chore: update dependencies

[dobby-coder]

Routine dep-update-scan (2026-05-24) flagged outdated dependencies on this repo. npm audit is clean.

Outdated packages

• @e4a/pg-js: 1.8.0 → 1.10.0
• @sveltejs/kit: 2.60.1 → 2.61.1
• libphonenumber-js: 1.13.2 → 1.13.3
• prettier-plugin-svelte: 4.0.0 → 4.0.1
• sass: 1.99.0 → 1.100.0
• svelte-preprocess: 6.0.3 → 6.0.4
• vite: 8.0.13 → 8.0.14

All patch/minor bumps. Note: install currently requires --legacy-peer-deps because of a svelte-preprocess 6.0.3 peerOptional conflict with typescript 5.9.3 — the 6.0.4 bump may or may not resolve this; verify and adjust install commands accordingly.

Coordination: existing issue #235 covers a follow-up from the prettier-plugin-svelte major bump (PR #234) — keep this PR separate from that work unless the worker concludes consolidation is cleaner.

Worker instructions

Before bumping anything:

1. Pull the repo and check the lockfile + recent git log on main — many of these may have already been resolved.
2. For each package in the list below, grep the source tree (excluding manifest/lockfile) to confirm the package is actually imported. If a package is unused, open a removal PR for it instead of a bump.
3. Apply bumps in this order: security advisories → patch/minor → majors. Use one branch per coherent area.
4. Build and run the full test suite. If there's no test suite, note "no tests to verify" in the PR body.
5. Open a draft PR with title chore: update dependencies (or chore(security): ... if security-driven). PR body should use Closes #<this-issue>.
6. After CI passes: gh pr ready <num>. If the repo has no CI workflow, open ready from the start.
7. Add reviewer: --add-reviewer rubenhensen.

Conventions:

• Conventional-commit PR title (chore:, fix:, feat:).
• If a bump turns out to be a no-op (already on main), close the issue with evidence (commit/PR hash) — do not ship an empty PR.

/dobby

[dobby-coder]

On it. This agent will pull the repo, verify each package is actually used, check whether anything is already on main, then ship a single chore PR for the patch/minor bumps. Keeping scope away from #235 (the prettier-plugin-svelte follow-up) per the coordination note.

[dobby-coder]

Plan

Confirmed against the lockfile on main: none of these have been pre-empted by a recent commit. All seven packages are imported/used in the source tree (verified via grep, excluding manifest/lockfile).

Bumps to apply (all patch/minor)

• @e4a/pg-js 1.8.0 → 1.10.0
• @sveltejs/kit 2.60.1 → 2.61.1
• libphonenumber-js 1.13.2 → 1.13.3
• prettier-plugin-svelte 4.0.0 → 4.0.1
• sass 1.99.0 → 1.100.0
• svelte-preprocess 6.0.3 → 6.0.4
• vite 8.0.13 → 8.0.14

Approach

• One branch, one PR: chore/dep-updates-2026-05-24 titled chore: update dependencies.
• Stay out of chore: follow-up from PR #234 — chore: bump prettier-plugin-svelte 3.5.2 -> 4.0.0 #235's scope (engines floor, upstream prettier-plugin-svelte link).
• Update the lockfile via npm install --legacy-peer-deps (typescript ^6 still conflicts with svelte-preprocess's peerOptional typescript ^5 — see repo dep-bump-gotchas note; will recheck whether 6.0.4 relaxed it).
• Run npm run build, npm run check, npm run lint, npm run test before pushing.
• Pre-existing husky .svelte pre-commit issue is documented; not in scope here.
• PR body: Closes #236, reviewer @rubenhensen. Open as ready (or flip after CI green per default-prs-to-ready).