notes

Sourced from d3's releases.

v7.9.2

• Revert d3-delaunay’s fix for collinear diagrams.

v7.9.1

• Update dependencies.
• Adopt pnpm and vitest.
• Adopt npm trusted publishing.
• Publish an ES module bundle instead of separate source files.

Commits

• db118c9 7.9.2
• 374c4b3 fix docs build
• 78db499 7.9.1 (#4149)
• 3d1a90c Fix Bruls paper external URL in treemap.md (#4147)
• ca958d4 docs: Incorrect alt text copied from the Observable Framework repository; it ...
• 42ccb63 fix broken link (#4084)
• 66bfe8c Fix external edge bundling references (#4039)
• ab22394 fix: support links on d3js.org are outdated (#4015)
• a10166c Update CHANGES.md
• 844b75a Update getting-started.md link to Svelte example (#3962)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for d3 since your current version.

Updates minimatch from 11.0.3 to 11.0.5

Commits

• ea0a4a6 11.0.5
• e83fdf3 match large numeric brace ranges without expanding them
• 85d681c fixup! ci: update github actions to latest major versions
• a675e79 ci: update github actions to latest major versions
• 70f442d dedupe level 2 patterns without a pairwise compare
• b2d7c28 ci: increase timeout on test
• 2d5578b throw when **/.. pattern expansion goes above the limit
• 9c6ebb1 fix: reject incomplete glob split expansions
• 73f0e1b fix: bound total cells added by the glob split pass
• f24eba9 11.0.4
• Additional commits viewable in compare view

Updates rehype-pretty-code from 0.14.5 to 0.14.6

Release notes

Sourced from rehype-pretty-code's releases.

rehype-pretty-code@0.14.6

Patch Changes

• Fix: inline code highlighted with a {:.token} suffix is now always rendered as text. Previously its content was interpolated into an HTML string and re-parsed, so untrusted Markdown could inject HTML elements and attributes. As a result, entities in token code such as < now display as written, matching the {:lang} syntax.

Changelog

Sourced from rehype-pretty-code's changelog.

0.14.6

Patch Changes

• Fix: inline code highlighted with a {:.token} suffix is now always rendered as text. Previously its content was interpolated into an HTML string and re-parsed, so untrusted Markdown could inject HTML elements and attributes. As a result, entities in token code such as < now display as written, matching the {:lang} syntax.

Commits

• 4e63973 [ci] release (#278)
• aff7cf8 Merge commit from fork
• See full diff in compare view

Updates serve-handler from 6.1.7 to 6.1.8

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serve-handler since your current version.

Updates shiki from 4.5.0 to 4.6.0

Release notes

Sourced from shiki's releases.

v4.6.0

   🐞 Bug Fixes

• primitive: Apply injections loaded after their target grammar  -  by @​Yahiro025 in shikijs/shiki#1333 (28817)
• rehype: Avoid cache key collisions between code blocks  -  by @​Don-Yin in shikijs/shiki#1343 (f8f63)
• stream: Align ShikiStreamTokenizer offsets and CRLF handling with codeToTokens  -  by @​xyrolle in shikijs/shiki#1335 (f8aba)
• transformers: Also convert single-theme inline token styles to classes  -  by @​harsh-thakkar7 in shikijs/shiki#1344 (6319e)
• vitepress-twoslash: Keep drag guard working with floating-vue 5.4  -  by @​0froq in shikijs/shiki#1340 (5a174)

   🏎 Performance

• core: Render many decorations in linear time  -  by @​DaniPopes in shikijs/shiki#1338 (f07d3)
• engine-oniguruma: Compress Wasm binary with gzip and load asynchronously  -  by @​jeremy-code in shikijs/shiki#1331 (a1fea)

    View changes on GitHub

Commits

• 167a38f chore: release v4.6.0
• 0d7f97f chore: update deps (#1346)
• f07d3f9 perf(core): render many decorations in linear time (#1338)
• See full diff in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

• The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).
• Sender.frame() no longer returns empty chunks (85319a72).

Commits

• c18a80a [dist] 8.22.1
• 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
• c9efa88 [ci] Test on node 27
• aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
• b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
• 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions