[dependabot]

Bumps the dependencies group with 6 updates in the / directory:

Package	From	To
@deepgram/sdk	5.15.0	5.16.0
happy-dom	21.0.1	21.0.4
vite	8.3.4	8.3.5
sugar-high	2.6.0	2.6.4
@testing-library/preact	3.2.4	3.2.6
@playwright/test	1.64.0	1.64.1

Updates @deepgram/sdk from 5.15.0 to 5.16.0

Release notes

Sourced from @​deepgram/sdk's releases.

v5.16.0

5.16.0 (2026-10-23)

Features

• Listen V1 (Nova-3 multilingual): Add optional language_hint support for prerecorded and streaming requests. Pass one BCP-47 hint as a string or several as an array; hints bias detection when model: "nova-3" and language: "multi". Transcription alternatives expose typed languages and normalized languages_hinted values. Live reconfiguration emits typed ConfigureSuccess or ConfigureFailure frames; retain legacy Error handling for older server frames. (#583) (9c31d2f)

Changelog

Sourced from @​deepgram/sdk's changelog.

5.16.0 (2026-10-23)

Features

• Listen V1 (Nova-3 multilingual): Add optional language_hint support for prerecorded and streaming requests. Pass one BCP-47 hint as a string or several as an array; hints bias detection when model: "nova-3" and language: "multi". Transcription alternatives expose typed languages and normalized languages_hinted values. Live reconfiguration emits typed ConfigureSuccess or ConfigureFailure frames; retain legacy Error handling for older server frames. (#583) (9c31d2f)

Commits

• 9767c9d chore(main): release 5.16.0 (#584)
• 9c31d2f feat(regen): add nova-3 multilingual Listen V1 support (#583)
• 73f7ea3 chore(regen): update Listen configuration and TTS metadata (#575)
• See full diff in compare view

Updates happy-dom from 21.0.1 to 21.0.4

Release notes

Sourced from happy-dom's releases.

v21.0.4

👷‍♂️ Patch fixes

• Fixed a code injection vulnerability in the ESM compiler - By @​capricorn86
• Fixed cross-origin isolation so opaque-origin data: iframes cannot access their parent or top window - By @​capricorn86

v21.0.3

👷‍♂️ Patch fixes

• Fixes security vulnerability where authorization header was forwarded when redirecting - By @​capricorn86

v21.0.2

👷‍♂️ Patch fixes

• Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @​happy-dom/server-renderer - By @​capricorn86

Commits

• fd16352 fix: Fixed a code injection vulnerability in the ESM compiler (#2537)
• 75ab0fb fix: Fixed cross-origin isolation so opaque-origin data: iframes cannot acces...
• 875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
• 1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
• f55c7e0 chore: Update security documentation (#2509)
• See full diff in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (#23725)
• 197daf6 fix(bundled-dev): declare utf-8 charset in fallback page (#23846)
• 4d16e7c fix(build): include preload dependencies to chunk import map hashing (#23793)
• df7b40e refactor(dev): consolidate moduleURL to file path utilities (#23828)
• a162990 refactor(dev): use ModuleURLs throughout HTML transforms (#23815)
• 6116689 refactor(dev): separate import resolution from URL conversion (#23791)
• 446954c refactor(dev): share ModuleURL and BrowserURL conversions (#23790)
• Additional commits viewable in compare view

Updates sugar-high from 2.6.0 to 2.6.4

Release notes

Sourced from sugar-high's releases.

sugar-high@2.6.4

Patch Changes

• a19ced0: Speed up tokenization with character-code checks and batched text scanning while preserving tokens and highlighted HTML.

sugar-high@2.6.3

Patch Changes

• 1adb6ca: Speed up JavaScript and TypeScript highlighting while preserving token and HTML output.
• d22460c: Render ordinary highlights directly from tokens while preserving existing HTML, themes, annotations, and display hooks.
• 34eb4dd: Reduce allocations in JavaScript tokenization and HTML rendering while preserving token and markup output.

sugar-high@2.6.2

Patch Changes

• a81ea55: Treat CRLF line endings like LF, so Windows sources no longer render an empty line after every line or lose JSX, CSS property, and Markdown highlighting.
• dea164c: Highlight Rust line, doc, and block comments as comments instead of operators and identifiers.
• fb0a8f0: Keep apostrophes inside YAML plain scalars, such as don't or users', from opening a string that swallows the following lines.

sugar-high@2.6.1

Patch Changes

• 216c7c9: Fix nested braces in JavaScript template literal interpolations.
• 98d4b43: Keep TypeScript generic expressions and component type arguments in JavaScript mode inside JSX.
• 719426e: Restore parent JSX state after nested elements and fragments close.

Changelog

Sourced from sugar-high's changelog.

2.6.4

Patch Changes

• a19ced0: Speed up tokenization with character-code checks and batched text scanning while preserving tokens and highlighted HTML.

2.6.3

Patch Changes

• 1adb6ca: Speed up JavaScript and TypeScript highlighting while preserving token and HTML output.
• d22460c: Render ordinary highlights directly from tokens while preserving existing HTML, themes, annotations, and display hooks.
• 34eb4dd: Reduce allocations in JavaScript tokenization and HTML rendering while preserving token and markup output.

2.6.2

Patch Changes

• a81ea55: Treat CRLF line endings like LF, so Windows sources no longer render an empty line after every line or lose JSX, CSS property, and Markdown highlighting.
• dea164c: Highlight Rust line, doc, and block comments as comments instead of operators and identifiers.
• fb0a8f0: Keep apostrophes inside YAML plain scalars, such as don't or users', from opening a string that swallows the following lines.

2.6.1

Patch Changes

• 216c7c9: Fix nested braces in JavaScript template literal interpolations.
• 98d4b43: Keep TypeScript generic expressions and component type arguments in JavaScript mode inside JSX.
• 719426e: Restore parent JSX state after nested elements and fragments close.

Commits

• f844492 ci: release packages (#317)
• 09fd31d docs: refresh benchmarks and feature 100 KiB comparison
• 7aa4f30 perf: speed up tokenizers without changing output (#316)
• b5db9fd ci: release packages (#312)
• 078f827 docs: update metrics
• d22460c fix: render highlights directly from tokens (#314)
• ac7af0e docs: update metrics
• 1adb6ca fix: simplify JavaScript scanning (#313)
• 34eb4dd fix: simplify tokenization and rendering (#311)
• eed8411 docs: explain the highlighting speed and correctness balance (#310)
• Additional commits viewable in compare view

Updates @testing-library/preact from 3.2.4 to 3.2.6

Release notes

Sourced from @​testing-library/preact's releases.

v3.2.6

3.2.6 (2026-10-22)

Bug Fixes

• correct type of wrapper property in RenderOptions (#74) (6c8abdf)
• drop browser export condition pointing at the ESM build (#87) (0bf4860), closes #70
• fire lowercase event types for Preact 11 (#86) (90585d6), closes #67
• type RenderResult.unmount as returning void (#88) (0009053), closes #76

v3.2.5

3.2.5 (2026-10-22)

Bug Fixes

• Compat change aliases (#77) (08365bc)

Commits

• 0bf4860 fix: drop browser export condition pointing at the ESM build (#87)
• 0009053 fix: type RenderResult.unmount as returning void (#88)
• 90585d6 fix: fire lowercase event types for Preact 11 (#86)
• 6c8abdf fix: correct type of wrapper property in RenderOptions (#74)
• 6c87b3b Merge pull request #82 from akselinurmio/fix/renderhook-wrapper-type
• 0fd3434 chore: Bump 'testing-library/dom' version (#84)
• c509d96 Chore: update release process (#79)
• 08365bc fix: Compat change aliases (#77)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/preact since your current version.

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.