Bump the "javascript-apps" group with 2 updates across multiple ecosystems

[dependabot]

Bumps the javascript-apps group with 3 updates in the / directory: ses, simple-statistics and trading-signals.
Bumps the javascript-apps group with 6 updates in the /apps/arena-admin directory:

Package	From	To
@sveltejs/kit	2.70.1	2.70.3
@sveltejs/vite-plugin-svelte	7.2.0	7.3.0
svelte	5.56.7	5.56.10
svelte-check	4.7.3	4.7.6
tailwind-variants	3.2.2	3.3.1
vite	8.1.5	8.2.2

Updates ses from 2.2.0 to 2.3.0

Release notes

Sourced from ses's releases.

ses@2.3.0

Minor Changes

• #3308 4da9a99 Thanks @​kriskowal! - Drop the immutable-ArrayBuffer pseudo-prototype.

  Emulated immutable ArrayBuffers produced by @endo/immutable-arraybuffer now inherit directly from ArrayBuffer.prototype rather than from an intermediate prototype. Object.getPrototypeOf(immuAB) === ArrayBuffer.prototype for both emulated immutable and genuine buffers; the brand check is the new immutable accessor on ArrayBuffer.prototype installed by the shim.

  The [Symbol.toStringTag] slot is preserved as an own property on each emulated immutable buffer (not on the shared prototype), so Object.prototype.toString.call(immuAB) continues to return '[object ImmutableArrayBuffer]' (as in master) while genuine ArrayBuffers continue to read as '[object ArrayBuffer]'. This keeps concordance (and any other downstream consumer that sniffs the toStringTag to decide whether the value is a genuine exotic) from misrouting an emulated immutable through Node's Buffer.from, which throws because the emulated immutable is not an exotic object.

  @endo/immutable-arraybuffer is now a side-effect-only package: its sole public export is ./shim.js. The index.js and the package's . entry are removed; the previously exported names (isBufferImmutable, sliceBufferToImmutable, optTransferBufferToImmutable) are no longer reachable from outside the package. Callers detect immutability via the ArrayBuffer.prototype.immutable accessor (or Object.prototype.toString.call(buffer) === '[object ImmutableArrayBuffer]' when the shim has not been loaded) and convert via buffer.sliceToImmutable(...) and buffer.transferToImmutable(...) on the prototype. The break is a major bump for the @endo/immutable-arraybuffer package.

  @endo/bytes's to-immutable.js imports @endo/immutable-arraybuffer/shim.js (triggering the shim install) and calls buffer.sliceToImmutable(...) on ArrayBuffer.prototype instead of the previously exported sliceBufferToImmutable free function.

  The shim's install policy is now detect-then-skip rather than warn-and-overwrite: the Immutable ArrayBuffer proposal has reached stage 3, so any prior installation (native or previously loaded shim) wins. If 'sliceToImmutable' in ArrayBuffer.prototype is already true when the shim loads, the shim does nothing.

  ses drops the %ImmutableArrayBufferPrototype% permits entry, which no longer has a referent. The three permits lines inside %ArrayBufferPrototype% that declare the shim-installed methods (transferToImmutable, sliceToImmutable, immutable) stay as-is.

  @endo/pass-style's byteArray brand check no longer routes through an intermediate prototype; it consults the immutable accessor on ArrayBuffer.prototype directly. The check also tolerates the [Symbol.toStringTag] own-property on emulated immutable buffers and verifies that its value is a non-enumerable data property with a string value.

• #3322 eeefaa0 Thanks @​kriskowal! - Permit TextEncoder and TextDecoder as universal intrinsics.

  TextEncoder and TextDecoder are pure transformations between string and Uint8Array with no static side channels, so they are now permitted on every compartment (start compartment and every compartment created after lockdown, identity-equal). Their prototypes are frozen alongside the other tamed primordials. On hosts that do not provide them (XS), lockdown proceeds without them and compartments observe their absence as before.

  Code that monkey-patches TextEncoder.prototype or TextDecoder.prototype after lockdown() will now throw, because the prototypes are frozen. Such mutations must happen before lockdown, the same rule that already applies to every other intrinsic.

• #3220 d47d74f Thanks @​boneskull! - Exposes __noNamespaceBox__ getter on Compartment.

• #3316 71cbdb9 Thanks @​boneskull! - makeError() now allows a code?: string option, which sets a code property on the resulting Error, if so desired.

Patch Changes

• #3306 a85b212 Thanks @​gibson042! - - consoleTaming: 'safe' prevents Node.js console logging from invoking custom inspect methods

• #3307 c69eb03 Thanks @​gibson042! - The console format specifier %c is for consuming a CSS style string and applying that style to the rendering of the remaining arguments. Node.js and browsers both parse %c the same way and have it consume one argument.

  • Browsers actually make use of the CSS, leading to security problems (e.g., https://issues.chromium.org/40056332 ).
  • Node.js ignores the %c and its corresponding argument, which is allowed by the WHATWG Console specification.

  To avoid the CSS security problems on all platforms, under the defaut consoleTaming: 'safe', we now sanitize out the %c and corresponding argument, emulating the allowed current Node.js behavior on all platforms. This fixes this CSS vulnerability while maintaining compatibility with the specification. We also treat unknown specifiers in a future-proof manner.

• #3309 bfa149b Thanks @​boneskull! - makeError now narrows type of return instance when errConstructor provided.

• Updated dependencies [4da9a99]:

  • @​endo/immutable-arraybuffer@​2.0.0

Changelog

Sourced from ses's changelog.

2.3.0

Minor Changes

• #3308 4da9a99 Thanks @​kriskowal! - Drop the immutable-ArrayBuffer pseudo-prototype.

  Emulated immutable ArrayBuffers produced by @endo/immutable-arraybuffer now inherit directly from ArrayBuffer.prototype rather than from an intermediate prototype. Object.getPrototypeOf(immuAB) === ArrayBuffer.prototype for both emulated immutable and genuine buffers; the brand check is the new immutable accessor on ArrayBuffer.prototype installed by the shim.

  The [Symbol.toStringTag] slot is preserved as an own property on each emulated immutable buffer (not on the shared prototype), so Object.prototype.toString.call(immuAB) continues to return '[object ImmutableArrayBuffer]' (as in master) while genuine ArrayBuffers continue to read as '[object ArrayBuffer]'. This keeps concordance (and any other downstream consumer that sniffs the toStringTag to decide whether the value is a genuine exotic) from misrouting an emulated immutable through Node's Buffer.from, which throws because the emulated immutable is not an exotic object.

  @endo/immutable-arraybuffer is now a side-effect-only package: its sole public export is ./shim.js. The index.js and the package's . entry are removed; the previously exported names (isBufferImmutable, sliceBufferToImmutable, optTransferBufferToImmutable) are no longer reachable from outside the package. Callers detect immutability via the ArrayBuffer.prototype.immutable accessor (or Object.prototype.toString.call(buffer) === '[object ImmutableArrayBuffer]' when the shim has not been loaded) and convert via buffer.sliceToImmutable(...) and buffer.transferToImmutable(...) on the prototype. The break is a major bump for the @endo/immutable-arraybuffer package.

  @endo/bytes's to-immutable.js imports @endo/immutable-arraybuffer/shim.js (triggering the shim install) and calls buffer.sliceToImmutable(...) on ArrayBuffer.prototype instead of the previously exported sliceBufferToImmutable free function.

  The shim's install policy is now detect-then-skip rather than warn-and-overwrite: the Immutable ArrayBuffer proposal has reached stage 3, so any prior installation (native or previously loaded shim) wins. If 'sliceToImmutable' in ArrayBuffer.prototype is already true when the shim loads, the shim does nothing.

  ses drops the %ImmutableArrayBufferPrototype% permits entry, which no longer has a referent. The three permits lines inside %ArrayBufferPrototype% that declare the shim-installed methods (transferToImmutable, sliceToImmutable, immutable) stay as-is.

  @endo/pass-style's byteArray brand check no longer routes through an intermediate prototype; it consults the immutable accessor on ArrayBuffer.prototype directly. The check also tolerates the [Symbol.toStringTag] own-property on emulated immutable buffers and verifies that its value is a non-enumerable data property with a string value.

• #3322 eeefaa0 Thanks @​kriskowal! - Permit TextEncoder and TextDecoder as universal intrinsics.

  TextEncoder and TextDecoder are pure transformations between string and Uint8Array with no static side channels, so they are now permitted on every compartment (start compartment and every compartment created after lockdown, identity-equal). Their prototypes are frozen alongside the other tamed primordials. On hosts that do not provide them (XS), lockdown proceeds without them and compartments observe their absence as before.

  Code that monkey-patches TextEncoder.prototype or TextDecoder.prototype after lockdown() will now throw, because the prototypes are frozen. Such mutations must happen before lockdown, the same rule that already applies to every other intrinsic.

• #3220 d47d74f Thanks @​boneskull! - Exposes __noNamespaceBox__ getter on Compartment.

• #3316 71cbdb9 Thanks @​boneskull! - makeError() now allows a code?: string option, which sets a code property on the resulting Error, if so desired.

Patch Changes

• #3306 a85b212 Thanks @​gibson042! - - consoleTaming: 'safe' prevents Node.js console logging from invoking custom inspect methods

• #3307 c69eb03 Thanks @​gibson042! - The console format specifier %c is for consuming a CSS style string and applying that style to the rendering of the remaining arguments. Node.js and browsers both parse %c the same way and have it consume one argument.

  • Browsers actually make use of the CSS, leading to security problems (e.g., https://issues.chromium.org/40056332 ).
  • Node.js ignores the %c and its corresponding argument, which is allowed by the WHATWG Console specification.

  To avoid the CSS security problems on all platforms, under the defaut consoleTaming: 'safe', we now sanitize out the %c and corresponding argument, emulating the allowed current Node.js behavior on all platforms. This fixes this CSS vulnerability while maintaining compatibility with the specification. We also treat unknown specifiers in a future-proof manner.

• #3309 bfa149b Thanks @​boneskull! - makeError now narrows type of return instance when errConstructor provided.

• Updated dependencies [4da9a99]:

  • @​endo/immutable-arraybuffer@​2.0.0

Commits

• 2982078 Version Packages (#3302)
• dc504ca fix(ses): fix Node.js-specific permits (#3340)
• fcfedee chore(ses): use real CjsModuleSource in import-cjs test
• d47d74f feat(ses): expose getter noNamespaceBox
• 7d434b9 fix(ses): drop redundant globalThis global directive
• 0174f4e test(ses): cover ignoreBOM, @@​toStringTag, constructor reverse-link, [[Proto]]
• eeefaa0 feat(ses): permit TextEncoder and TextDecoder as universal intrinsics
• bbbf824 chore(ses): lint
• b467b82 chore: lint everything
• 0594e99 feat(ses): add support for "code" prop in SES-managed Errors (#3130)
• Additional commits viewable in compare view

Updates simple-statistics from 7.9.3 to 7.10.2

Release notes

Sourced from simple-statistics's releases.

v7.10.2

Patch Changes

• 7063073: Make approxEqual's tolerance parameter optional in its type declaration. The implementation defaults it to the library's epsilon (0.0001), but the declaration required all three arguments, so TypeScript rejected the two-argument call the runtime supports. Runtime behavior is unchanged.
• 62d100a: Correct two JSDoc example values that the implementation does not produce: interquartileRange([0, 1, 2, 3]) returns 1.5 under the type-7 quantile interpolation the library switched to, not the documented 2, and weightedQuantile([1, 2, 3], [1, 1, 2], 0.5) returns 2 — the value its own tests assert — not the documented 3. Documentation-only; runtime behavior is untouched.
• 08369c8: Declare that jenks can return null. The implementation returns null whenever nClasses is greater than the number of data points — since the function's introduction — but the type declaration promised a plain number[], so TypeScript consumers under strictNullChecks got no warning before dereferencing the result. Runtime behavior is unchanged; only the declaration and docstring now state the null case.
• f25c2ba: Repair JSDoc that misrenders on the documentation site: quantileRank and quantileRankSorted now document their value parameter (it was missing, and the @returns description read "value value"), jenks's example is tagged @example so it renders as an example instead of leaking into the @returns description, and kMeansCluster's documented example output gets the missing comma that made it invalid JavaScript. Documentation-only; runtime behavior is untouched.
• 32096eb: Correct the third parameter of the permutationTest type declaration. It was named string and typed string, so TypeScript consumers saw permutationTest(sampleX, sampleY, string?: string, ...) with no indication of which values are accepted. It is now alternative?: "two_side" | "greater" | "less", matching the JSDoc and the three values the implementation accepts before it throws. Runtime behavior is unchanged. The rename is not breaking, since TypeScript binds parameters positionally, but the narrowed type will newly reject a call that passes an arbitrary string — such a call already threw at runtime.
• f59d6d2: Correct permutationTest's JSDoc to name the alternative value the implementation accepts. The docs described the two-sided test as two_tail and 'two_sided' (default), but passing either throws `alternative` must be either 'two_side', 'greater', or 'less'. — only 'two_side' is accepted. Documentation-only change; runtime behavior is untouched.

v7.10.1

Patch Changes

• 894958a: Fix chiSquaredGoodnessOfFit() reporting a fit it never measured. Collapsing a sparse class dropped the last class instead of the one that had just been merged, so observations were discarded and others double counted; an observation past the end of the hypothesized distribution had no expected frequency at all, which made the statistic NaN; and criticalValue < NaN is false, the same answer the function gives for a good fit. Degrees of freedom and significance levels the table does not cover now raise a descriptive error instead of a TypeError or a silent false.
• a078231: Declare that PerceptronModel#predict and PerceptronModel#train can return null. predict returns null when the feature array's length differs from what the model was trained on, and train returns null when the label is not 0 or 1 — both since their introduction — but the type declarations promised plain number and PerceptronModel, so TypeScript consumers under strictNullChecks got no warning before dereferencing the result. Runtime behavior is unchanged; only the declarations and docstrings now state the null cases.

v7.10.0

Minor Changes

• 2149cff: Fix poissonDistribution() and binomialDistribution() returning a truncated table ending in Infinity or NaN. Both built each cell from a power and a factorial (or a binomial coefficient) that leave floating-point range long before their product does, so the cumulative-probability stopping rule was satisfied by a non-finite sum instead of by the distribution: poissonDistribution(200) returned 135 cells covering 0.000045% of the distribution, and binomialDistribution(10000, 0.5) returned 135 cells covering none of it. Cells are now taken through gammaln, and a table that cannot be completed returns undefined rather than a partial one.

  NOTE: this is tagged as a minor change but you should be aware that it does change behavior for binomialDistribution. For most users this won't be a big deal.

  1. Both functions now return undefined in cases where they used to return an array of non-finite cells. binomialDistribution(5, NaN) returned [NaN] and now returns undefined. Their TypeScript declarations widen to number[] | undefined.
  2. Evaluating cells through logarithms costs a precision where the old product form was exact: binomialDistribution(2, 0.5) returns [0.25000000000000006, 0.5000000000000006, 0.25000000000000006] rather than [0.25, 0.5, 0.25]. This precision loss is small but if you're comparing exact results, it may require updates or rounding.

Patch Changes

• 13530b2: Fix wilcoxon rank-sum test behavior

  This fixes a bug in which the tie averaging in wilcoxonRankSum was incorrect and would return an unrelated position.

• 0779f22: Fix sampleRankCorrelation returning different results for the same data depending on the order the pairs are listed in. Tied values were given distinct consecutive ranks broken by original array position, rather than sharing the average of the ranks they span as Spearman's rho requires. Reordering rows could change the magnitude and even the sign of the result. Tied values now receive midranks, so the correlation depends only on the paired data. As a consequence an input with no rank variance — every value tied — now correctly returns NaN instead of reporting near-perfect correlation. Results for inputs with no ties are unchanged.

Changelog

Sourced from simple-statistics's changelog.

7.10.2

Patch Changes

• 7063073: Make approxEqual's tolerance parameter optional in its type declaration. The implementation defaults it to the library's epsilon (0.0001), but the declaration required all three arguments, so TypeScript rejected the two-argument call the runtime supports. Runtime behavior is unchanged.
• 62d100a: Correct two JSDoc example values that the implementation does not produce: interquartileRange([0, 1, 2, 3]) returns 1.5 under the type-7 quantile interpolation the library switched to, not the documented 2, and weightedQuantile([1, 2, 3], [1, 1, 2], 0.5) returns 2 — the value its own tests assert — not the documented 3. Documentation-only; runtime behavior is untouched.
• 08369c8: Declare that jenks can return null. The implementation returns null whenever nClasses is greater than the number of data points — since the function's introduction — but the type declaration promised a plain number[], so TypeScript consumers under strictNullChecks got no warning before dereferencing the result. Runtime behavior is unchanged; only the declaration and docstring now state the null case.
• f25c2ba: Repair JSDoc that misrenders on the documentation site: quantileRank and quantileRankSorted now document their value parameter (it was missing, and the @returns description read "value value"), jenks's example is tagged @example so it renders as an example instead of leaking into the @returns description, and kMeansCluster's documented example output gets the missing comma that made it invalid JavaScript. Documentation-only; runtime behavior is untouched.
• 32096eb: Correct the third parameter of the permutationTest type declaration. It was named string and typed string, so TypeScript consumers saw permutationTest(sampleX, sampleY, string?: string, ...) with no indication of which values are accepted. It is now alternative?: "two_side" | "greater" | "less", matching the JSDoc and the three values the implementation accepts before it throws. Runtime behavior is unchanged. The rename is not breaking, since TypeScript binds parameters positionally, but the narrowed type will newly reject a call that passes an arbitrary string — such a call already threw at runtime.
• f59d6d2: Correct permutationTest's JSDoc to name the alternative value the implementation accepts. The docs described the two-sided test as two_tail and 'two_sided' (default), but passing either throws `alternative` must be either 'two_side', 'greater', or 'less'. — only 'two_side' is accepted. Documentation-only change; runtime behavior is untouched.

7.10.1

Patch Changes

• 894958a: Fix chiSquaredGoodnessOfFit() reporting a fit it never measured. Collapsing a sparse class dropped the last class instead of the one that had just been merged, so observations were discarded and others double counted; an observation past the end of the hypothesized distribution had no expected frequency at all, which made the statistic NaN; and criticalValue < NaN is false, the same answer the function gives for a good fit. Degrees of freedom and significance levels the table does not cover now raise a descriptive error instead of a TypeError or a silent false.
• a078231: Declare that PerceptronModel#predict and PerceptronModel#train can return null. predict returns null when the feature array's length differs from what the model was trained on, and train returns null when the label is not 0 or 1 — both since their introduction — but the type declarations promised plain number and PerceptronModel, so TypeScript consumers under strictNullChecks got no warning before dereferencing the result. Runtime behavior is unchanged; only the declarations and docstrings now state the null cases.

7.10.0

Minor Changes

• 2149cff: Fix poissonDistribution() and binomialDistribution() returning a truncated table ending in Infinity or NaN. Both built each cell from a power and a factorial (or a binomial coefficient) that leave floating-point range long before their product does, so the cumulative-probability stopping rule was satisfied by a non-finite sum instead of by the distribution: poissonDistribution(200) returned 135 cells covering 0.000045% of the distribution, and binomialDistribution(10000, 0.5) returned 135 cells covering none of it. Cells are now taken through gammaln, and a table that cannot be completed returns undefined rather than a partial one.

  NOTE: this is tagged as a minor change but you should be aware that it does change behavior for binomialDistribution. For most users this won't be a big deal.

  1. Both functions now return undefined in cases where they used to return an array of non-finite cells. binomialDistribution(5, NaN) returned [NaN] and now returns undefined. Their TypeScript declarations widen to number[] | undefined.
  2. Evaluating cells through logarithms costs a precision where the old product form was exact: binomialDistribution(2, 0.5) returns [0.25000000000000006, 0.5000000000000006, 0.25000000000000006] rather than [0.25, 0.5, 0.25]. This precision loss is small but if you're comparing exact results, it may require updates or rounding.

Patch Changes

• 13530b2: Fix wilcoxon rank-sum test behavior

  This fixes a bug in which the tie averaging in wilcoxonRankSum was incorrect and would return an unrelated position.

• 0779f22: Fix sampleRankCorrelation returning different results for the same data depending on the order the pairs are listed in. Tied values were given distinct consecutive ranks broken by original array position, rather than sharing the average of the ranks they span as Spearman's rho requires. Reordering rows could change the magnitude and even the sign of the result. Tied values now receive midranks, so the correlation depends only on the paired data. As a consequence an input with no rank variance — every value tied — now correctly returns NaN instead of reporting near-perfect correlation. Results for inputs with no ties are unchanged.

Commits

• 7643ea9 Version Packages (#834)
• 32096eb fix(types): correct the alternative parameter in the permutationTest declarat...
• f25c2ba docs(jsdoc): repair quantileRank, jenks, and kMeansCluster rendering (#831)
• 62d100a docs(jsdoc): correct interquartileRange and weightedQuantile example values (...
• f59d6d2 docs(permutation-test): correct alternative values to 'two_side' (#828)
• 08369c8 fix(types): declare jenks return type as number[] | null (#832)
• 7063073 fix(types): make approxEqual tolerance parameter optional (#833)
• 0c33928 Use pnpm 11, not 10 (#827)
• 7b3a609 Update workflow inputs (#826)
• 6bec231 Update changesets to v3 across flow, update github workflows (#825)
• Additional commits viewable in compare view

Updates trading-signals from 7.4.3 to 8.3.0

Release notes

Sourced from trading-signals's releases.

trading-signals@8.3.0

8.3.0 (2026-08-11)

Features

• trading-signals: add Ichimoku Cloud, Keltner/Donchian Channels and Vortex Indicator (#1286)
• trading-signals: add nine oscillators (APO, BOP, COPPOCK, ERI, FI, FISHER, KST, KVO, TSI) (#1285)
• trading-signals: add six moving average variants (ALMA, FRAMA, T3, TRIMA, VIDYA, ZLEMA) (#1284)
• trading-signals: close the Cloud9Trader feature gap (PB, DPO, PGO, GAPO, PMO) (#1298)
• trading-signals: close the Highcharts indicator gap (Disparity Index) (#1292)
• trading-signals: close the indicatorts feature gap (8 indicators + KDJ %J line) (#1290)
• trading-signals: close the Jesse feature gap (9 indicators) (#1293)
• trading-signals: close the LEAN feature gap (10 indicators) (#1294)
• trading-signals: close the Pandas TA feature gap (8 indicators) (#1295)
• trading-signals: close the Stock Indicators .NET and StockSharp gaps (7 indicators) (#1296)
• trading-signals: expand the utility toolkit (#1305)
• trading-signals: finish the alternatives sourcing campaign (RWI, ADXR) (#1297)

Bug Fixes

• trading-signals: LINREG one-bar-ahead forecast + RSI declared warm-up (#1299)
• trading-signals: re-seed EMA, RMA and WSMA when the seeding price is replaced (#1287)

trading-signals@8.2.1

8.2.1 (2026-08-08)

Bug Fixes

• trading-signals: correct replace() across six indicators (#1261)

trading-signals@8.2.0

8.2.0 (2026-08-02)

Features

• trading-signals: add getTypicalPrice helper (#1270)

Changelog

Sourced from trading-signals's changelog.

8.3.0 (2026-08-11)

Features

• trading-signals: add Ichimoku Cloud, Keltner/Donchian Channels and Vortex Indicator (#1286)
• trading-signals: add nine oscillators (APO, BOP, COPPOCK, ERI, FI, FISHER, KST, KVO, TSI) (#1285)
• trading-signals: add six moving average variants (ALMA, FRAMA, T3, TRIMA, VIDYA, ZLEMA) (#1284)
• trading-signals: close the Cloud9Trader feature gap (PB, DPO, PGO, GAPO, PMO) (#1298)
• trading-signals: close the Highcharts indicator gap (Disparity Index) (#1292)
• trading-signals: close the indicatorts feature gap (8 indicators + KDJ %J line) (#1290)
• trading-signals: close the Jesse feature gap (9 indicators) (#1293)
• trading-signals: close the LEAN feature gap (10 indicators) (#1294)
• trading-signals: close the Pandas TA feature gap (8 indicators) (#1295)
• trading-signals: close the Stock Indicators .NET and StockSharp gaps (7 indicators) (#1296)
• trading-signals: expand the utility toolkit (#1305)
• trading-signals: finish the alternatives sourcing campaign (RWI, ADXR) (#1297)

Bug Fixes

• trading-signals: LINREG one-bar-ahead forecast + RSI declared warm-up (#1299)
• trading-signals: re-seed EMA, RMA and WSMA when the seeding price is replaced (#1287)

8.2.1 (2026-08-08)

Bug Fixes

• trading-signals: correct replace() across six indicators (#1261)

8.2.0 (2026-08-02)

Features

• trading-signals: add getTypicalPrice helper (#1270)

8.1.1 (2026-08-02)

Bug Fixes

• format lerna-generated changelogs via the version lifecycle (#1268)
• trading-signals, trading-strategies, candles, exchange: add repository metadata for npm provenance (#1267)

8.1.0 (2026-08-02)

Features

• trading-signals: add SuperTrend indicator (SUPERTREND) (#1238)
• trading-signals: add Volatility Stop indicator (VSTOP) (#1237)

Bug Fixes

... (truncated)

Commits

• a689363 [skip ci] chore: Publish
• 68ef214 docs(trading-signals): promote the utility methods list to a proper heading (...
• 0c58c18 refactor(trading-signals): categorize utilities into candle, statistics, perf...
• 4b35d3e feat(trading-signals): expand the utility toolkit (#1305)
• c1e8576 refactor(trading-signals): promote linear regression to a documented utility ...
• 4cede90 refactor(trading-signals): extract object-result signal tracking into shared ...
• 1a295df refactor(trading-signals): share the least-squares regression math via LINREG...
• 5298348 refactor(trading-signals): share Ehlers' dominant-cycle measurement between M...
• bd05cd4 refactor(trading-signals): extract overbought/oversold signal into shared Thr...
• 0260355 fix(trading-signals): LINREG one-bar-ahead forecast + RSI declared warm-up (#...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for trading-signals since your current version.

Updates @sveltejs/kit from 2.70.1 to 2.70.3

Release notes

Sourced from @​sveltejs/kit's releases.

@​sveltejs/kit@​2.70.3

Patch Changes

• fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

@​sveltejs/kit@​2.70.2

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (#1)

Changelog

Sourced from @​sveltejs/kit's changelog.

2.70.3

Patch Changes

• fix: avoid eagerly reading $app/state dependencies during module initialization (b61018d)

2.70.2

Patch Changes

• fix: prevent quadratic backtracking in Accept header content negotiation (82712fc)

Commits

• 39e8e1f Version Packages (#16771)
• b61018d fix: avoid eagerly reading $app/state dependencies during module
• 1ad0d43 chore: get Vercel split platform tests running (#16666)
• a297aff Version Packages (#16571)
• 82712fc Merge commit from fork
• See full diff in compare view

Updates @sveltejs/vite-plugin-svelte from 7.2.0 to 7.3.0

Release notes

Sourced from @​sveltejs/vite-plugin-svelte's releases.

@​sveltejs/vite-plugin-svelte@​7.3.0

Minor Changes

• feat: pass environment to dynamicCompileOptions (#1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#1376)

Changelog

Sourced from @​sveltejs/vite-plugin-svelte's changelog.

7.3.0

Minor Changes

• feat: pass environment to dynamicCompileOptions (#1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#1376)

Commits

• e6a89fc Version Packages (#1377)
• 2eeef7e feat: pass environment to dynamicCompileOptions (#1386)
• f92b24a fix(deps): update dependency magic-string to v1 (#1381)
• d3d4052 fix: don't log inline config when encountering unexpected options (#1376)
• c9feef6 chore: add type annotations to Inspector.svelte (#1372)
• See full diff in compare view

Updates svelte from 5.56.7 to 5.56.10

Release notes

Sourced from svelte's releases.

svelte@5.56.10

Patch Changes

• fix: preserve CSS escape sequences when printing selectors (#18667)

• fix: parse :nth-child(2n of.foo) where of is not followed by whitespace (#18611)

• fix: transform expressions inside labeled statements during server compilation (#18617)

• docs: clarify that context lookup includes the current component and all ancestors (#18581)

• fix: apply CSS custom properties with falsy values on components (#18634)

• fix: correctly print {#await ... catch x} et al (#18645)

• fix: ignore comments of Program node during migration script (#18656)

• fix: reliably resolve append_style to its correct root (#18614)

• fix: clean up removed capture event handlers from spread attributes (#18618)

• fix: don't corrupt renderer type during SSR's legacy bind: retry loop (#18616)

• fix: treat concise arrow function bodies as implicit returns when calculating blockers (#18613)

• fix: give effect teardowns the value from before the first write in a flush (#18620)

• fix: avoid double-calling a derived reference when destructuring $derived of another $derived during server-side rendering (#18668)

• fix: preserve namespaces in CSS type selectors (#18678)

• fix: increment private state fields through a non-this receiver (#18622)

• chore: deduplicate client and server context helpers (#18580)

• fix: release last_propagated_event after event propagation settles so it no longer retains the last event's target subtree (#18569)

• fix: allow custom elements to receive async values as props (#18661)

• fix: strip comments from inline style values in linear time (#18553)

• fix: prevent declaration comments from breaking server derived references (#18641)

• perf: make async blocker analysis scale linearly with the number of top-level references (#18549)

• fix: preserve short-circuiting for logical assignments to private state fields (#18594)

svelte@5.56.9

Patch Changes

... (truncated)

Changelog

Sourced from svelte's changelog.

5.56.10

Patch Changes

• fix: preserve CSS escape sequences when printing selectors (#18667)

• fix: parse :nth-child(2n of.foo) where of is not followed by whitespace (#18611)

• fix: transform expressions inside labeled statements during server compilation (#18617)

• docs: clarify that context lookup includes the current component and all ancestors (#18581)

• fix: apply CSS custom properties with falsy values on components (#18634)

• fix: correctly print {#await ... catch x} et al (#18645)

• fix: ignore comments of Program node during migration script (#18656)

• fix: reliably resolve append_style to its correct root (#18614)

• fix: clean up removed capture event handlers from spread attributes (#18618)

• fix: don't corrupt renderer type during SSR's legacy bind: retry loop (#18616)

• fix: treat concise arrow function bodies as implicit returns when calculating blockers (#18613)

• fix: give effect teardowns the value from before the first write in a flush (#18620)

• fix: avoid double-calling a derived reference when destructuring $derived of another $derived during server-side rendering (#18668)

• fix: preserve namespaces in CSS type selectors (#18678)

• fix: increment private state fields through a non-this receiver (#18622)

• chore: deduplicate client and server context helpers (#18580)

• fix: release last_propagated_event after event propagation settles so it no longer retains the last event's target subtree (#18569)

• fix: allow custom elements to receive async values as props (#18661)

• fix: strip comments from inline style values in linear time (#18553)

• fix: prevent declaration comments from breaking server derived references (#18641)

• perf: make async blocker analysis scale linearly with the number of top-level references (#18549)

• fix: preserve short-circuiting for logical assignments to private state fields (#18594)

5.56.9

... (truncated)

Commits

• 56a036f Version Packages (#18640)
• 545205b perf: make async blocker analysis linear (#18549)
• 950e2a8 fix: strip comments from inline style values in linear time (#18553)
• ffc0e6e fix: release last_propagated_event after event propagation settles (#18569)
• 2f684fe docs: clarify that context lookup includes the current component and all ance...
• 3feb34a chore: deduplicate client/server context helpers (#18580)
• 24130c1 fix: parse nth-child of syntax without whitespace after of (#18611)
• a166761 fix: treat concise arrow function bodies as implicit returns when calculating...
• @astrojs/starlight, astro and @astrojs/check.

  Updates @astrojs/starlight from 0.41.4 to 0.41.7

  Release notes

  Sourced from @​astrojs/starlight's releases.

  @​astrojs/starlight@​0.41.7

  Patch Changes

  • #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

  @​astrojs/starlight@​0.41.6

  Patch Changes

  • #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

  @​astrojs/starlight@​0.41.5

  Patch Changes

  • #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

  Changelog

  Sourced from @​astrojs/starlight's changelog.

  0.41.7

  Patch Changes

  • #4114 3e486fb Thanks @​delucis! - Fixes processing of code examples in RTL languages when using Astro’s Sätteri Markdown processor

  0.41.6

  Patch Changes

  • #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

  0.41.5

  Patch Changes

  • #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

  Commits

  • 656ffd5 [ci] release (#4115)
  • 612fd0a Update dependencies (#4113)
  • 3e486fb Refactor Sätteri RTL code support plugin (#4114)
  • ae0838f [ci] release (#4106)
  • f1dddc0 Add Forgejo icon (#4102)
  • 5b06909 [ci] release (#4097)
  • bb06434 Fix union schema extend regression (#4095)
  • See full diff in compare view
  
  

  Updates astro from 7.1.3 to 7.2.4

  Release notes

  Sourced from astro's releases.

  astro@7.2.4

  Patch Changes

  • #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

  • #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

  • #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

  • #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

  • Updated dependencies [05763a0, bc171af]:

    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/markdown-satteri@​0.3.7
    • @​astrojs/markdown-remark@​7.2.4

  astro@7.2.3

  Patch Changes

  • #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

  • #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

    The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

    As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

  • #17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

  • #17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

    • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
    • Two i18n configuration options were being used incorrectly in the examples.
    • The indentation of some code blocks was broken on hover.

  • #17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

  • #17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

  • #17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

  • #17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

  • Updated dependencies [8c193f6]:

    • @​astrojs/internal-helpers@​0.10.3
    • @​astrojs/markdown-remark@​7.2.3

  ... (truncated)

  Changelog

  Sourced from astro's changelog.

  7.2.4

  Patch Changes

  • #17747 a90ff66 Thanks @​Princesseuh! - Fixes builds hanging when an image file is malformed

  • #17701 05763a0 Thanks @​matthewp! - Fixes base path stripping to respect path-segment boundaries. With a configured base such as /docs, a request like /docs-archive/page is no longer treated as being under the base, so routing and context.url.pathname now agree on the same pathname.

  • #17742 70b449d Thanks @​Kjubikstronk! - Fixes astro build throwing TypeError: Missing parameter for dynamic routes when build.format: 'preserve' and trailingSlash: 'always' are used together. Stripping the framework-injected .html suffix dropped the trailing slash that the compiled route pattern requires, so the route no longer matched itself and its params resolved as empty.

  • #17703 771b0a9 Thanks @​astrobot-houston! - Fixes Astro.site always being undefined when rendering components via the Container API, even when site is set in astroConfig

  • Updated dependencies [05763a0, bc171af]:

    • @​astrojs/internal-helpers@​0.10.4
    • @​astrojs/markdown-satteri@​0.3.7
    • @​astrojs/markdown-remark@​7.2.4

  7.2.3

  Patch Changes

  • #17724 97140b2 Thanks @​ematipico! - Fixes an issue where Astro could run out of memory when experimental.collectionStorage is set to chunked and there are multiple concurrent updates to the same collection.

  • #17636 51723b1 Thanks @​matthewp! - Fixes the dev server sometimes matching against stale routes after pages were added, removed, or renamed, requiring a dev server restart to pick up the change

  • #17636 51723b1 Thanks @​matthewp! - Fixes the composable request helpers (astro/fetch) throwing an error when used on a request that had been rewritten with Astro.rewrite() or next()

  • #17636 51723b1 Thanks @​matthewp! - Refactors Astro's internal server-side request handling. This is an internal change: all documented public APIs, including App and NodeApp, keep their existing signatures and behavior.

    The undocumented internal app.pipeline property and the AppPipeline export from astro/app have been removed. Adapters that used app.pipeline.getLogger() to wait for the configured log destination can call the new app.getLogger() instead.

    As a result of this refactor, new FetchState(request) from astro/fetch now works anywhere inside a built Astro server — including custom src/fetch.ts entrypoints — without the request needing to first pass through app.render(). Previously this threw an error, breaking patterns like the Cloudflare adapter's advanced custom-worker setup.

  • #17723 c3b9aed Thanks @​florian-lefebvre! - Fixes a link in font providers JSDoc annotations

  • #17699 e28d227 Thanks @​ArmandPhilippot! - Fixes several documentation issues related to the JSDoc for configuration options.

    • When hovering over the server and fonts options, the JSDoc for the nested options was displayed instead of the JSDoc for the top-level property.
    • Two i18n configuration options were being used incorrectly in the examples.
    • The indentation of some code blocks was broken on hover.

  • #17572 2066f39 Thanks @​matthewp! - Fixes a crash when a request arrives with a malformed port in the Host header (for example example.com:65536 or example.com:8080:8080). Such a host made the constructed request URL invalid, and the fallback that was meant to recover reused the same invalid host and threw again. The request URL now degrades to a host the server controls when the incoming host cannot be parsed, so the request is handled instead of erroring.

  • #17685 9f15609 Thanks @​astrobot-houston! - Fixes a dev server error where an SSR full reload triggered by a third-party Vite plugin (such as @tailwindcss/vite) could fail with Failed to load url astro:server-app.js

  • #17636 51723b1 Thanks @​matthewp! - Improves error handling for custom log destinations. When the configured logger fails to load, Astro now reports the error and continues with the default console logger instead of failing the first request.

  • #17631 cf29bec Thanks @​matthewp! - Fixes getCollection() and getEntry() throwing DataCloneError when a collection schema transform returns a Temporal.PlainDate or other class instance.

  • Updated dependencies [8c193f6]:

  ... (truncated)

  Commits

  • 8a31cba [ci] release (#17739)
  • aeda810 [ci] format
  • a90ff66 fix(assets): harden vendored image-size box and entry checks (#17747)
  • 05763a0 Respect path-segment boundaries when stripping the configured base (#17701)
  • 70b449d fix(routing): keep the trailing slash when stripping an injected .html (#17742)
  • 771b0a9 fix(container): wire astroConfig.site through to the SSR manifest so Astro.si...
  • 52e6c34 [ci] release (#17691)
  • 97140b2 fix(collections): chunk writing of collections (#17724)
  • e28d227 docs: fix the code snippets in the JSDoc for the configuration options (#17699)
  • c3b9aed chore: remove unifont workaround (#17723)
  • Additional commits viewable in compare view
  
  

  Updates @astrojs/check from 0.9.9 to 0.9.10

  Release notes

  Sourced from @​astrojs/check's releases.

  @​astrojs/check@​0.9.10

  Patch Changes

  • #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

  Changelog

  Sourced from @​astrojs/check's changelog.

  0.9.10

  Patch Changes

  • #17447 b01a692 Thanks @​ocavue! - Update dependency yargs to version 18. See the yargs changelog for details.

  Commits

  • 112d3ea [ci] release (#17469)
  • b01a692 chore(deps): update yargs to v18 (#17447)
  • 3652d1c chore: merge main into next
  • 8062391 chore(deps): dedupe vite installations (#16788)
  • ce88423 Dedupe vite (#16787)
  • b8061a6 refactor: use TypeScript project service in ESLint (#16623)
  • 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
  • See full diff in compare view
  
  

[dependabot]

Superseded by #346.