build(deps): bump the theme-npm group across 1 directory with 7 updates

[dependabot]

Bumps the theme-npm group with 7 updates in the /wp-content/themes/wp-starter directory:

Package	From	To
@alpinejs/focus	3.17.3	3.17.4
@alpinejs/persist	3.17.3	3.17.4
alpinejs	3.17.3	3.17.4
cssnano	9.0.5	9.2.0
prettier	3.9.8	3.9.9
sharp	0.35.4	0.35.5
vite	8.3.0	8.3.2

Updates @alpinejs/focus from 3.17.3 to 3.17.4

Release notes

Sourced from @​alpinejs/focus's releases.

v3.17.4

What's Changed

• Fix mutation observer recovery after errors by @​BillyNoyes in alpinejs/alpine#4908
• Add viewport modifier to resize plugin by @​BillyNoyes in alpinejs/alpine#4910

New Contributors

• @​BillyNoyes made their first contribution in alpinejs/alpine#4908

Full Changelog: alpinejs/alpine@v3.17.3...v3.17.4

Commits

• c7fa1bf Bump version to 3.17.4
• See full diff in compare view

Updates @alpinejs/persist from 3.17.3 to 3.17.4

Release notes

Sourced from @​alpinejs/persist's releases.

v3.17.4

What's Changed

• Fix mutation observer recovery after errors by @​BillyNoyes in alpinejs/alpine#4908
• Add viewport modifier to resize plugin by @​BillyNoyes in alpinejs/alpine#4910

New Contributors

• @​BillyNoyes made their first contribution in alpinejs/alpine#4908

Full Changelog: alpinejs/alpine@v3.17.3...v3.17.4

Commits

• c7fa1bf Bump version to 3.17.4
• See full diff in compare view

Updates alpinejs from 3.17.3 to 3.17.4

Release notes

Sourced from alpinejs's releases.

v3.17.4

What's Changed

• Fix mutation observer recovery after errors by @​BillyNoyes in alpinejs/alpine#4908
• Add viewport modifier to resize plugin by @​BillyNoyes in alpinejs/alpine#4910

New Contributors

• @​BillyNoyes made their first contribution in alpinejs/alpine#4908

Full Changelog: alpinejs/alpine@v3.17.3...v3.17.4

Commits

• c7fa1bf Bump version to 3.17.4
• a7e2802 Fix mutation observer recovery after errors (#4908)
• See full diff in compare view

Updates cssnano from 9.0.5 to 9.2.0

Release notes

Sourced from cssnano's releases.

v9.2.0

Features

• Merge box alignment properties into the place-content, place-items and place-self shorthands, such as align-items:center;justify-items:start into place-items:center start. This only happens when every browser in your Browserslist targets supports the shorthands, because a browser that does not would ignore both alignments. The defaults query includes browsers with unknown support, such as Opera Mini and UC Browser, so it keeps the longhands. Values that use safe, unsafe or last baseline merge only when both values use the same keywords. postcss-merge-longhand now accepts the Browserslist options overrideBrowserslist, stats, path and env.

Fixes

• Write numbers in scientific notation when it is shorter, such as 1e-6px for 0.000001px and 1e6px for 1000000px. This also applies when length unit conversion is disabled. Numbers written without a decimal point, such as z-index:1000000, keep their form, because an <integer> cannot use scientific notation.

• Stop merging longhands across a nested rule or at-rule. The shorthand ended up after the nested rule and overrode it, so in a{margin-top:1px;&{margin-top:2px}…} the nested margin-top was lost. This applies to margin, padding, border, border-radius and columns. Declarations on each side of a nested rule are now merged separately. An at-rule without a block, such as @apply x;, also separates them, since it may add declarations. An empty rule such as &{} does not. A border-image or all declaration before a nested rule no longer prevents merging the border longhands after it.

• Stop merging rules that have an invalid selector, such as b: hover, [a b], :lang(en fr) or a||b. An invalid selector makes the whole selector list invalid, so the browser also dropped the valid rule it was merged with.

• Only treat a dimension as the font size in the font shorthand when it has a length unit. An invalid value such as font:bold 1s "Arial Black" is now left unchanged.

• Leave the font shorthand unchanged when it contains attr(), if(), inherit() or a custom function such as --name(), as already done for var() and env(). Their result is only known when the browser computes the value.

• Remove a zero color stop position only when it has the right type for the gradient. conic-gradient() now drops 0deg and keeps an invalid 0px, while linear and radial gradients still drop 0px. -webkit-linear-gradient() keeps to bottom and other to directions as written, since the prefixed syntax measures angles differently.

• Stop turning a comment inside a selector into a descendant combinator. A comment is not whitespace, so .a/**/.b selects elements with both classes, including inside :is(), and is no longer rewritten as .a .b. Invalid selectors such as div/**/span are left as written instead of becoming valid.

• Leave rules with an invalid selector unchanged, including an ID selector that starts with a digit, such as #1a, and a combinator after a pseudo-element, such as a::before b.

• Shorten top center and bottom center to top and bottom, instead of 0 and 100%, which the browser reads as horizontal positions. center top and center bottom are now shortened the same way.

  Leave a position unchanged when it cannot be safely rewritten:

  • in a background layer where another value splits the position, as in left no-repeat center, which is invalid;
  • when it contains a function such as attr(), if() or a custom --function(), which may return a keyword, as var() already did;
  • when an invalid three-value position contains a math function, such as left abs(1px) top, as calc() already did.

• Keep strings unchanged when removing a line continuation (a backslash before a newline) right after an escape. In "\31 followed by a line continuation and 2", joining the lines would turn \31 into \312, so the result is now "\31 2".

  Leave @charset unchanged. Browsers only recognize it with double quotes, so rewriting single quotes would make an ignored @charset take effect.

• Update postcss-calc to 11.2.2. postcss-calc() now attempts to preserve fractions if the replacement would lose too much precision

v9.1.2

What's Changed

• fix: collapse redundant whitespace in at-rules in cssnano/cssnano#1999

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.1.1...cssnano@9.1.2

v9.1.1

What's Changed

Bug Fixes

• fix(postcss-convert-values): preserve unicode range in cssnano/cssnano#1995

Full Changelog: https://github.com/cssnano/cssnano/compare/cssnano@9.1.0...cssnano@9.1.1

... (truncated)

Commits

• f011fb4 Publish cssnano 9.2.0
• cd567b6 fix(postcss-merge-idents): fix edge case when identifier ends with backslash
• 1ce0d19 fixup! chore: update source map
• 8bb86dc chore: remove unpublished convertExponent option
• 2e521dd docs: improve changeset language
• 4b95072 chore: update source map
• e6411ff build(deps): bump pnpm/setup
• ae0f9cb chore: update mdn-data
• e64f904 docs: improve language
• 5ee423c fix: bug fixes found during review
• Additional commits viewable in compare view

Updates prettier from 3.9.8 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)

... (truncated)

Commits

• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• 1929b4c docs: fix dead og-image PNG links in vite6/vite7 changelog entries (#23594)
• 6894f5c fix(server): handle file watcher errors without crashing (#23503)
• cf5c028 perf(build): avoid quadratic link scan in the preload helper (#23510)
• bba3bb8 fix: merge build.rolldownOptions.output.minify correctly (#23536)
• 5e4b9ca fix(optimize-deps): avoid "unsupported" warnings for browser:false mappings (...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions