chore(deps-dev): bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @sveltejs/kit, brace-expansion, js-yaml and postcss.

Updates @sveltejs/kit from 2.61.1 to 2.70.2

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.70.2

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (#1)

@​sveltejs/kit@​2.70.1

Patch Changes

• docs: update links to hooks documentation (#16417)

@​sveltejs/kit@​2.70.0

Minor Changes

• feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

• fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

@​sveltejs/kit@​2.69.3

Patch Changes

• fix: detect destructured load and actions exports during type generation (#16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

@​sveltejs/kit@​2.69.2

Patch Changes

• fix: set define values on globalThis when running Vitest (#16246)

@​sveltejs/kit@​2.69.1

Patch Changes

• fix: prevent prototype pollution when deleting file inputs (#16218)

• fix: prevent unhandled promise rejection (#16219)

@​sveltejs/kit@​2.69.0

Minor Changes

• feat: expose submitted property of remote forms (#14811)

Patch Changes

... (truncated)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.70.2

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (#1)

2.70.1

Patch Changes

• docs: update links to hooks documentation (#16417)

2.70.0

Minor Changes

• feat: move defineEnvVars to @sveltejs/kit/env (#16378)

Patch Changes

• fix: enable CSRF protection in builds with a non-production NODE_ENV value (#16313)

2.69.3

Patch Changes

• fix: detect destructured load and actions exports during type generation (#16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

2.69.2

Patch Changes

• fix: detect destructured load and actions exports during type generation (#16329)

• fix: ensure CSS URL references are absolute when paths.relative is false (#16315)

• fix: exclude deleted cookies from cookies.getAll() so it stays consistent with cookies.get() (#16297)

• fix: reset failed <svelte:boundary> on client navigation so a stale +error.svelte is torn down (#16296)

• fix: preserve shared client chunk hashes when the app version changes (#16324)

• fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)

• fix: use mouseover+mousemove for preloading to reduce events (#16325)

... (truncated)

Commits

• a297aff Version Packages (#16571)
• 82712fc Merge commit from fork
• 4c2355f Version Packages (#16418)
• c1665b9 docs: update hooks page (#16417)
• 4da36e6 Version Packages (#16343)
• 78f28f1 feat: move defineEnvVars to @sveltejs/kit/env (#16378)
• ffa0e3b fix: don't disable CSRF protection in builds with a non-production NODE_ENV (...
• 80b18f5 Version Packages (#16316)
• b557b1b fix: align MAX_COOKIE_SIZE with RFC 6265bis (#16322)
• 14d7d5a fix: detect destructured route exports during type generation (#16329)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.15 to 1.1.18

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• See full diff in compare view

Updates js-yaml from 4.2.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

• [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

• Restore umd builds back to es5.

Removed

• [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• 33d05b5 4.3.0 released
• 663bfab Drop demo publish, to not override new v5 one.
• 1cb8c7b Add v4-legacy tag for publish
• 02f27af Restore umd builds back to es5
• 8be84ed Fix es5 compatibility
• 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
• 6842ef6 doc polish
• See full diff in compare view

Updates postcss from 8.5.15 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).

... (truncated)

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml