Update non-major-updates

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@sveltejs/kit (source)	2.49.4 → 2.50.0			devDependencies	minor
node (source)	24.12.0 → 24.13.0				minor
prettier (source)	3.7.4 → 3.8.0			devDependencies	minor
svelte (source)	5.46.1 → 5.47.0			devDependencies	minor

---

Release Notes

sveltejs/kit (@​sveltejs/kit)

v2.50.0

Compare Source

Minor Changes

• breaking: remove buttonProps from experimental remote form functions; use e.g. <button {...myForm.fields.action.as('submit', 'register')}>Register</button> button instead (#​15144)

v2.49.5

Compare Source

Patch Changes

• fix: avoid overriding Vite default base when running Vitest 4 (#​14866)

• fix: ensure url decoded pathnames are not mistaken as rerouted requests (d9ae9b0)

• fix: add length checks to remote forms (8ed8155)

nodejs/node (node)

v24.13.0: 2026-01-13, Version 24.13.0 'Krypton' (LTS), @​marco-ippolito

Compare Source

This is a security release.

Notable Changes

lib:

• (CVE-2025-59465) add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• (CVE-2025-55132) disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
  lib,permission:
• (CVE-2025-55130) require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
  src:
• (CVE-2025-59466) rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
  src,lib:
• (CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
  tls:
• (CVE-2026-21637) route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

Commits

• [2092785d01] - deps: update c-ares to v1.34.6 (Node.js GitHub Bot) #​60997
• [3e58b7f2af] - deps: update undici to 7.18.2 (Node.js GitHub Bot) #​61283
• [4ba536a5a6] - (CVE-2025-59465) lib: add TLSSocket default error handler (RafaelGSS) nodejs-private/node-private#797
• [89adaa21fd] - (CVE-2025-55132) lib: disable futimes when permission model is enabled (RafaelGSS) nodejs-private/node-private#748
• [7302b4dae1] - (CVE-2025-55130) lib,permission: require full read and write to symlink APIs (RafaelGSS) nodejs-private/node-private#760
• [ac030753c4] - (CVE-2025-59466) src: rethrow stack overflow exceptions in async_hooks (Matteo Collina) nodejs-private/node-private#773
• [20075692fe] - (CVE-2025-55131) src,lib: refactor unsafe buffer creation to remove zero-fill toggle (Сковорода Никита Андреевич) nodejs-private/node-private#759
• [20591b0618] - (CVE-2026-21637) tls: route callback exceptions through error handlers (Matteo Collina) nodejs-private/node-private#796

prettier/prettier (prettier)

v3.8.0

Compare Source

diff

🔗 Release note

sveltejs/svelte (svelte)

v5.47.0

Compare Source

Minor Changes

• feat: customizable <select> elements (#​17429)

Patch Changes

• fix: mark subtree of svelte boundary as dynamic (#​17468)

• fix: don't reset static elements with debug/snippets (#​17477)

v5.46.4

Compare Source

Patch Changes

• fix: use devalue.uneval to serialize hydratable keys (ef81048e238844b729942441541d6dcfe6c8ccca)

v5.46.3

Compare Source

Patch Changes

• fix: reconnect clean deriveds when they are read in a reactive context (#​17362)

• fix: don't transform references of function declarations in legacy mode (#​17431)

• fix: notify deriveds of changes to sources inside forks (#​17437)

• fix: always reconnect deriveds in get, when appropriate (#​17451)

• fix: prevent derives without dependencies from ever re-running (286b40c4526ce9970cb81ddd5e65b93b722fe468)

• fix: correctly update writable deriveds inside forks (#​17437)

• fix: remove $inspect calls after await expressions when compiling for production server code (#​17407)

• fix: clear batch between runs (#​17424)

• fix: adjust loc property of Program nodes created from <script> elements (#​17428)

• fix: don't revert source to UNINITIALIZED state when time travelling (#​17409)

---

Configuration

📅 Schedule: Branch creation - "after 8am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.