chore(deps): bump the webui-deps group across 1 directory with 3 updates

[dependabot]

Bumps the webui-deps group with 3 updates in the /packages/webui directory: tailwind-variants, svelte and typescript.

Updates tailwind-variants from 3.2.2 to 3.3.1

Release notes

Sourced from tailwind-variants's releases.

v3.3.1

   🐞 Bug Fixes

• Slots shared-state contamination  -  by @​tianenpang in heroui-inc/tailwind-variants#305 (8b7f0)

    View changes on GitHub

v3.3.0

No significant changes

    View changes on GitHub

Changelog

Sourced from tailwind-variants's changelog.

3.3.1 (2026-08-03)

Bug Fixes

• slots shared-state contamination (#305) (8b7f0b6)

3.3.0 (2026-07-26)

Commits

• e087a82 chore: release v3.3.1
• 8b7f0b6 fix: slots shared-state contamination (#305)
• 7546252 ci: publish to npm via OIDC trusted publishing
• 9bf4fde chore: release v3.3.0
• 66f1a49 refactor: typescript (#301)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwind-variants since your current version.

Updates svelte from 5.56.6 to 5.56.9

Release notes

Sourced from svelte's releases.

svelte@5.56.9

Patch Changes

• fix: skip controlled each fast path while another batch is pending (#18625)

• fix: better whitespace handling inside printer (#18638)

• fix: don't duplicate comments in attributes (#18636)

• fix: preserve CSS comments in the AST printer (#18637)

svelte@5.56.8

Patch Changes

• fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

• fix: preserve select selection when spread attributes omit value (#18561)

svelte@5.56.7

Patch Changes

• chore: provide indent option for print (#18474)

Changelog

Sourced from svelte's changelog.

5.56.9

Patch Changes

• fix: skip controlled each fast path while another batch is pending (#18625)

• fix: better whitespace handling inside printer (#18638)

• fix: don't duplicate comments in attributes (#18636)

• fix: preserve CSS comments in the AST printer (#18637)

5.56.8

Patch Changes

• fix: call onerror and provide a working reset when hydrating a failed boundary (#18556)

• fix: preserve select selection when spread attributes omit value (#18561)

5.56.7

Patch Changes

• chore: provide indent option for print (#18474)

Commits

• 20b341f Version Packages (#18628)
• ee6dff8 fix: better whitespace handling inside printer (#18638)
• a1d5035 fix: preserve CSS comments in the AST printer (#18637)
• 3ed9db4 fix: don't duplicate comments in attributes (#18636)
• 26786e9 fix: skip controlled each fast path while another batch is pending (#18625)
• 44a7813 Version Packages (#18572)
• 3dde011 fix: call onerror and provide a working reset when hydrating a failed bou...
• 2bace30 fix: preserve select selection with spread attributes (#18561)
• b29d700 Version Packages (#18560)
• b791cac chore: provide indent option for print (#18474)
• See full diff in compare view

Updates typescript from 5.9.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).
• fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

• npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).
• fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

• npm

TypeScript 6.0.1 RC

For release notes, check out the release announcement blog post.

• fixed issues query for TypeScript 6.0.0 (Beta).
• fixed issues query for TypeScript 6.0.1 (RC).

Downloads are available on:

• npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

• fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

• npm

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​svelte@​5.56.9
	npm/​typescript@​7.0.2
	npm/​tailwind-variants@​3.3.1

View full report

[winnowl]

Actionable comments posted: 1

🛠️ To have the bot fix these findings, comment @winnowl fix.

⛔ Files ignored due to path filters (1)

• packages/webui/package-lock.json is excluded by !**/package-lock.json

🔎 Confirmed findings (1)

• 🟠 High The committed consumer lockfiles do not describe the changed shared package manifest, so frozen clean installs can reject the file dependency or use a graph that does not satisfy the source being bundled. packages/webui/package.json now requires tailwind-variants ^3.3.1, Svelte ^5.56.9, and TypeScript ^7.0.2, while website/bun.lock records the linked package as requiring tailwind-variants ^3.2.2, Svelte ^5.56.0, and TypeScript ^5.9.0, and monitor/frontend/package-lock.json records the same old webui metadata (including tailwind-variants ^3.2.2). The website's deployment script runs bun install --frozen-lockfile before its npm prebuild, so a clean Pages-style checkout can fail at the frozen install (or otherwise resolve stale metadata) before the prebuild can install the package's own lockfile. (inline)

📋 Additional findings from this change (not shown inline) (3)

• 🟡 Medium The website Bun lock is not synchronized with the changed webui manifest, so a frozen/reproducible website install cannot install the selected dependency set. Its @serverbox/webui file-package record still declares tailwind-variants: ^3.2.2, svelte: ^5.56.0, and typescript: ^5.9.0, while the manifest now requires ^3.3.1, ^5.56.9, and ^7.0.2; the lock also resolves the website's TypeScript to 6.0.3 and tailwind-variants to 3.2.2. Thus the committed website resolution is either rejected as an out-of-date lockfile or, if refreshed non-frozen, silently changes the toolchain and dependencies rather than reproducing the selected manifest. This is introduced by the manifest change without the corresponding website lock update. It would be false only if website builds never run Bun install/frozen-lockfile from this lock, or if the lock is regenerated as part of an external build step. (packages/webui/package.json) — anchor-outside-diff
• 🟡 Medium A clean checkout using the documented make monitor-dev path still starts the frontend without installing the linked package's dependencies. The target only runs cd monitor/frontend && npm ci, then launches npm run dev; it never runs the new npm install --prefix ../../packages/webui prebuild hook. Since the package exports raw source and src/utils.ts/components import clsx, tailwind-merge, and tailwind-variants, a fresh dev install can fail module resolution before the monitor panel starts (and success can depend on accidental hoisting from unrelated packages). (packages/webui/package.json) — anchor-outside-diff
• 🟡 Medium make monitor-dev cannot reliably start the frontend from a clean checkout: it runs only npm ci in monitor/frontend, which installs @serverbox/webui as the symlink recorded at node_modules/@serverbox/webui but never installs that linked package's dependencies. The linked source imports clsx, tailwind-merge, and tailwind-variants, so Vite/check/dev startup can fail with module-resolution errors until npm install --prefix ../../packages/webui is run manually. (Makefile) — anchor-outside-diff

📚 Preexisting issues (unrelated to this change) (5)

• 🟠 High Dependency brace-expansion@5.0.7 is affected by high advisory GHSA-mh99-v99m-4gvg (brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash); upgrade to at least 5.0.8. (monitor/frontend/package-lock.json) — dependency-evidence
• 🟠 High Dependency brace-expansion@5.0.7 is affected by high advisory GHSA-rgw5-rvv9-x895 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation); upgrade to at least 1.1.18. (monitor/frontend/package-lock.json) — dependency-evidence
• ⚪ Info Dependency rsa@0.10.0-rc.18 is affected by info advisory RUSTSEC-2023-0071 (Marvin Attack: potential key recovery through timing sidechannels); no fixed version is available yet. (Cargo.lock) — dependency-evidence
• ⚪ Info Dependency rsa@0.9.10 is affected by info advisory RUSTSEC-2023-0071 (Marvin Attack: potential key recovery through timing sidechannels); no fixed version is available yet. (Cargo.lock) — dependency-evidence
• ⚪ Info Dependency rustls-pemfile@2.2.0 is affected by info advisory RUSTSEC-2025-0134 (rustls-pemfile is unmaintained); no fixed version is available yet. (Cargo.lock) — dependency-evidence

🤖 Prompt for AI agents — all findings (9)

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

## Findings on this change (also posted as inline comments) (1)

In packages/webui/package.json around line 21, address this finding:
The committed consumer lockfiles do not describe the changed shared package manifest, so frozen clean installs can reject the file dependency or use a graph that does not satisfy the source being bundled. `packages/webui/package.json` now requires `tailwind-variants` ^3.3.1, Svelte ^5.56.9, and TypeScript ^7.0.2, while `website/bun.lock` records the linked package as requiring tailwind-variants ^3.2.2, Svelte ^5.56.0, and TypeScript ^5.9.0, and `monitor/frontend/package-lock.json` records the same old webui metadata (including tailwind-variants ^3.2.2). The website's deployment script runs `bun install --frozen-lockfile` before its npm prebuild, so a clean Pages-style checkout can fail at the frozen install (or otherwise resolve stale metadata) before the prebuild can install the package's own lockfile.

## Additional findings on this change (not posted inline) (3)

In packages/webui/package.json around line 23, address this finding:
The website Bun lock is not synchronized with the changed webui manifest, so a frozen/reproducible website install cannot install the selected dependency set. Its `@serverbox/webui` file-package record still declares `tailwind-variants: ^3.2.2`, `svelte: ^5.56.0`, and `typescript: ^5.9.0`, while the manifest now requires `^3.3.1`, `^5.56.9`, and `^7.0.2`; the lock also resolves the website's TypeScript to 6.0.3 and tailwind-variants to 3.2.2. Thus the committed website resolution is either rejected as an out-of-date lockfile or, if refreshed non-frozen, silently changes the toolchain and dependencies rather than reproducing the selected manifest. This is introduced by the manifest change without the corresponding website lock update. It would be false only if website builds never run Bun install/frozen-lockfile from this lock, or if the lock is regenerated as part of an external build step.

In packages/webui/package.json around line 18, address this finding:
A clean checkout using the documented `make monitor-dev` path still starts the frontend without installing the linked package's dependencies. The target only runs `cd monitor/frontend && npm ci`, then launches `npm run dev`; it never runs the new `npm install --prefix ../../packages/webui` prebuild hook. Since the package exports raw source and `src/utils.ts`/components import `clsx`, `tailwind-merge`, and `tailwind-variants`, a fresh dev install can fail module resolution before the monitor panel starts (and success can depend on accidental hoisting from unrelated packages).

In Makefile around line 178, address this finding:
`make monitor-dev` cannot reliably start the frontend from a clean checkout: it runs only `npm ci` in `monitor/frontend`, which installs `@serverbox/webui` as the symlink recorded at `node_modules/@serverbox/webui` but never installs that linked package's dependencies. The linked source imports `clsx`, `tailwind-merge`, and `tailwind-variants`, so Vite/check/dev startup can fail with module-resolution errors until `npm install --prefix ../../packages/webui` is run manually.

## Preexisting issues, unrelated to this change — fix only if asked (5)

In monitor/frontend/package-lock.json, address this finding:
Dependency `brace-expansion@5.0.7` is affected by high advisory GHSA-mh99-v99m-4gvg (brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash); upgrade to at least 5.0.8.

In monitor/frontend/package-lock.json, address this finding:
Dependency `brace-expansion@5.0.7` is affected by high advisory GHSA-rgw5-rvv9-x895 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation); upgrade to at least 1.1.18.

In Cargo.lock, address this finding:
Dependency `rsa@0.10.0-rc.18` is affected by info advisory RUSTSEC-2023-0071 (Marvin Attack: potential key recovery through timing sidechannels); no fixed version is available yet.

In Cargo.lock, address this finding:
Dependency `rsa@0.9.10` is affected by info advisory RUSTSEC-2023-0071 (Marvin Attack: potential key recovery through timing sidechannels); no fixed version is available yet.

In Cargo.lock, address this finding:
Dependency `rustls-pemfile@2.2.0` is affected by info advisory RUSTSEC-2025-0134 (rustls-pemfile is unmaintained); no fixed version is available yet.

📜 Review details

Model

• gpt-5.6-luna

Coverage

• 2 of 2 areas reviewed

[winnowl]

🔍 Compatibility | 🟠 High

🧩 Analysis

• Change relation: introduced
• Confirmation: independently-verified
• Reachable: ✅
• ⚠️ The exact Bun diagnostic text and whether every Bun version rejects nested file-dependency manifest drift may vary, but the committed website lock entry is demonstrably stale relative to the linked package manifest and the frozen install is the first step in the deployment path.

🤖 Prompt for AI agents

In packages/webui/package.json, address this finding:
The committed consumer lockfiles do not describe the changed shared package manifest, so frozen clean installs can reject the file dependency or use a graph that does not satisfy the source being bundled. `packages/webui/package.json` now requires `tailwind-variants` ^3.3.1, Svelte ^5.56.9, and TypeScript ^7.0.2, while `website/bun.lock` records the linked package as requiring tailwind-variants ^3.2.2, Svelte ^5.56.0, and TypeScript ^5.9.0, and `monitor/frontend/package-lock.json` records the same old webui metadata (including tailwind-variants ^3.2.2). The website's deployment script runs `bun install --frozen-lockfile` before its npm prebuild, so a clean Pages-style checkout can fail at the frozen install (or otherwise resolve stale metadata) before the prebuild can install the package's own lockfile.

[lollipopkit]

@dependabot rebase