chore(deps): roll up 12 dependabot bumps

[twangodev]

Octopus roll-up of the 12 open dependabot PRs that are safe to merge. None touch the platform version, since-build, or anything else affecting the minimum supported IDE version.

Merged head commits of:

• Closes chore(deps): bump gradle/actions from 5 to 6.2.0 #125 (gradle/actions 5 → 6.2.0)
• Closes chore(deps): bump github/codeql-action from 4 to 4.37.4 #124 (github/codeql-action 4 → 4.37.4)
• Closes chore(deps): bump JetBrains/qodana-action from 2026.1.3 to 2026.2.0 #122 (JetBrains/qodana-action 2026.1.3 → 2026.2.0)
• Closes chore(deps): bump org.jetbrains.intellij.plugins:verifier-cli from 1.408 to 1.409 #121 (verifier-cli 1.408 → 1.409)
• Closes chore(deps): bump org.jetbrains.kotlinx.kover from 0.9.7 to 0.9.9 #120 (kover 0.9.7 → 0.9.9)
• Closes chore(deps): bump org.jetbrains.intellij.platform from 2.17.0 to 2.18.1 #117 (org.jetbrains.intellij.platform 2.17.0 → 2.18.1)
• Closes chore(deps): bump org.jetbrains.intellij.platform.settings from 2.17.0 to 2.18.1 #116 (org.jetbrains.intellij.platform.settings 2.17.0 → 2.18.1)
• Closes chore(deps-dev): bump vite from 8.1.3 to 8.1.4 in /ui #113 (vite 8.1.3 → 8.1.4)
• Closes chore(deps-dev): bump shadcn-svelte from 1.3.0 to 1.4.0 in /ui #112 (shadcn-svelte 1.3.0 → 1.4.0)
• Closes chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /ui #111 (typescript 6.0.3 → 7.0.2)
• Closes chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 in /ui #110 (@types/node 26.1.0 → 26.1.1)
• Closes chore(deps-dev): bump @sveltejs/vite-plugin-svelte from 7.1.4 to 7.2.0 in /ui #109 (@sveltejs/vite-plugin-svelte 7.1.4 → 7.2.0)

Excluded: #119 (kotlin.plugin.serialization 2.4.10) — requires a coordinated Kotlin 2.4 upgrade, build fails standalone.

ui/package-lock.json was regenerated after merging so it is consistent with the merged package.json (typescript 7.0.2 + its platform binaries).

The red checks on the individual PRs were investigated: IU-2026.2 verify failures are a pre-existing EAP compile issue unrelated to these bumps; the failures on #116/#117 were a GitHub Actions outage on 2026-07-13.

Summary by CodeRabbit

• Chores
  • Updated build, testing, release, and code-scanning tooling to newer versions.
  • Refreshed development tooling used for IntelliJ platform integration, verification, code coverage, and UI development.
  • Improved consistency and reliability across automated project workflows.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Dependency and tooling updates

Layer / File(s)	Summary
CI action version updates .github/workflows/build.yml, .github/workflows/codeql.yml, .github/workflows/release.yml	Updated Gradle setup, CodeQL, Qodana, and release workflow action versions.
Gradle tooling version updates gradle/libs.versions.toml, settings.gradle.kts	Updated plugin verifier, IntelliJ Platform, Kover, and IntelliJ Platform settings versions.
UI development dependency updates ui/package.json	Updated Svelte, Node.js types, shadcn-svelte, TypeScript, and Vite versions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The listed dependency upgrades match the linked issues, but the required package-lock.json update is excluded from review.	Review ui/package-lock.json to verify that it matches the updated ui/package.json; the file was excluded by the !**/package-lock.json path filter.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies a dependency roll-up that matches the pull request changes.
Out of Scope Changes check	✅ Passed	The reviewed changes are limited to the dependency and tooling upgrades described in the linked issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/deps-rollup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​org.jetbrains.intellij.plugins/​verifier-cli@​1.408 ⏵ 1.409	-18
	npm/​@​types/​node@​26.1.0 ⏵ 26.1.1			+1	-1
	npm/​@​sveltejs/​vite-plugin-svelte@​7.1.4 ⏵ 7.2.0	+1		+1	-1
	npm/​vite@​8.1.3 ⏵ 8.1.4	+1		+1	+1
	npm/​shadcn-svelte@​1.3.0 ⏵ 1.4.0			+1	+3
	npm/​typescript@​6.0.3 ⏵ 7.0.2			-1		+10

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: maven org.bouncycastle:bcprov-jdk18on is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/org.jetbrains.intellij.plugins/verifier-cli@1.409 → maven/org.bouncycastle/bcprov-jdk18on@1.85 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.bouncycastle/bcprov-jdk18on@1.85. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Rolls up multiple Dependabot dependency bumps across the Gradle build (IntelliJ Platform + tooling), the UI toolchain (Vite/Svelte/TypeScript ecosystem), and GitHub Actions workflows to keep CI and build tooling up to date without changing the minimum supported IDE/platform version.

Changes:

• Bump UI dev dependencies (TypeScript, Vite, shadcn-svelte, @types/node, @sveltejs/vite-plugin-svelte) and regenerate package-lock.json.
• Bump Gradle toolchain versions (IntelliJ Platform Gradle plugin + settings plugin, Kover, Plugin Verifier).
• Update GitHub Actions workflow action versions (Gradle setup, CodeQL, Qodana).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
ui/package.json	Updates UI devDependency versions (TypeScript/Vite/Svelte tooling).
ui/package-lock.json	Regenerated lockfile to reflect updated UI dependency graph (incl. new platform optional deps).
settings.gradle.kts	Bumps org.jetbrains.intellij.platform.settings plugin version.
gradle/libs.versions.toml	Bumps IntelliJ Platform Gradle plugin, Kover, and verifier-cli versions.
.github/workflows/release.yml	Updates Gradle setup action version used during release publishing.
.github/workflows/codeql.yml	Pins CodeQL init/analyze actions to the bumped patch version.
.github/workflows/build.yml	Updates Gradle setup, CodeQL upload-sarif, and Qodana action versions in CI.

Files not reviewed (1)

• ui/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/package.json`:
- Around line 28-33: Add the required TypeScript 7 integration for the
svelte-check command, using the documented `@typescript/native` TypeScript 7 alias
or --tsgo/@typescript/native-preview setup while retaining TypeScript 6 for
Svelte tooling. Update the relevant package.json dependencies and check script
so plain svelte-check runs successfully with the existing tsconfig.app.json.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9e4440c3-a7ef-4d37-9c42-8d3bca073e05

📥 Commits

Reviewing files that changed from the base of the PR and between 3c937c0 and fa973c9.

⛔ Files ignored due to path filters (1)

• ui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• .github/workflows/build.yml
• .github/workflows/codeql.yml
• .github/workflows/release.yml
• gradle/libs.versions.toml
• settings.gradle.kts
• ui/package.json

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python - <<'PY'
import json
from pathlib import Path

package = json.loads(Path("ui/package.json").read_text())
print("scripts:", json.dumps(package.get("scripts", {}), indent=2))
print("relevant dependencies:", json.dumps({
    k: v for k, v in package.get("devDependencies", {}).items()
    if k in {"svelte-check", "typescript", "`@typescript/native`", "`@typescript/native-preview`"}
}, indent=2))
PY

rg -n '"(svelte-check|typescript|`@typescript/native`|`@typescript/native-preview`)|--tsgo' \
  ui/package.json ui/package-lock.json

Repository: twangodev/jetplay

Length of output: 953

---

🌐 Web query:

svelte-check 4.7.2 README TypeScript 7 tsgo @typescript/native-preview TypeScript 6 TypeScript 7

💡 Result:

The current state of TypeScript 7 and its relationship with svelte-check is as follows: Svelte-check 4.7.2 (released July 7, 2026) includes updates regarding the experimental --tsgo flag, which allows users to leverage the native TypeScript compiler port (the foundation of TypeScript 7) [1][2]. The --tsgo flag in svelte-check relies on the @typescript/native-preview package [3][4]. This package was used to distribute preview builds of the native TypeScript compiler (often referred to as tsgo) during the transition from TypeScript 6.0 to TypeScript 7.0 [5][6][7]. As of the release of TypeScript 7.0, the stable version is distributed under the official typescript package, and the tsgo binary has been transitioned to be available as the standard tsc command [6][8][4]. However, ecosystem tools like svelte-check that rely on deep integration with the TypeScript compiler's programmatic API face compatibility challenges [9]. Because TypeScript 7 initially lacked a stable programmatic API, these tools often require TypeScript 6.0 for internal operations, even when experimenting with TypeScript 7 features via --tsgo or similar mechanisms [9]. In summary: - svelte-check 4.7.2 provides experimental support for the native compiler (tsgo) through the --tsgo flag [10][1]. - This functionality is intended to allow testing the performance improvements of the new compiler architecture [6][4]. - Users should be aware that full programmatic integration of TypeScript 7 into tools like svelte-check is an ongoing effort, and users may still require a TypeScript 6.0 environment for stable type-checking operations within these tools [9].

Citations:

• 1: https://github.com/sveltejs/language-tools/releases/tag/svelte-check@4.7.2
• 2: https://github.com/sveltejs/language-tools/blob/master/packages/svelte-check/CHANGELOG.md
• 3: https://www.npmjs.com/package/svelte-check
• 4: https://github.com/microsoft/typescript-go?tab=readme-ov-file
• 5: https://www.npmjs.com/package/@typescript/native-preview
• 6: https://devblogs.microsoft.com/typescript/announcing-typescript-7-0-rc/
• 7: https://devblogs.microsoft.com/typescript/announcing-typescript-native-previews/
• 8: https://devblogs.microsoft.com/typescript/announcing-typescript-7-0-beta/
• 9: Typescript 7 crashes svelte2tsx and svelte-check sveltejs/language-tools#3063
• 10: https://github.com/sveltejs/language-tools/blob/master/packages/svelte-check/README.md

---

🌐 Web query:

Svelte language tools README svelte-check TypeScript 7 @typescript/native-preview @typescript/native``

💡 Result:

As of August 5, 2026, svelte-check does not natively support TypeScript 7 due to fundamental incompatibilities with TypeScript 7's architecture and programmatic API [1]. While TypeScript 7 is stable, Svelte tooling—including svelte-check and svelte2tsx—requires TypeScript 6.0 for core language service operations [1]. To use TypeScript 7 within a project that also requires Svelte tooling, maintainers recommend a dual-version setup using npm aliases [2]. This allows you to keep TypeScript 6 for Svelte's requirements while experimenting with or running TypeScript 7 for other parts of your build [2][1]. Recommended setup: npm install --save-dev typescript@~6 @typescript/native@npm:typescript@7 [2] For type-checking specifically, svelte-check provides experimental flags to leverage TypeScript's "Go" (native) implementation, which is often used in conjunction with TypeScript 7 workflows [3][2][4]. Key flags for svelte-check: --tsgo: Uses TypeScript's native Go implementation [5][3]. This requires the @typescript/native-preview package to be installed [5][2]. Note that this approach has specific limitations similar to the --incremental flag, such as difficulties handling files outside the root directory of your tsconfig.json [5][3]. --tsgo-experimental-api: An alternative flag that avoids some of the limitations of --tsgo by not caching virtual code, though it is slightly slower and considered experimental [6][4]. These flags are intended for testing and experimentation as the Svelte and TypeScript teams continue to work toward full compatibility [7][6][1]. In typical environments, you should continue to rely on a stable TypeScript 6.0 dependency for your primary Svelte development workflow to avoid crashes and integration errors [1][8].

Citations:

• 1: Typescript 7 crashes svelte2tsx and svelte-check sveltejs/language-tools#3063
• 2: https://www.npmjs.com/package/svelte-check
• 3: feat: svelte-check --incremental / --tsgo sveltejs/language-tools#2932
• 4: TypeScript Go support (at least in CLI) sveltejs/language-tools#2733
• 5: https://github.com/sveltejs/language-tools/blob/master/packages/svelte-check/README.md
• 6: feat: svelte-check tsgo support with experimental api sveltejs/language-tools#3036
• 7: https://www.npmjs.com/package/@typescript/native-preview
• 8: svelte-check crashes under TypeScript 7 — blocks TS 7 upgrade philoserf/obsidian-periodic-notes#157

---

Add the required TypeScript 7 support for svelte-check.

check runs plain svelte-check --tsconfig ./tsconfig.app.json, but svelte-check 4.7.2 needs both TypeScript 6 for Svelte tooling and TypeScript 7 support for the project TypeScript version. Add @typescript/native@npm:typescript@7 or use the documented --tsgo/@typescript/native-preview setup, or keep TypeScript 6 as the compiler until the TypeScript 7 integration is in place.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ui/package.json` around lines 28 - 33, Add the required TypeScript 7
integration for the svelte-check command, using the documented
`@typescript/native` TypeScript 7 alias or --tsgo/@typescript/native-preview setup
while retaining TypeScript 6 for Svelte tooling. Update the relevant
package.json dependencies and check script so plain svelte-check runs
successfully with the existing tsconfig.app.json.

[twangodev]

Superseded by a rebuilt roll-up without the typescript 7 bump: svelte-check 4.7.2 crashes against typescript@7 (TS 7 no longer ships the JS API svelte-check consumes), and CI does not run npm run check, so the green checks on #111 never exercised it. New PR carries the remaining 11 bumps.

[github-actions]

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2.0
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions