fix: upgrade basic-ftp to 5.2.0 (CVE-2026-27699)

.changeset/README.md

@@ -0,0 +1,40 @@
+# Changesets
+
+This folder holds pending changesets. Versions, `CHANGELOG.md` files and npm
+publishing are driven from them by
+[`@changesets/cli`](https://github.com/changesets/changesets)
+- see [CONTRIBUTING.md](../CONTRIBUTING.md#changesets) for the full workflow and
+  [Changeset format](../CONTRIBUTING.md#changeset-format) for the rules this
+  project expects.
+
+Add one with `yarn changeset`, or write the file by hand:
+
+```markdown
+---
+"@joint/core": minor
+---
+
+dia.Paper - add `originX` and `originY` options to `getFitToContentArea()`
+```
+
+The short version of the format:
+
+- **Frontmatter** - which packages this changeset releases, and the bump type
+  (`patch`, `minor`, `major`). Listing several packages is rare: the body is
+  copied verbatim into each one's changelog. Prefer one changeset per package.
+- **Body** - the changelog entry, one line, `scope - description`. One changeset
+  becomes exactly one changelog bullet (later lines are folded into that same
+  bullet, not turned into new ones) - so write no `-`/`*` bullets of your own
+  and add another changeset file for each further changelog line.
+- **Scope** - usually `namespace.Class` (`dia.Paper`, `elementTools.Control`,
+  `mvc.View`, `layout.MSAGL`), or the component/hook for `@joint/react`
+  (`<Paper />`, `useCells`). A bare `namespace` (`anchors`, `connectionPoints`)
+  when the change covers all of it; no scope at all for package-wide,
+  architectural changes.
+- **Description** - less than ~100 characters, lowercase, no trailing period,
+  verb first. Code artifacts in backticks (`` `changeId` ``,
+  `` `batch:start` ``, `` `initializeUnmounted: true` ``); functions and
+  methods always with `()`.
+
+An empty changeset (`yarn changeset add --empty`) marks a PR that touches
+releasable files but should not trigger a release.

.changeset/config.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@4.0.0/schema.json",
+  "baseBranch": "master",
+  "access": "public",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "ignore": [],
+  "fixed": [],
+  "linked": [
+    [
+      "@joint/core",
+      "@joint/layout-directed-graph",
+      "@joint/layout-msagl",
+      "@joint/router-avoid"
+    ]
+  ],
+  "updateInternalDependencies": "patch",
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  },
+  "changedFilePatterns": [
+    "**",
+    "!**/*.test.{js,jsx,ts,tsx,mjs}",
+    "!**/test/**",
+    "!**/__tests__/**",
+    "!**/__mocks__/**",
+    "!**/bench/**",
+    "!**/demo/**",
+    "!**/stories/**",
+    "!**/.storybook/**",
+    "!**/dist/**",
+    "!**/build/**",
+    "!**/coverage/**",
+    "!**/coverage.json",
+    "!**/.tscache/**",
+    "!**/scripts/**",
+    "!**/grunt/**",
+    "!**/Gruntfile.js",
+    "!**/Makefile",
+    "!**/rollup.config.*",
+    "!**/rollup.resources.mjs",
+    "!**/vite.config.*",
+    "!**/vitest.workspace.*",
+    "!**/jest.config.js",
+    "!**/jest.react18.config.mjs",
+    "!**/karma.conf.js",
+    "!**/tsconfig*.json",
+    "!**/dts-generator.config.js",
+    "!**/knip.json",
+    "!**/typedoc.*",
+    "!**/.prettierrc*",
+    "!**/.gitignore",
+    "!**/eslint.config.mjs",
+    "!**/*.md",
+    "!**/LICENSE"
+  ]
+}

.changeset/container-membership-notifications.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+fix stale cell keys when a single commit swaps ids without changing the count (membership changes now notify key-list subscribers, and large-graph rendering no longer defers id updates)

.changeset/link-anchor-arrowhead.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+link routing - account for the arrowhead when a custom link anchor is used

.changeset/paper-guard-blank-pointerdown.md

@@ -0,0 +1,5 @@
+---
+"@joint/core": patch
+---
+
+dia.Paper - the `guard` option can now veto blank pointerdowns; its `view` argument is `undefined` when the event did not hit a cell view

.changeset/paper-magnet-interactive-controls.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+<Paper /> - support interactive controls (buttons, inputs) nested inside magnets without the press starting a link drag or an element move

.changeset/right-angle-path-extraction.md

@@ -0,0 +1,5 @@
+---
+"@joint/core": patch
+---
+
+routers.rightAngle - refactor the path-finding algorithm into a separate utility

.changeset/router-avoid-initial-release.md

@@ -0,0 +1,5 @@
+---
+"@joint/router-avoid": patch
+---
+
+Initial release - automatic obstacle-avoiding orthogonal link routing via libavoid (WASM), with main-thread and Web Worker providers

.changeset/use-cell-removed-mid-render.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+useCell - tolerate a cell removed from the graph mid-render

.changeset/use-combined-ref-commit-assignment.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+useCombinedRef - assign the forwarded ref during the commit phase

.changeset/use-markup-unrendered-view.md

@@ -0,0 +1,5 @@
+---
+"@joint/react": patch
+---
+
+useMarkup - tolerate a cell view whose markup has not been rendered yet (synchronous rendering in development)

.github/pull_request_template.md

@@ -3,10 +3,11 @@ Thank you for submitting a pull request!
 
 Please verify that:
 * [ ] Code is up-to-date with the `master` branch
-* [ ] You've successfully run `grunt test` locally
+* [ ] You've successfully run `yarn test` locally
 * [ ] If applicable, there are new or updated unit tests validating the change
 * [ ] If applicable, there are new or updated @types
 * [ ] If applicable, documentation has been updated
+* [ ] If the change is releasable, you've added a changeset (`yarn changeset`)
 -->
 
 ## Description

.github/workflows/codeql.yml

@@ -39,11 +39,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -57,7 +57,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -70,6 +70,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/publish-joint-react-docs.yml

@@ -39,17 +39,17 @@ jobs:
 
     steps:
       # Checkout the repo contents
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       # Set up Node.js version for building
       - name: Use Node.js 22.14.0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: '22.14.0'
 
       # Cache Yarn packages to speed up CI
       - name: Cache Yarn
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             .yarn/cache
@@ -87,7 +87,7 @@ jobs:
 
       # Upload the built docs as an artifact for GitHub Pages deployment
       - name: Upload GitHub Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: ./packages/joint-react/docs
 
@@ -103,9 +103,9 @@ jobs:
     steps:
       # Setup GitHub Pages deployment environment
       - name: Setup GitHub Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@v6
 
       # Deploy the uploaded artifact to GitHub Pages
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/release.yml

@@ -0,0 +1,155 @@
+# Release pipeline, driven by Changesets (https://changesets.dev).
+#
+# On every push to `master` this workflow decides between two modes:
+#
+#   * `version` - there are pending changesets in `.changeset/`. The workflow
+#     applies the version bumps + per-package `CHANGELOG.md` entries, deletes
+#     the consumed changesets and opens (or updates) `changeset-release/master`
+#     PR titled "Version Packages".
+#   * `publish` - the release PR has been merged, so the versions in `master`
+#     are ahead of what is on npm. The workflow builds the workspace, publishes
+#     every changed public package, and creates a git tag + GitHub Release per
+#     published package.
+#
+# Nothing is published until the release PR is merged by a maintainer.
+#
+# Repository setup:
+#   * Settings > Actions > General > "Allow GitHub Actions to create and approve
+#     pull requests" must be enabled (needed to open the release PR).
+#   * Secret `NPM_TOKEN` - an npm automation token that bypasses 2FA.
+#
+# Note: the release PR is opened by `github-actions[bot]`, so `test-pr.yml` does
+# not run on it.
+name: Release
+
+on:
+  push:
+    branches: [ "master" ]
+
+# Reset permissions and grant them explicitly per job.
+permissions: {}
+
+# Never release twice at the same time.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Decide whether this push should version or publish.
+  select-mode:
+    if: ${{ github.repository == 'clientIO/joint' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      mode: ${{ steps.select-mode.outputs.mode }}
+    steps:
+      - name: Checkout joint
+        id: checkout-joint
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js v22
+        id: setup-node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22.14.0
+
+      - name: Cache Yarn
+        id: cache-yarn
+        uses: actions/cache@v6
+        with:
+          path: |
+            .yarn/cache
+          key: yarn-cache-${{ hashFiles('yarn.lock') }}
+
+      - name: Install dependencies
+        id: install-dependencies
+        run: yarn install --immutable
+
+      - name: Select Changesets mode
+        id: select-mode
+        uses: changesets/action/select-mode@v2
+
+  # Pending changesets: open/update the "Version Packages" PR.
+  version:
+    needs: select-mode
+    if: ${{ needs.select-mode.outputs.mode == 'version' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # commit the version bumps
+      pull-requests: write # open the release PR
+    steps:
+      - name: Checkout joint
+        id: checkout-joint
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js v22
+        id: setup-node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22.14.0
+
+      - name: Cache Yarn
+        id: cache-yarn
+        uses: actions/cache@v6
+        with:
+          path: |
+            .yarn/cache
+          key: yarn-cache-${{ hashFiles('yarn.lock') }}
+
+      - name: Install dependencies
+        id: install-dependencies
+        run: yarn install --immutable
+
+      # Runs `changeset version` and pushes the result to `changeset-release/master`.
+      - name: Version packages
+        id: version-packages
+        uses: changesets/action/version@v2
+
+  # Release PR merged: build and publish everything that is not on npm yet.
+  publish:
+    needs: select-mode
+    if: ${{ needs.select-mode.outputs.mode == 'publish' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # push git tags and create GitHub Releases
+    steps:
+      - name: Checkout joint
+        id: checkout-joint
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js v22
+        id: setup-node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22.14.0
+          # No `registry-url` on purpose (not used by Yarn)
+
+      - name: Cache Yarn
+        id: cache-yarn
+        uses: actions/cache@v6
+        with:
+          path: |
+            .yarn/cache
+          key: yarn-cache-${{ hashFiles('yarn.lock') }}
+
+      - name: Install dependencies
+        id: install-dependencies
+        run: yarn install --immutable
+
+      - name: Build packages
+        id: build-packages
+        run: yarn dist
+
+      # Runs `changeset publish`, which publishes through `yarn npm publish` (Yarn Berry
+      # is auto-detected), then tags each published package and cuts a GitHub Release.
+      - name: Publish packages
+        id: publish-packages
+        uses: changesets/action/publish@v2
+        env:
+          YARN_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          # No `NODE_AUTH_TOKEN` on purpose (must use Yarn)