[TrapsterDK]

Dependency update as of 2026-11-05, applied with dx update --apply <set:package> <version> (lockfiles regenerated by the owning tools). Non-major versions only. Note: dx update --outdated with JSON output fails on this tree (invalid command mode "outdated"); I used -o text.

Kind	Updated (from -> to)
Bazel	.bazelversion 9.2.0 -> 9.3.1
bazel_dep (floor and tested together)	apple_support 2.10.1 -> 2.11.0, rules_apple 5.3.1 -> 5.4.0, rules_scala 7.4.0 -> 7.4.1, libxml2 2.15.3 -> 2.15.4, tar.bzl 0.10.4 -> 0.10.9, googletest 1.18.0 -> 1.18.0.bcr.1
crates (dx_crates)	cc 1.4.5 -> 1.11.0, cxx and cxx-gen 1.0.202 -> 1.0.205, wasm-bindgen 0.2.128 -> 0.2.130
crates (dx_quality_crates)	anyhow, clap 4.6.7, ignore 0.4.34, indexmap 2.14.2, lazy_static 1.5.1, proc-macro2, quote, serde 1.0.229, serde_json 1.0.154, sha2 0.11.1, similar 3.2.1, toml 1.2.0
npm (root)	astro 7.4.5, @astrojs/preact 6.1.1, jest/jest-cli/jest-environment-jsdom 30.5.2, svelte 5.57.3, svelte-check 4.7.8, vite 8.3.6, vue and @vue/compiler-sfc 3.5.44, vue-tsc 3.3.14
npm (tools)	@redocly/cli 2.75.0, eslint 10.14.0, eslint-plugin-mdx 3.9.1, eslint-plugin-svelte 3.24.0, gplint 2.6.1, prettier 3.9.10, svelte, svelte-check, svelte-eslint-parser 1.10.1, vue-component-meta, vue-tsc, wrangler 4.157.0
npm (node-app)	jest, jest-cli 30.5.2, semver 7.8.6, @types/semver 7.8.0
uv	djlint 1.49.9, mbake 1.5.0, click 8.5.0, coverage 7.17.2, python-geohash 0.9.2 (two sets)
Go	goldmark 1.8.6 -> 1.8.7, x/mod 0.41.0 -> 0.42.0, x/net 0.59.0 -> 0.62.0
GitHub Actions	create-github-app-token v3.3.0, deploy-pages v5.0.1, download-artifact v8.0.2, upload-artifact v7.0.2, upload-pages-artifact v5.0.0, setup-bazel 0.19.1 (SHA pins)
NuGet	fantomas 8.1.1, xunit.v3 4.0.2, xunit.analyzers 2.2.0

Held back

• Rust majors / 0.x breaking bumps (API migration): base64 0.22->0.23, clap_mangen 0.2->0.3, gomod-parser 0.5->0.6, md-5/sha1/sha2 0.10->0.11, notify-debouncer-mini 0.6->0.7, object 0.36->0.40, quick-xml 0.41->0.42, rand 0.8->0.10, saphyr-parser 0.2->0.3, syn 2->3, codespan/codespan-reporting 0.11->0.13, dirs 4->7, rnix 0.14->0.15, rowan 0.16->0.17, tree-sitter 0.26->0.27, tree-sitter-ocaml 0.24->0.26, ordered-float 3->5
• npm majors: typescript 6/5.9->7.0.2, preact 10->11, jest-junit 16->17, graphql 16->17, stylelint 17->18, asciidoctor 3->4, @types/node 22->26
• go golang.org/x/tools 0.51.0->0.52.0: bump changes go.mod transitive requirements (go changed go.mod), needs manual tidy
• uv: pytest 8.3.4->9.2.0 (major)
• maven scalatest/scalactic 3.2.20->3.3.0-SNAP4 (snapshot); rules_python 2.5.0-rc0, protobuf 37.0-rc1, gazelle 2.0.0-beta.2 (prereleases); rules_perl 1.5.0->2.1.0 and lua 5.4.6->5.5.0 (major)
• NuGet FSharp.Core 11, FSharp.Compiler.Service, Ionide.ProjInfo 0.75, Microsoft.Build 17.x->18.11: coupled paket resolution across sets, needs separate migration
• Toolchain pins (tools pins.bzl, http_archive sha256 matrices): not covered by the updater, not touched

Tested

• tools/dx check --apply --affected (widened to //...): generate failed with deploy/rules/Cargo.lock is not wired; add a crate.from_cargo for it (unrelated to this change; format/lint/typecheck skipped).
• tools/dx test --affected: analysis fails with android_check() got unexpected keyword argument: target_compatible_with in @rules_dx_android (families/android, unrelated to any dep touched here), which aborted the rest of the build; no test failures reported, results incomplete.
• Evidence run 41995398133 (//cli/... //tools/..., linux/windows/macos_arm64): all three legs hit the same android_check target_compatible_with analysis error (present on main, in families/android) and report "All tests passed but there were other errors during the build"; no dependency-related failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_011u9TXHDZrfmzFQ2WT8QAKK