Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 24 updates - #172

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-445c2dc229
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-445c2dc229

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 19, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 24 updates in the / directory:

Package From To
@formkit/auto-animate 0.8.4 0.10.0
@google/genai 2.29.1 2.30.0
@radix-ui/react-alert-dialog 1.1.23 1.2.1
@radix-ui/react-context-menu 2.3.7 2.4.1
@radix-ui/react-dialog 1.1.23 1.3.1
@radix-ui/react-dropdown-menu 2.1.24 2.2.1
@radix-ui/react-popover 1.1.23 1.3.1
@radix-ui/react-select 2.3.7 2.4.1
@radix-ui/react-slider 1.4.7 1.6.1
@radix-ui/react-switch 1.3.7 1.4.1
@radix-ui/react-tooltip 1.2.16 1.4.1
@tanstack/react-virtual 3.14.13 3.14.20
@uiw/react-codemirror 4.25.11 4.25.12
@viz-js/viz 3.29.0 3.31.0
docx-preview 0.4.0 0.4.1
dompurify 3.4.16 3.4.17
jszip 3.10.1 3.10.2
lucide-react 0.417.0 0.577.0
mammoth 1.12.1 1.13.0
pdfjs-dist 4.8.69 4.10.38
pyodide 0.27.7 0.29.5
react-virtuoso 4.18.12 4.18.19
ws 8.21.3 8.22.0
zod 4.4.3 4.6.7

Updates @formkit/auto-animate from 0.8.4 to 0.10.0

Release notes

Sourced from @​formkit/auto-animate's releases.

v0.10.0

Features

  • Marko v6 integration — a new <auto-animate> tag exported from @formkit/auto-animate/marko (#239). Pass your parent element's tag variable (<ul/listRef> → parent=listRef), with optional options and a reactive enabled attribute. SSR/resume safe. Thanks @​defunkt-dev!

Docs

CI

  • Releases are now published to npm via OIDC trusted publishing on v* tag pushes.
Commits
  • b6a6fee ci: use bundled npm for trusted publishing
  • 00b8944 ci: add trusted publishing and release workflows
  • 75ba14d chore: release v0.10.0
  • a73b637 test: scope framework demo selectors and cover Marko example
  • 01c5f5b Merge pull request #239 from defunkt-dev/master
  • e0a1b15 docs support
  • 35ac0ad fix some ts errors
  • 7f1d60a e2e ssr test suite for marko
  • 8b1ef37 e2e test suite for marko
  • 304efab feat: marko v6 auto-animate integration
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​formkit/auto-animate since your current version.


Updates @google/genai from 2.29.1 to 2.30.0

Release notes

Sourced from @​google/genai's releases.

v2.30.0

2.30.0 (2026-10-14)

Features

  • interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

  • clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)
  • fix the grounding metadata merging for automatic continuation in generate content and generate content stream (6bfba87)
  • make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (6bdc0d9)
  • type GeminiNextGen signatures with public, importable names (ad3fb89)
Changelog

Sourced from @​google/genai's changelog.

2.30.0 (2026-10-14)

Features

  • interactions: add gemini-4-argon to Model enum (8a3c307)

Bug Fixes

  • clear continuation state and preserve prompt feedback when continuation hop returns no candidates (e63d1f1)
  • fix the grounding metadata merging for automatic continuation in generate content and generate content stream (6bfba87)
  • make continuation streams retry dropped hops, stop on prompt_feedback, and keep real errors in generate_content (6bdc0d9)
  • type GeminiNextGen signatures with public, importable names (ad3fb89)
Commits
  • 1de87f8 chore(main): release 2.30.0 (#2058)
  • 14086e6 chore(cli): update Speakeasy OpenAPI generator to v2.948.9
  • 433a33a chore: internal change
  • 6bdc0d9 fix: make continuation streams retry dropped hops, stop on prompt_feedback, a...
  • 6bfba87 fix: fix the grounding metadata merging for automatic continuation in generat...
  • ad3fb89 fix: type GeminiNextGen signatures with public, importable names
  • 8a3c307 feat(interactions): add gemini-4-argon to Model enum
  • f2ad2c1 chore: Skip the code coverage workflow on push/PR (manual trigger only).
  • e63d1f1 fix: clear continuation state and preserve prompt feedback when continuation ...
  • See full diff in compare view

Updates @radix-ui/react-alert-dialog from 1.1.23 to 1.2.1

Changelog

Sourced from @​radix-ui/react-alert-dialog's changelog.

1.2.1

  • Updated dependencies: @radix-ui/react-dialog@1.3.1

1.2.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dialog@1.3.0, @radix-ui/react-primitive@2.2.0

1.1.24

  • Updated dependencies: @radix-ui/react-dialog@1.2.0, @radix-ui/react-primitive@2.1.11
Commits

Updates @radix-ui/react-context-menu from 2.3.7 to 2.4.1

Changelog

Sourced from @​radix-ui/react-context-menu's changelog.

2.4.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-menu@2.2.1

2.4.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Allowed side, sideOffset, and align props to be overridden on ContextMenu.Content.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.3.8

  • Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11
Commits

Updates @radix-ui/react-dialog from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.3.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

  • Added support for multiple aria-describedby attributes.
  • Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
  • Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18
Commits

Updates @radix-ui/react-dropdown-menu from 2.1.24 to 2.2.1

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.2.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-menu@2.2.1

2.2.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-menu@2.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

2.1.25

  • Updated dependencies: @radix-ui/react-menu@2.1.25, @radix-ui/react-primitive@2.1.11
Commits

Updates @radix-ui/react-popover from 1.1.23 to 1.3.1

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.3.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.3.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed aria-controls being set on Popover.Trigger while the popover is closed.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.0

  • Added Popover.Title and Popover.Description parts that provide accessible names and descriptions for popover content.
  • Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
  • Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18
Commits

Updates @radix-ui/react-select from 2.3.7 to 2.4.1

Changelog

Sourced from @​radix-ui/react-select's changelog.

2.4.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

2.4.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
  • Fixed content alignment when all items are disabled.
  • Fixed a bug where updating a Select value programmatically while inside a <form> would dispatch a click event from the hidden bubble select that propagated to ancestor onClick handlers.
  • Fixed a bug resulting from incorrect tree-shaking in SWC-minified code.
  • Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-use-callback-ref@1.1.5, @radix-ui/react-visually-hidden@1.2.13

2.3.8

  • Fixed a bug where internal event handlers were still called on disabled Select.Item elements. Consumer-provided event handlers still run, but Radix's own selection logic no longer fires for disabled items.
  • Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18, @radix-ui/react-collection@1.1.16
Commits

Updates @radix-ui/react-slider from 1.4.7 to 1.6.1

Changelog

Sourced from @​radix-ui/react-slider's changelog.

1.6.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.6.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
  • Fixed a bug where updating a Slider value programmatically inside a <form> would dispatch an input event that propagated to ancestor onInput handlers.
  • Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.5.0

  • Added a preserveThumbOrder prop to Slider that prevents thumbs from crossing over one another. When enabled, each thumb is constrained to the values of its neighbors instead of swapping positions when dragged past them.
  • Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16
Commits

Updates @radix-ui/react-switch from 1.3.7 to 1.4.1

Changelog

Sourced from @​radix-ui/react-switch's changelog.

1.4.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

1.4.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed bugs in form-nested control components where a user-driven change was treated as programmatic in some cases, preventing bubbled event handlers from being called.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.3.8

  • Updated dependencies: @radix-ui/react-use-size@1.1.5, @radix-ui/react-primitive@2.1.11
Commits

Updates @radix-ui/react-tooltip from 1.2.16 to 1.4.1

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.4.1

  • Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
  • Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

1.4.0

  • Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
  • Fixed a bug where tabbing away from a focusable tooltip trigger nested in a modal popover moved focus to the popover's root instead of the next element in the popover.
  • Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-popper@1.4.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0, @radix-ui/react-visually-hidden@1.2.13

1.3.0

  • Added support for multiple aria-describedby attributes.
  • Updated dependencies: @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-visually-hidden@1.2.12, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-popper@1.3.8, @radix-ui/react-portal@1.1.18
Commits

Updates @tanstack/react-virtual from 3.14.13 to 3.14.20

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.20

Patch Changes

@​tanstack/react-virtual@​3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

@​tanstack/react-virtual@​3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

@​tanstack/react-virtual@​3.14.17

Patch Changes

@​tanstack/react-virtual@​3.14.16

Patch Changes

@​tanstack/react-virtual@​3.14.15

Patch Changes

@​tanstack/react-virtual@​3.14.14

Patch Changes

  • #1301 ce57b78 - fix(react-virtual): position directDomUpdates rows that mount without the owner re-rendering

    Rows were only positioned by the owner's layout effect or the next onChange. A row mounted by a child that re-renders on its own (local state, context, a resolved Suspense boundary) skipped both when it was fixed-size, and stayed unpositioned until the range changed. Rows are now positioned as they register through measureElement, and containerRef positions the rows that mounted together with the container.

  • Updated dependencies [43675bc, 9df47a3, c644f10, 2a631f4]:

    • @​tanstack/virtual-core@​3.18.0
Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.20

Patch Changes

3.14.19

Patch Changes

  • Updated dependencies [269e8ed]:
    • @​tanstack/virtual-core@​3.19.4

3.14.18

Patch Changes

  • Updated dependencies [f211d3a]:
    • @​tanstack/virtual-core@​3.19.3

3.14.17

Patch Changes

3.14.16

Patch Changes

3.14.15

Patch Changes

3.14.14

Patch Changes

  • #1301 ce57b78 - fix(react-virtual): position directDomUpdates rows that mount without the owner re-rendering

    Rows were only positioned by the owner's layout effect or the next onChange. A row mounted by a child that re-renders on its own (local state, context, a resolved Suspense boundary) skipped both when it was fixed-size, and stayed unpositioned until the range changed. Rows are now positioned as they register through measureElement, and containerRef positions the rows that mounted together with the container.

... (truncated)

Commits
  • 4296ac2 ci: Version Packages (#1323)
  • 9c762fe fix(virtual-core): finish the iOS scroll-correction plan and simplify the scr...
  • 4a1a4fd fix(virtual-core): defer iOS scroll corrections only for touch-driven scrolls...
  • 4f9636e ci: Version Packages (#1322)
  • 676a098 ci: Version Packages (#1317)
  • 7c20899 ci: Version Packages (#1315)
  • cb510cb refactor(virtual-core): describe an in-flight scroll command by one phase (#1...
  • 46f73fb ci: Version Packages (#1312)
  • 6732e00 test(virtual-core): pin the iOS deferral and index-scroll orderings measured ...
  • 84c1502 ci: Version Packages (#1303)
  • Additional commits viewable in compare view

Updates @uiw/react-codemirror from 4.25.11 to 4.25.12

Release notes

Sourced from @​uiw/react-codemirror's releases.

v4.25.12

Buy me a coffee

Documentation v4.25.12: https://raw.githack.com/uiwjs/react-codemirror/5d05e26/index.html
Comparing Changes: uiwjs/react-codemirror@v4.25.11...v4.25.12

npm i @uiw/react-codemirror@4.25.12
Commits

Updates @viz-js/viz from 3.29.0 to 3.31.0

Release notes

Sourced from @​viz-js/viz's releases.

@​viz-js/viz 3.31.0

  • Update emsdk to 6.0.10.
  • Update Graphviz to 16.1.0.
  • Update Expat to 2.8.5.

@​viz-js/viz 3.30.0

  • Update Graphviz to 16.0.0.
  • Update Expat to 2.8.4.
  • Update emsdk to 5.0.7.
Changelog

Sourced from @​viz-js/viz's changelog.

3.31.0

  • Update emsdk to 6.0.10.
  • Update Graphviz to 16.1.0.
  • Update Expat to 2.8.5.

3.30.0

  • Update Graphviz to 16.0.0.
  • Update Expat to 2.8.4.
  • Update emsdk to 5.0.7.
Commits

Updates docx-preview from 0.4.0 to 0.4.1

Commits

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

  • Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @​manus-pi
  • Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @​uttej-badwane
  • Fixed the SMIL attributeName guard in XHTML mode, thanks @​Koukyosyumei
  • Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @​artiphishell
  • Added a purify-edge test runner as a compatibility check, thanks @​anzal1
  • Clarified the IN_PLACE documentation in the README about possible risks
  • Updated several dependencies
Commits

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

  • Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
  • Add missing types for JSZip.defaults. Fixes #690 (see #927)
  • Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)
Commits
Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.


Updates lucide-react from 0.417.0 to 0.577.0

Release notes

Sourced from lucide-react's releases.

Version 0.577.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.576.0...0.577.0

Version 0.576.0

What's Changed

Full Changelog: lucide-icons/lucide@0.575.0...0.576.0

Version 0.575.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@0.573.0...0.575.0

Version 0.574.0

What's Changed

New Contributors

... (truncated)

Commits
  • f6c0d06 chore(deps): bump rollup from 4.53.3 to 4.59.0 (#4106)
  • 67c0485 feat(scripts): added helper script to automatically update OpenCollective bac...
  • b6ed43d feat(packages): Added aria-hidden fallback for decorative icons to all packag...
  • 076e0bb chore(dependencies): Update dependencies (#3809)
  • 80d6f73 fix(icons): Rename fingerprint icon to fingerprint-pattern (#3767)
  • 1cfb3ff chore(deps-dev): bump vite from 6.3.5 to 6.3.6 (#3611)
  • e71198d chore: icon alias improvements (#2861)
  • 3e644fd chore(scripts): Refactor scripts to typescript (#3316)
  • 19fa01b build(deps-dev): bump vite from 6.3.2 to 6.3.4 (#3181)
  • 03eb862 use implicit return in react package (#2325)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for lucide-react since your current version.


Updates mammoth from 1.12.1 to 1.13.0

Changelog

Sourced from mammoth's changelog.

1.13.0

  • Replace the use of bluebird with native promises.

    This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

    The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

    Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

  • Read the children of w:customXml elements.

  • Handle paragraphs and runs that have been moved and tracked as a revision.

  • Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

  • Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

    Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

  • Handle complex field separator and end characters without corresponding start characters.

1.12.2

  • Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.
Commits
  • 791a189 Bump version to 1.13.0
  • 4abdfe2 Clarify implication of markdown escaping
  • 8e6e755 Escape markdown image alt text and src
  • 9463f5c Escape markdown link hrefs
  • d302d07 Escape HTML IDs in markdown writer
  • 671dbb6 Handle paragraphs and runs that have been moved and tracked as a revision
  • d157374 Read the children of w:customXml elements
  • 2a489fb Mark up code fragment in README
  • adc5749 Update dingbat-to-unicode to 1.0.2
  • c0dce8c Remove dependency on path-is-absolute
  • Additional commits viewable in compare view

Updates pdfjs-dist from 4.8.69 to 4.10.38

Release notes

Sourced from pdfjs-dist's releases.

v4.10.38

This release contains improvements for accessibility, the annotation editor, font conversion, performance, SMasks and the viewer.

Changes since v4.9.155

  • Bump the stable version in pdfjs.config by

…y with 24 updates

Bumps the production-dependencies group with 24 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@formkit/auto-animate](https://github.com/formkit/auto-animate) | `0.8.4` | `0.10.0` |
| [@google/genai](https://github.com/googleapis/js-genai) | `2.29.1` | `2.30.0` |
| [@radix-ui/react-alert-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/alert-dialog) | `1.1.23` | `1.2.1` |
| [@radix-ui/react-context-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/context-menu) | `2.3.7` | `2.4.1` |
| [@radix-ui/react-dialog](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dialog) | `1.1.23` | `1.3.1` |
| [@radix-ui/react-dropdown-menu](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/dropdown-menu) | `2.1.24` | `2.2.1` |
| [@radix-ui/react-popover](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/popover) | `1.1.23` | `1.3.1` |
| [@radix-ui/react-select](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/select) | `2.3.7` | `2.4.1` |
| [@radix-ui/react-slider](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/slider) | `1.4.7` | `1.6.1` |
| [@radix-ui/react-switch](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/switch) | `1.3.7` | `1.4.1` |
| [@radix-ui/react-tooltip](https://github.com/radix-ui/primitives/tree/HEAD/packages/react/tooltip) | `1.2.16` | `1.4.1` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.13` | `3.14.20` |
| [@uiw/react-codemirror](https://github.com/uiwjs/react-codemirror) | `4.25.11` | `4.25.12` |
| [@viz-js/viz](https://github.com/mdaines/viz-js/tree/HEAD/packages/viz) | `3.29.0` | `3.31.0` |
| [docx-preview](https://github.com/VolodymyrBaydalka/docxjs) | `0.4.0` | `0.4.1` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.16` | `3.4.17` |
| [jszip](https://github.com/Stuk/jszip) | `3.10.1` | `3.10.2` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `0.417.0` | `0.577.0` |
| [mammoth](https://github.com/mwilliamson/mammoth.js) | `1.12.1` | `1.13.0` |
| [pdfjs-dist](https://github.com/mozilla/pdf.js) | `4.8.69` | `4.10.38` |
| [pyodide](https://github.com/pyodide/pyodide) | `0.27.7` | `0.29.5` |
| [react-virtuoso](https://github.com/petyosi/react-virtuoso/tree/HEAD/packages/react-virtuoso) | `4.18.12` | `4.18.19` |
| [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.7` |



Updates `@formkit/auto-animate` from 0.8.4 to 0.10.0
- [Release notes](https://github.com/formkit/auto-animate/releases)
- [Commits](formkit/auto-animate@0.8.4...v0.10.0)

Updates `@google/genai` from 2.29.1 to 2.30.0
- [Release notes](https://github.com/googleapis/js-genai/releases)
- [Changelog](https://github.com/googleapis/js-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/js-genai@v2.29.1...v2.30.0)

Updates `@radix-ui/react-alert-dialog` from 1.1.23 to 1.2.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/alert-dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/alert-dialog)

Updates `@radix-ui/react-context-menu` from 2.3.7 to 2.4.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/context-menu/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/context-menu)

Updates `@radix-ui/react-dialog` from 1.1.23 to 1.3.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dialog/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dialog)

Updates `@radix-ui/react-dropdown-menu` from 2.1.24 to 2.2.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/dropdown-menu/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/dropdown-menu)

Updates `@radix-ui/react-popover` from 1.1.23 to 1.3.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/popover/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/popover)

Updates `@radix-ui/react-select` from 2.3.7 to 2.4.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/select/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/select)

Updates `@radix-ui/react-slider` from 1.4.7 to 1.6.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/slider/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/slider)

Updates `@radix-ui/react-switch` from 1.3.7 to 1.4.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/switch/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/switch)

Updates `@radix-ui/react-tooltip` from 1.2.16 to 1.4.1
- [Changelog](https://github.com/radix-ui/primitives/blob/main/packages/react/tooltip/CHANGELOG.md)
- [Commits](https://github.com/radix-ui/primitives/commits/HEAD/packages/react/tooltip)

Updates `@tanstack/react-virtual` from 3.14.13 to 3.14.20
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.20/packages/react-virtual)

Updates `@uiw/react-codemirror` from 4.25.11 to 4.25.12
- [Release notes](https://github.com/uiwjs/react-codemirror/releases)
- [Commits](uiwjs/react-codemirror@v4.25.11...v4.25.12)

Updates `@viz-js/viz` from 3.29.0 to 3.31.0
- [Release notes](https://github.com/mdaines/viz-js/releases)
- [Changelog](https://github.com/mdaines/viz-js/blob/v3/packages/viz/CHANGELOG.md)
- [Commits](https://github.com/mdaines/viz-js/commits/release-viz-3.31.0/packages/viz)

Updates `docx-preview` from 0.4.0 to 0.4.1
- [Release notes](https://github.com/VolodymyrBaydalka/docxjs/releases)
- [Commits](https://github.com/VolodymyrBaydalka/docxjs/commits)

Updates `dompurify` from 3.4.16 to 3.4.17
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.16...3.4.17)

Updates `jszip` from 3.10.1 to 3.10.2
- [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md)
- [Commits](Stuk/jszip@v3.10.1...v3.10.2)

Updates `lucide-react` from 0.417.0 to 0.577.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/0.577.0/packages/lucide-react)

Updates `mammoth` from 1.12.1 to 1.13.0
- [Release notes](https://github.com/mwilliamson/mammoth.js/releases)
- [Changelog](https://github.com/mwilliamson/mammoth.js/blob/master/NEWS)
- [Commits](mwilliamson/mammoth.js@1.12.1...1.13.0)

Updates `pdfjs-dist` from 4.8.69 to 4.10.38
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v4.8.69...v4.10.38)

Updates `pyodide` from 0.27.7 to 0.29.5
- [Release notes](https://github.com/pyodide/pyodide/releases)
- [Commits](pyodide/pyodide@0.27.7...0.29.5)

Updates `react-virtuoso` from 4.18.12 to 4.18.19
- [Release notes](https://github.com/petyosi/react-virtuoso/releases)
- [Changelog](https://github.com/petyosi/react-virtuoso/blob/main/packages/react-virtuoso/CHANGELOG.md)
- [Commits](https://github.com/petyosi/react-virtuoso/commits/react-virtuoso@4.18.19/packages/react-virtuoso)

Updates `ws` from 8.21.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.3...8.22.0)

Updates `zod` from 4.4.3 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.7)

---
updated-dependencies:
- dependency-name: "@formkit/auto-animate"
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@google/genai"
  dependency-version: 2.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-alert-dialog"
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-context-menu"
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-popover"
  dependency-version: 1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-slider"
  dependency-version: 1.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-switch"
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@radix-ui/react-tooltip"
  dependency-version: 1.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.20
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@uiw/react-codemirror"
  dependency-version: 4.25.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@viz-js/viz"
  dependency-version: 3.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: docx-preview
  dependency-version: 0.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: dompurify
  dependency-version: 3.4.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: jszip
  dependency-version: 3.10.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 0.577.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: mammoth
  dependency-version: 1.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pdfjs-dist
  dependency-version: 4.10.38
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pyodide
  dependency-version: 0.29.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: react-virtuoso
  dependency-version: 4.18.19
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 19, 2026
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Deploying amc-webui with  Cloudflare Pages  Cloudflare Pages

Latest commit: 12a93cc
Status: ✅  Deploy successful!
Preview URL: https://019369ea.all-model-chat.pages.dev
Branch Preview URL: https://dependabot-npm-and-yarn-prod-cmvq.all-model-chat.pages.dev

View logs

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 26, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-445c2dc229 branch October 26, 2026 01:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants