build(deps-dev): bump @velarscript/cli from 0.18.0 to 0.25.0

[dependabot]

Bumps @velarscript/cli from 0.18.0 to 0.25.0.

Changelog

Sourced from @​velarscript/cli's changelog.

0.25.0 — 2026-08-29

Surfaces: core@0.1 · web@0.11 · node@0.16 · server@0.15 · desktop@0.10

This is the release that starts counting, so these are the numbers the four extension contracts already carried plus Core's first one; earlier sections are not labelled retroactively. From the next release on, a change to a surface without a bump to its number is a build failure — scripts/check-surface-versions.mjs hashes each surface and compares it against surface-lock.json.

Core and CLI — core@0.1

• Surface versions arrive (D110). Each of the five surfaces — core, web, node, server, desktop — carries a version of its own beside the single installation number, velar --version prints all five, and velar.json accepts an optional surfaces block that the compiler checks against what is installed. The compiler refuses a declaration that no longer matches, so an upgrade that moves a surface makes the re-read mandatory rather than conscientious. Core's counting starts here at 0.1; the number is a counter, not a maturity grade.

0.25.0 — 2026-08-29

Web

• A component element inside a {ternary} interpolation or a keyed map over rebuilt records rebuilds by contract; static child positions and keyed rows written in place preserve the instance. The semantics were already written — this release adds the reconciliation regression suite that pins all four positions, and A4 now also recognizes the derived spelling of keyed row churn (a computed building fresh records through a builder) with the same code and the same velar-allow A4 suppression.
• A component element returned at the root of a markup-answering def is refused where it is written (VEL5075); the runtime could never honor it and previously dropped the subtree silently.
• A module-level root whose construction throws now surfaces the compiler-owned fatal state and reports once through velar/app under the mount phase, instead of leaving a blank page. Module-level instantiation itself is unchanged.
• A reactive render that invalidates itself by writing a collection it reads now names the read-write path and the repair in the runaway report.
• A // comment attempt on its own line inside a JSX children region is refused (VEL5002) instead of rendering as screen text; a URL or an inline // in prose stays text, and the children-region boundary is now stated in the charter and Web docs.
• Breaking: font leaves the Look property table. Write the longhands (fontFamily, fontSize, fontWeight, lineHeight, …) — the shorthand resets the siblings this family publishes as checked properties, and a token() there fails at computed-value time with no diagnostic. The refusal

... (truncated)

Commits

• 74a9247 release: VelarScript 0.25.0
• 810f24b release: VelarScript 0.24.0
• 9965b2d fix(web,core,cli): the P2c second-pass findings
• 9e6549a fix(web,cli): the P2c blind-test findings
• 21165ed fix(web): A4 covers the derived rebuild, and a module root failure is not a b...
• 6184802 fix(web): select the exact production entry for 0.23.4
• af7d08c fix(web,desktop): the P2a language and test-face findings
• 0afcbf3 feat(core): add portable hash and package targets
• 3ba46c7 fix(web): run manifest workers in development
• 9bf3f6f release: VelarScript 0.23.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Looks like @velarscript/cli is up-to-date now, so this is no longer needed.