[dependabot]

Bumps the production-dependencies group with 7 updates in the / directory:

Package	From	To
hast-util-to-jsx-runtime	2.3.6	2.3.7
isomorphic-git	1.44.4	1.44.9
minimatch	10.2.6	11.0.3
preact	11.0.2	11.1.1
preact-render-to-string	6.8.1	6.8.2
ws	8.22.0	8.22.1
@types/node	26.6.5	26.6.6

Updates hast-util-to-jsx-runtime from 2.3.6 to 2.3.7

Release notes

Sourced from hast-util-to-jsx-runtime's releases.

2.3.7

Fix

• b29735c Fix casing of style properties, specially variables

Dependencies

• 5fc8d17 Update style-to-js

Full Changelog: syntax-tree/hast-util-to-jsx-runtime@2.3.6...2.3.7

Commits

• 0086256 2.3.7
• b4c88ee Refactor .prettierignore
• 562b1b5 Update node in actions
• 47f49d4 Remove deno
• b29735c Fix casing of style properties, specially variables
• 40ec5e6 Update preact in example
• 0494bb2 Update react in example
• 940871c Remove skipLibCheck from tsconfig.json
• 5fc8d17 Update style-to-js
• 60af4ad Update dev-dependencies
• Additional commits viewable in compare view

Updates isomorphic-git from 1.44.4 to 1.44.9

Release notes

Sourced from isomorphic-git's releases.

v1.44.9

1.44.9 (2026-11-01)

Bug Fixes

• compare subsecond file timestamps (#2455) (86df2db)

v1.44.8

1.44.8 (2026-10-28)

Bug Fixes

• reject malformed pkt-line lengths (#2457) (6801888)

v1.44.7

1.44.7 (2026-10-28)

Bug Fixes

• read and write version 3 index files (#2465) (7ac1608), closes #1430

v1.44.6

1.44.6 (2026-10-27)

Performance Improvements

• inflate each object once in GitPackIndex.fromPack (#2443) (cea14b8)

v1.44.5

1.44.5 (2026-10-26)

Bug Fixes

• parse config section headers with comments, tabs and escaped subsections (#2466) (dea0848)

Commits

• 86df2db fix: compare subsecond file timestamps (#2455)
• f21142c Merge commit from fork
• 6801888 fix: reject malformed pkt-line lengths (#2457)
• 7ac1608 fix: read and write version 3 index files (#2465)
• 9db9fd1 docs(quickstart): define global Buffer in browser Quick Start (#2468)
• cea14b8 perf: inflate each object once in GitPackIndex.fromPack (#2443)
• dea0848 fix: parse config section headers with comments, tabs and escaped subsections...
• See full diff in compare view

Updates minimatch from 10.2.6 to 11.0.3

Changelog

Sourced from minimatch's changelog.

change log

11.0

• Match each path portion with Matcher from @isaacs/nonrecursive-glob-match, in place of a RegExp. Items in Minimatch.set are now strings, Matcher objects, or GLOBSTAR.
• Remove makeRe(), Minimatch#regexp, and the MMRegExp type.
• Remove the AST class.
• Remove the maxExtglobRecursion option.
• An empty path portion, such as the last one in a/b/, only matches an empty pattern portion. So a/b/ no longer matches a/b/?(x) or a/b/*(x), the same as a/b/*.
• Add the normalize option, to normalize unicode in the pattern and in each portion of the tested path.
• Remove the debug option and the debug() method.
• Remove the matchOne(), slashSplit(), and levelTwoFileOptimize() methods. They are internal now.
• Fix patterns with more than one ** and sections of different lengths between them, such as **/a/b/c/**/d/**, which failed to match some paths since 10.2.3.
• Fix partial matching of patterns with **, which since 10.2.3 matched some paths under a dot portion that ** can not walk, and did not match some paths that end in the pattern's last portion.
• partial matching of patterns with many ** no longer takes exponential time.
• On Windows, a .. no longer removes the drive letter, or the host and share of a UNC path, at the start of a pattern or (at optimization level 2) a path. So C:/a/../../x no longer matches x or /x.
• On Windows, compare the host and share of UNC paths like //host/share/... case-insensitively, the same as drive letters.
• On Windows, long UNC paths like //?/UNC/host/share/... match //host/share/... and vice versa, the same as //?/c:/... and c:/....
• At optimization level 2, stop splitting **/.. portions once there are braceExpandMax patterns, and do not dedupe sets of more than 1000 patterns. Before, a short pattern could take minutes to compile.
• minimatch() keeps the 256 Minimatch objects that it used most recently, so it does not compile the same pattern again.
• Faster to compile brace patterns that make rows that are merged, such as **/*.{png,jpg,gif}, because the Matchers for the rows that are merged are not made.

10.2

... (truncated)

Commits

• b0c2aa8 11.0.3
• 293267a perf: cache matchers more aggressively by postponing creation
• 52d2aec cache 256 patterns
• 4380455 11.0.2
• 322feb1 update @​isaacs/nonrecursive-glob-match
• 96cad78 ci: exclude windows from testing node 22 and 24
• 47afe88 11.0.1
• 77a0f5c limit **/.. optimization pass to avoid quadratic explosion
• 6f9f131 11.0.0
• 02dcbe4 update oxlint
• Additional commits viewable in compare view

Updates preact from 11.0.2 to 11.1.1

Release notes

Sourced from preact's releases.

11.1.1

Fixes

• Fix rendering, updating, and hydrating \<template> elements in SVG and MathML namespaces (#5339, thanks @​JoviDeCroock)

Types

• Add declarative shadow DOM attributes to \<template>, including their camelCase forms (#5338, thanks @​b84330808)

11.1.0

Features

• Add preact/compat/compiler-runtime for apps compiled with React Compiler (#5323, thanks @​JoviDeCroock)

Fixes

• Harden VNode recognition with a shared symbol marker (#5335, thanks @​JoviDeCroock)
• Isolate layout-effect errors to the throwing component so unrelated effects and lifecycle callbacks still run (#5321, thanks @​JoviDeCroock)
• Stop appending px to unitless SVG paint and aspect-ratio values in compat (#5233, thanks @​dylanpulver)

Types

• Allow the list attribute on all valid input types (#5331, thanks @​playlikeboy)

Compatibility

The new VNode marker requires @preact/signals 2.11.4 or later and preact-render-to-string 6.8.2 or later when using those packages.

Commits

• cad3d26 Merge pull request #5340 from preactjs/release/11.1.1
• bdf1a5f 11.1.1
• 4e5c63c Merge pull request #5339 from preactjs/fix/template-namespace-content
• 9ecf719 Fix template in alternative namespaces
• 2788c12 Merge pull request #5338 from b84330808/fix/template-shadowroot-types
• 9069f5a test: remove the type tests again
• 4ab827e test: drop the template shadow root type tests
• 3151183 Drop the type tests, per review
• 39d2920 fix(types): add declarative shadow DOM attributes to <template>
• 66b6e56 Merge pull request #5336 from preactjs/release/11.1.0
• Additional commits viewable in compare view

Updates preact-render-to-string from 6.8.1 to 6.8.2

Release notes

Sourced from preact-render-to-string's releases.

v6.8.2

Patch Changes

• #485 2dd9a3a Thanks @​JoviDeCroock! - Fix renderToStringAsync stringifying suspended children inside precompiled JSX templates

• #489 7be3108 Thanks @​JoviDeCroock! - Use Preact's VNode recognition across renderers.

Changelog

Sourced from preact-render-to-string's changelog.

6.8.2

Patch Changes

• #485 2dd9a3a Thanks @​JoviDeCroock! - Fix renderToStringAsync stringifying suspended children inside precompiled JSX templates

• #489 7be3108 Thanks @​JoviDeCroock! - Use Preact's VNode recognition across renderers.

Commits

• dc7d06b Merge pull request #486 from preactjs/changeset-release/main
• a927b46 Version Packages
• 6d233e7 Merge pull request #489 from preactjs/harden-vnode-recognition
• 7be3108 Harden vnode recognition
• 1647315 Merge pull request #485 from preactjs/test/async-template-suspense
• 2dd9a3a fix: resolve suspended children in precompiled templates
• 1389e91 test: cover suspended children in precompiled templates
• See full diff in compare view

Updates ws from 8.22.0 to 8.22.1

Release notes

Sourced from ws's releases.

8.22.1

Bug fixes

• The path of IPC URLs is no longer truncated at : (#2344).

Other notable changes

• http.websocketMask() and http.websocketUnmask() are now used instead of the bufferutil variants when available (2ab3d3e5).
• Sender.frame() no longer returns empty chunks (85319a72).

Commits

• c18a80a [dist] 8.22.1
• 2ab3d3e [minor] Use http.websocket{M,Unm}ask() if possible (#2347)
• c9efa88 [ci] Test on node 27
• aa91518 [test] Skip test on Node.js versions where it does not apply (#2340)
• b54ca10 [fix] Do not truncate the URL path of IPC URLs at : (#2344)
• 85319a7 [minor] Prevent Sender.frame() from returning empty chunks
• See full diff in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions