chore(deps): roll up 11 dependabot bumps

[twangodev]

Octopus roll-up of the open dependabot PRs that are safe to merge. None touch the platform version, since-build, or anything else affecting the minimum supported IDE version. Supersedes #126.

Merged head commits of:

• Closes chore(deps): bump gradle/actions from 5 to 6.2.0 #125 (gradle/actions 5 → 6.2.0)
• Closes chore(deps): bump github/codeql-action from 4 to 4.37.4 #124 (github/codeql-action 4 → 4.37.4)
• Closes chore(deps): bump JetBrains/qodana-action from 2026.1.3 to 2026.2.0 #122 (JetBrains/qodana-action 2026.1.3 → 2026.2.0)
• Closes chore(deps): bump org.jetbrains.intellij.plugins:verifier-cli from 1.408 to 1.409 #121 (verifier-cli 1.408 → 1.409)
• Closes chore(deps): bump org.jetbrains.kotlinx.kover from 0.9.7 to 0.9.9 #120 (kover 0.9.7 → 0.9.9)
• Closes chore(deps): bump org.jetbrains.intellij.platform from 2.17.0 to 2.18.1 #117 (org.jetbrains.intellij.platform 2.17.0 → 2.18.1)
• Closes chore(deps): bump org.jetbrains.intellij.platform.settings from 2.17.0 to 2.18.1 #116 (org.jetbrains.intellij.platform.settings 2.17.0 → 2.18.1)
• Closes chore(deps-dev): bump vite from 8.1.3 to 8.1.4 in /ui #113 (vite 8.1.3 → 8.1.4)
• Closes chore(deps-dev): bump shadcn-svelte from 1.3.0 to 1.4.0 in /ui #112 (shadcn-svelte 1.3.0 → 1.4.0)
• Closes chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 in /ui #110 (@types/node 26.1.0 → 26.1.1)
• Closes chore(deps-dev): bump @sveltejs/vite-plugin-svelte from 7.1.4 to 7.2.0 in /ui #109 (@sveltejs/vite-plugin-svelte 7.1.4 → 7.2.0)

Excluded:

• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /ui #111 (typescript 6.0.3 → 7.0.2): svelte-check 4.7.2 crashes against typescript@7 (TypeError: Cannot read properties of undefined (reading 'useCaseSensitiveFileNames')) because TS 7's native compiler no longer ships the JS API svelte-check consumes. CI never runs npm run check, so chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /ui #111's green checks did not cover this. Needs svelte-check support for TS 7 first.
• chore(deps): bump org.jetbrains.kotlin.plugin.serialization from 2.3.20 to 2.4.10 #119 (kotlin.plugin.serialization 2.4.10): requires a coordinated Kotlin 2.4 upgrade, build fails standalone.

Verified locally: ./gradlew help resolves with the 2.18.1 plugin pair, npm ci is lockfile-consistent, and npm run check output is identical to main (2 pre-existing App.svelte errors, no new diagnostics).

Red checks on the individual dependabot PRs were investigated: IU-2026.2 verify failures are a pre-existing EAP compile issue unrelated to these bumps; failures on #116/#117 were a GitHub Actions outage on 2026-07-13.

[coderabbitai]

Warning

Review limit reached

@twangodev, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 12548b57-9a31-4430-8206-309d0a256b6e

📥 Commits

Reviewing files that changed from the base of the PR and between 3c937c0 and 1e41843.

⛔ Files ignored due to path filters (1)

• ui/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• .github/workflows/build.yml
• .github/workflows/codeql.yml
• .github/workflows/release.yml
• gradle/libs.versions.toml
• settings.gradle.kts
• ui/package.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	maven/​org.jetbrains.intellij.plugins/​verifier-cli@​1.408 ⏵ 1.409	-18
	npm/​@​types/​node@​26.1.0 ⏵ 26.1.1			+1	-1
	npm/​@​sveltejs/​vite-plugin-svelte@​7.1.4 ⏵ 7.2.0	+1		+1	-1
	npm/​vite@​8.1.3 ⏵ 8.1.4	+1		+1	+1
	npm/​shadcn-svelte@​1.3.0 ⏵ 1.4.0			+1	+3

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: maven org.bouncycastle:bcprov-jdk18on is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → maven/org.jetbrains.intellij.plugins/verifier-cli@1.409 → maven/org.bouncycastle/bcprov-jdk18on@1.85 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore maven/org.bouncycastle/bcprov-jdk18on@1.85. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[Copilot]

Pull request overview

Roll-up of multiple Dependabot updates across the UI toolchain, Gradle/IntelliJ Platform build tooling, and GitHub Actions workflows, keeping the plugin’s minimum supported IDE version unchanged.

Changes:

• Bump UI dev dependencies (Vite, @sveltejs/vite-plugin-svelte, shadcn-svelte, @types/node) and refresh package-lock.json accordingly.
• Update Gradle/IntelliJ Platform-related versions (IntelliJ Platform Gradle plugins, Plugin Verifier, Kover).
• Update GitHub Actions workflow action versions (Gradle setup, CodeQL action, Qodana action).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
ui/package.json	Updates UI dev dependency versions for the frontend build/check tooling.
ui/package-lock.json	Regenerates lockfile to reflect updated UI dependency graph.
settings.gradle.kts	Bumps org.jetbrains.intellij.platform.settings plugin version.
gradle/libs.versions.toml	Bumps IntelliJ Platform Gradle plugin, Plugin Verifier, and Kover versions.
.github/workflows/release.yml	Updates Gradle setup action version used during release publishing.
.github/workflows/codeql.yml	Pins CodeQL init/analyze action to the newer v4.37.4 release.
.github/workflows/build.yml	Updates Gradle setup action, CodeQL SARIF upload action, and Qodana action versions used in CI.

Files not reviewed (1)

• ui/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Qodana for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2026.2.0
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions