chore(deps): update all dependencies

Refresh package-lock and update every dependency to its latest
compatible version. No npm overrides: production dependencies carry no
known vulnerabilities (`npm run audit`, i.e. `npm audit --omit=dev`, is
clean). The advisories bare `npm audit` still reports are confined to
dev-only tooling (mocha, changesets) whose transitive fixes live in
majors newer than those tools allow; they never ship — see
agent-feedback/dx.md.

- Babel toolchain -> 7.29.7 (regenerated the patch-package patches).
- mocha 11.7.6 (patch regenerated), rolldown 1.1.4, prettier 3.9.4,
  js-beautify 2, minimatch 10, htmljs-parser 5.12.1,
  @luxass/strip-json-comments 2, @types/node 26, and the eslint/cspell/
  typescript-eslint toolchain to latest.
- Regenerated bundle snapshots for rolldown 1.1.4's more aggressive
  minifier and reformatted sources for prettier 3.9.4.
- Added an `audit` script (`npm audit --omit=dev`) and the missing
  cspell terms.

Held back as dedicated migrations (see agent-feedback/dx.md): Babel 8
(breaks the compiler's babel-7 lib patches) and chai 6 (ESM-only vs 379
CommonJS require sites).

Full test suite, build, and lint all pass.

Author: DylanPiercey

.changeset/dependency-updates-audit.md

@@ -0,0 +1,6 @@
+---
+"@marko/compiler": patch
+"marko": patch
+---
+
+Update dependencies to their latest compatible versions.

.sizes.json

@@ -7,8 +7,8 @@
     {
       "name": "*",
       "total": {
-        "min": 25867,
-        "brotli": 9506
+        "min": 25866,
+        "brotli": 9518
       }
     },
     {
@@ -18,12 +18,12 @@
         "brotli": 119
       },
       "runtime": {
-        "min": 3938,
-        "brotli": 1744
+        "min": 3912,
+        "brotli": 1727
       },
       "total": {
-        "min": 4099,
-        "brotli": 1863
+        "min": 4073,
+        "brotli": 1846
       }
     },
     {
@@ -48,12 +48,12 @@
         "brotli": 365
       },
       "runtime": {
-        "min": 6480,
-        "brotli": 2845
+        "min": 6453,
+        "brotli": 2833
       },
       "total": {
-        "min": 7126,
-        "brotli": 3210
+        "min": 7099,
+        "brotli": 3198
       }
     },
     {

.sizes/comments.csr/entry.js

@@ -1,7 +1,7 @@
 // size: 646 (min) 365 (brotli)
 //#region packages/runtime-tags/src/__tests__/fixtures/basic-inert-collapsible-tree/tags/comments.marko
 const $template$1 = "<ul></ul>";
-const $if_content__comment_comments = /* @__PURE__ */ _if_closure(
+const $if_content__comment_comments = /*@__PURE__*/ _if_closure(
   4,
   0,
   ($scope) => $input_comments$1($scope.a, $scope._.i),
@@ -10,17 +10,17 @@ const $if_content__setup = ($scope) => {
   $if_content__comment_comments._($scope);
   $if_content__id._($scope);
 };
-const $if_content__id = /* @__PURE__ */ _if_closure(4, 0, ($scope) =>
+const $if_content__id = /*@__PURE__*/ _if_closure(4, 0, ($scope) =>
   $input_path$1($scope.a, $scope._.l),
 );
-const $for_content__id = /* @__PURE__ */ _const(11, ($scope) => {
+const $for_content__id = /*@__PURE__*/ _const(11, ($scope) => {
   _attr($scope.a, "id", $scope.l);
   $if_content__id($scope);
 });
-const $for_content__input_path = /* @__PURE__ */ _for_closure(0, ($scope) =>
+const $for_content__input_path = /*@__PURE__*/ _for_closure(0, ($scope) =>
   $for_content__id($scope, `${$scope._.e || "c"}-${$scope.M}`),
 );
-const $for_content__open = /* @__PURE__ */ _let(12, ($scope) => {
+const $for_content__open = /*@__PURE__*/ _let(12, ($scope) => {
   _attr($scope.a, "hidden", !$scope.m);
   _text($scope.d, $scope.m ? "[-]" : "[+]");
 });
@@ -36,21 +36,21 @@ const $for_content__setup = ($scope) => {
 };
 const $for_content__comment_text = ($scope, comment_text) =>
   _text($scope.b, comment_text);
-const $for_content__if = /* @__PURE__ */ _if(
+const $for_content__if = /*@__PURE__*/ _if(
   4,
   $template$1,
-  /* @__PURE__ */ ((_w0) => `/${_w0}&`)(" b"),
+  /*@__PURE__*/ ((_w0) => `/${_w0}&`)(" b"),
   $if_content__setup,
 );
-const $for_content__comment_comments = /* @__PURE__ */ _const(8, ($scope) => {
+const $for_content__comment_comments = /*@__PURE__*/ _const(8, ($scope) => {
   $for_content__if($scope, $scope.i ? 0 : 1);
   $if_content__comment_comments($scope);
 });
 const $for_content__$params = ($scope, $params2) => {
   $for_content__comment_text($scope, $params2[0]?.text);
   $for_content__comment_comments($scope, $params2[0]?.comments);
 };
-const $for = /* @__PURE__ */ _for_of(
+const $for = /*@__PURE__*/ _for_of(
   0,
   "<li><span> </span><button> </button><!></li>",
   " E l D l%l",
@@ -59,11 +59,11 @@ const $for = /* @__PURE__ */ _for_of(
 );
 const $input_comments$1 = ($scope, input_comments) =>
   $for($scope, [input_comments]);
-const $input_path$1 = /* @__PURE__ */ _const(4, $for_content__input_path);
+const $input_path$1 = /*@__PURE__*/ _const(4, $for_content__input_path);
 //#endregion
 //#region packages/runtime-tags/src/__tests__/fixtures/basic-inert-collapsible-tree/template.marko
 const $template = $template$1;
-const $walks = /* @__PURE__ */ ((_w0) => `/${_w0}&`)(" b");
+const $walks = /*@__PURE__*/ ((_w0) => `/${_w0}&`)(" b");
 const $setup = () => {};
 const $input_comments = ($scope, input_comments) =>
   $input_comments$1($scope.a, input_comments);

.sizes/comments.csr/runtime.js

@@ -1,12 +1,11 @@
-// size: 6480 (min) 2845 (brotli)
+// size: 6453 (min) 2833 (brotli)
 //#region packages/runtime-tags/dist/dom.mjs
 let decodeAccessor = (num) =>
     (num + (num < 26 ? 10 : num < 962 ? 334 : 11998)).toString(36),
   delegate = (type, handler) =>
     (handler[type] ||= (document.addEventListener(type, handler, !0), 1)),
   parsers = {},
   nextScopeId = 1e6,
-  collectingScopes,
   destroyNestedScopes = function destroyNestedScopes(scope) {
     ((scope.H = 0),
       scope.D?.forEach(destroyNestedScopes),
@@ -21,7 +20,7 @@ let decodeAccessor = (num) =>
       currentMultiplier,
       storedMultiplier = 0,
       currentScopeIndex = 0;
-    for (; currentWalkIndex < walkCodes.length; )
+    for (; currentWalkIndex < walkCodes.length;)
       if (
         ((value = walkCodes.charCodeAt(currentWalkIndex++)),
         (currentMultiplier = storedMultiplier),
@@ -50,13 +49,13 @@ let decodeAccessor = (num) =>
           value === 48 &&
             (scope[decodeAccessor(currentScopeIndex++)] = skipScope()));
       else if (value < 92)
-        for (value = 20 * currentMultiplier + value - 67; value--; )
+        for (value = 20 * currentMultiplier + value - 67; value--;)
           walker.nextNode();
       else if (value < 107)
-        for (value = 10 * currentMultiplier + value - 97; value--; )
+        for (value = 10 * currentMultiplier + value - 97; value--;)
           walker.nextSibling();
       else if (value < 117) {
-        for (value = 10 * currentMultiplier + value - 107; value--; )
+        for (value = 10 * currentMultiplier + value - 107; value--;)
           walker.parentNode();
         walker.nextSibling();
       } else storedMultiplier = currentMultiplier * 10 + value - 117;
@@ -75,7 +74,7 @@ let decodeAccessor = (num) =>
   pendingRenders = [],
   scopeKeyOffset = 1e3,
   runEffects = (effects) => {
-    for (let i = 0; i < effects.length; ) effects[i++](effects[i++]);
+    for (let i = 0; i < effects.length;) effects[i++](effects[i++]);
   },
   runRender = (render) => render.c(render.b, render.d),
   catchEnabled,
@@ -105,7 +104,7 @@ function _on(element, type, handler) {
 }
 function handleDelegated(ev) {
   let target = !rendering && ev.target;
-  for (; target; )
+  for (; target;)
     (target["$" + ev.type]?.(ev, target),
       (target = ev.bubbles && !ev.cancelBubble && target.parentNode));
 }
@@ -114,13 +113,12 @@ function parseHTML(html, ns) {
   return ((parser.innerHTML = html), parser.content || parser);
 }
 function createScope($global, closestBranch) {
-  let scope = {
+  return {
     L: nextScopeId++,
     H: runId,
     F: closestBranch,
     $: $global,
   };
-  return (collectingScopes?.push(scope), scope);
 }
 function skipScope() {
   return nextScopeId++;
@@ -306,7 +304,7 @@ function normalizeAttrValue(value) {
 }
 function removeChildNodes(startNode, endNode) {
   let stop = endNode.nextSibling;
-  for (; startNode !== stop; ) {
+  for (; startNode !== stop;) {
     let next = startNode.nextSibling;
     (startNode.remove(), (startNode = next));
   }
@@ -318,7 +316,7 @@ function toInsertNode(startNode, endNode) {
   if (startNode === endNode) return startNode;
   let parent = new DocumentFragment(),
     stop = endNode.nextSibling;
-  for (; startNode !== stop; ) {
+  for (; startNode !== stop;) {
     let next = startNode.nextSibling;
     (parent.appendChild(startNode), (startNode = next));
   }
@@ -329,7 +327,7 @@ function _if(nodeAccessor, ...branchesArgs) {
   let branchAccessor = "D" + nodeAccessor,
     branches = [],
     i = 0;
-  for (; i < branchesArgs.length; )
+  for (; i < branchesArgs.length;)
     branches.push(
       _content("", branchesArgs[i++], branchesArgs[i++], branchesArgs[i++])(),
     );
@@ -475,24 +473,24 @@ function loop(forEach) {
           hi,
           mid;
         for (let i = start; i <= oldEnd; i++) oldPos.set(oldScopes[i], i);
-        for (let i = diffLen; i--; )
+        for (let i = diffLen; i--;)
           sources[i] = oldPos.get(newScopes[start + i]) ?? -1;
         for (let i = 0; i < diffLen; i++)
           if (~sources[i])
             if (tail < 0 || sources[tails[tail]] < sources[i])
               (~tail && (pred[i] = tails[tail]), (tails[++tail] = i));
             else {
-              for (lo = 0, hi = tail; lo < hi; )
+              for (lo = 0, hi = tail; lo < hi;)
                 ((mid = ((lo + hi) / 2) | 0),
                   sources[tails[mid]] < sources[i]
                     ? (lo = mid + 1)
                     : (hi = mid));
               sources[i] < sources[tails[lo]] &&
                 (lo > 0 && (pred[i] = tails[lo - 1]), (tails[lo] = i));
             }
-        for (hi = tails[tail], lo = tail + 1; lo-- > 0; )
+        for (hi = tails[tail], lo = tail + 1; lo-- > 0;)
           ((tails[lo] = hi), (hi = pred[hi]));
-        for (let i = diffLen; i--; )
+        for (let i = diffLen; i--;)
           (~tail && i === tails[tail]
             ? tail--
             : insertBranchBefore(
@@ -526,7 +524,7 @@ function queueRender(scope, signal, signalKey, value, scopeKey = scope.L) {
 }
 function queuePendingRender(render) {
   let i = pendingRenders.push(render) - 1;
-  for (; i; ) {
+  for (; i;) {
     let parentIndex = (i - 1) >> 1,
       parent = pendingRenders[parentIndex];
     if (render.a - parent.a >= 0) break;
@@ -562,14 +560,14 @@ function prepareEffects(fn) {
   return preparedEffects;
 }
 function runRenders() {
-  for (; pendingRenders.length; ) {
+  for (; pendingRenders.length;) {
     let render = pendingRenders[0],
       item = pendingRenders.pop();
     if (render !== item) {
       let i = 0,
         mid = pendingRenders.length >> 1,
         key = (pendingRenders[0] = item).a;
-      for (; i < mid; ) {
+      for (; i < mid;) {
         let bestChild = (i << 1) + 1,
           right = bestChild + 1;
         if (

.sizes/comments.ssr/entry.js

@@ -1,6 +1,6 @@
 // size: 115 (min) 101 (brotli)
 //#region packages/runtime-tags/src/__tests__/fixtures/basic-inert-collapsible-tree/tags/comments.marko
-const $for_content__open = /* @__PURE__ */ _let(12, ($scope) => {
+const $for_content__open = /*@__PURE__*/ _let(12, ($scope) => {
   _attr($scope.a, "hidden", !$scope.m);
   _text($scope.d, $scope.m ? "[-]" : "[+]");
 });

.sizes/comments.ssr/runtime.js

@@ -15,7 +15,7 @@ let decodeAccessor = (num) =>
   pendingRenders = [],
   scopeKeyOffset = 1e3,
   runEffects = (effects) => {
-    for (let i = 0; i < effects.length; ) effects[i++](effects[i++]);
+    for (let i = 0; i < effects.length;) effects[i++](effects[i++]);
   },
   runRender = (render) => render.c(render.b, render.d),
   catchEnabled;
@@ -28,7 +28,7 @@ function _on(element, type, handler) {
 }
 function handleDelegated(ev) {
   let target = !rendering && ev.target;
-  for (; target; )
+  for (; target;)
     (target["$" + ev.type]?.(ev, target),
       (target = ev.bubbles && !ev.cancelBubble && target.parentNode));
 }
@@ -125,10 +125,7 @@ function init(runtimeId = "M") {
               for (; i < resumes.length; i++) {
                 let serialized = resumes[i];
                 if (typeof serialized == "string")
-                  for (
-                    lastTokenIndex = 0, visitText = serialized;
-                    nextToken();
-                  )
+                  for (lastTokenIndex = 0, visitText = serialized; nextToken();)
                     /\D/.test(lastToken)
                       ? (lastEffect = registeredValues[lastToken])
                       : effects.push(lastEffect, getScope(lastToken));
@@ -232,7 +229,7 @@ function queueRender(scope, signal, signalKey, value, scopeKey = scope.L) {
 }
 function queuePendingRender(render) {
   let i = pendingRenders.push(render) - 1;
-  for (; i; ) {
+  for (; i;) {
     let parentIndex = (i - 1) >> 1,
       parent = pendingRenders[parentIndex];
     if (render.a - parent.a >= 0) break;
@@ -253,14 +250,14 @@ function run() {
   runEffects(effects);
 }
 function runRenders() {
-  for (; pendingRenders.length; ) {
+  for (; pendingRenders.length;) {
     let render = pendingRenders[0],
       item = pendingRenders.pop();
     if (render !== item) {
       let i = 0,
         mid = pendingRenders.length >> 1,
         key = (pendingRenders[0] = item).a;
-      for (; i < mid; ) {
+      for (; i < mid;) {
         let bestChild = (i << 1) + 1,
           right = bestChild + 1;
         if (

.sizes/counter.csr/entry.js

@@ -2,7 +2,7 @@
 //#region packages/runtime-tags/src/__tests__/fixtures/basic-counter/template.marko
 const $template = "<div><button> </button></div>";
 const $walks = "D D m";
-const $clickCount = /* @__PURE__ */ _let(2, ($scope) =>
+const $clickCount = /*@__PURE__*/ _let(2, ($scope) =>
   _text($scope.b, $scope.c),
 );
 const $setup__script = _script("a0", ($scope) =>