Skip to content

fix: bump the production-dependencies group across 1 directory with 7 updates - #588

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c2dc63873c
Closed

fix: bump the production-dependencies group across 1 directory with 7 updates#588
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-dependencies-c2dc63873c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
@napi-rs/canvas 1.0.11 1.0.13
lucide-react 1.58.0 1.61.0
@napi-rs/keyring 2.1.1 2.1.2
@tanstack/react-virtual 3.14.21 3.14.22
docx 9.11.0 9.14.0
officeparser 8.1.1 8.2.0
zod 4.6.6 4.6.7

Updates @napi-rs/canvas from 1.0.11 to 1.0.13

Release notes

Sourced from @​napi-rs/canvas's releases.

v1.0.13

What's Changed

Full Changelog: Brooooooklyn/canvas@v1.0.12...v1.0.13

v1.0.12

What's Changed

New Contributors

Full Changelog: Brooooooklyn/canvas@v1.0.11...v1.0.12

Changelog

Sourced from @​napi-rs/canvas's changelog.

1.0.13 (2026-10-21)

Bug Fixes

  • canvas: wrap native methods, not previous wrappers, on re-evaluation (#1395) (6997e1d)

1.0.12 (2026-10-20)

Bug Fixes

  • canvas: compositing, shadows, drawCanvas and filters like Chrome (#1379) (c6f06a6)
  • canvas: draw Image sources from Chrome's decode-cache levels (#1367) (7c3d0c2)
  • canvas: enable dithering for gradient fill and stroke paints (#1358) (5f95bd4)
  • canvas: gradients and SVG conic export work like Chrome (#1377) (4059399)
  • canvas: ImageData patterns and SvgCanvas reads like Chrome (#1363) (e2f6a83)
  • canvas: match Chrome for alpha:false, clearRect and 'copy' (#1365) (d82b79c)
  • canvas: match Chrome for hsl() colors and gradient edge cases (#1362) (17a4b3b)
  • canvas: parse fonts, lay out and measure text like Blink (#1381) (a43bb16)
  • canvas: paths, clips, roundRect and setTransform work like Chrome (#1375) (1299146)
  • canvas: preserve fractional global alpha through native paints (#1355) (2eb68bc)
  • canvas: preserve pattern snapshots and honor current image sampling quality (#1357) (65f4e7c)
  • canvas: style getters, shadowColor and canvas sizes like Chrome (#1376) (9bf7aef)
  • canvas: WebIDL conversion for ImageData, getContext, createPattern (#1361) (583b7e2)
  • canvas: WebIDL conversion, arity checks and exceptions like Chrome (#1373) (676047d)
  • codecs: Chrome's encoders, AVIF decode, data: URLs and SVG images (#1380) (b5b38a9)
  • crash-safe non-finite args, ImageData sizes, DOMMatrixInit (#1372) (004444b)
  • deps: pin font-types back to Skia's 0.12.0 (#1388) (57cd52b)
  • deps: update rust crate font-types to v0.12.7 (#1386) (61d89eb)
  • imagedata: ImageData and get/put/createImageData work like Chrome (#1374) (82eeacc)
  • reset style getters on resize, tag AVIF color, exact PDF alpha (#1364) (09b86b4)
  • retain display-p3 backing surfaces through context acquisition and resize (#1359) (0b502f6)

Features

  • canvas: float16 canvas storage and float ImageData formats (#1383) (5f841db)
  • canvas: rasterize text like Chrome with CoreText and Fontations (#1382) (4c9902a)
  • canvas: write DPI and text metadata in toBuffer, encode and encodeSync (#1390) (60f2df2)
  • chrome/m157 (#1391) (2c52f61)
  • color: CSS Color 4/5 at every canvas color site, like Chrome (#1378) (3be7099)
  • skia: build Skia with Chrome's CPU raster defines and blitters (#1366) (9eeb454)
  • svg: draw SVG images like Chrome: CSS, var(), , (#1384) (b04d0bc)
Commits
  • 00a115d 1.0.13
  • 6997e1d fix(canvas): wrap native methods, not previous wrappers, on re-evaluation (#1...
  • a89b3c9 1.0.12
  • b0e53ea chore: remove the benchmark (#1393)
  • 2c52f61 feat: chrome/m157 (#1391)
  • 60f2df2 feat(canvas): write DPI and text metadata in toBuffer, encode and encodeSync ...
  • 57cd52b fix(deps): pin font-types back to Skia's 0.12.0 (#1388)
  • 61d89eb fix(deps): update rust crate font-types to v0.12.7 (#1386)
  • b04d0bc feat(svg): draw SVG images like Chrome: CSS, var(), <use>, <image> (#1384)
  • 5f841db feat(canvas): float16 canvas storage and float ImageData formats (#1383)
  • Additional commits viewable in compare view

Updates lucide-react from 1.58.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Commits
  • fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
  • See full diff in compare view

Updates @napi-rs/keyring from 2.1.1 to 2.1.2

Release notes

Sourced from @​napi-rs/keyring's releases.

v2.1.2

What's Changed

Full Changelog: Brooooooklyn/keyring-node@v2.1.1...v2.1.2

Commits

Updates @tanstack/react-virtual from 3.14.21 to 3.14.22

Release notes

Sourced from @​tanstack/react-virtual's releases.

@​tanstack/react-virtual@​3.14.22

Patch Changes

Changelog

Sourced from @​tanstack/react-virtual's changelog.

3.14.22

Patch Changes

Commits

Updates docx from 9.11.0 to 9.14.0

Release notes

Sourced from docx's releases.

9.14.0 adds citations, captions, document protection and embedded files, and fixes tables of contents in LibreOffice. A document can now cite its sources and list them in a bibliography, in each of Word's citation styles, from the new docx/bibliography entry, and style: "Caption" now gives captions Word's Caption style, with a new guide to captions and cross-references (#557). protection makes a document read-only in Word, or keeps parts of it editable with EditableRangeStart and EditableRangeEnd, with an optional password (#2271). EmbeddedFileRun, from the new docx/embedded-files entry, embeds a file such as a spreadsheet as an object that opens when double-clicked (#719). There are smaller additions too. fitText fits a run's text to a width (#2597). Table cell borders take diagonalDown and diagonalUp to split a header cell (#3121). TableOfContents takes a tabLeader, so the space before page numbers can be blank or hyphens rather than dots (#1696). styles.default.lineNumber styles a section's line numbers (#551), and patchDocument can set a document's properties, such as its title and author (#2701). On the fixes side, docx now defines the TOC1 to TOC9 styles that table of contents entries use, so LibreOffice keeps the levels indented after it updates the table (#3819). It also writes a half-inch default tab stop, so tabs and list text line up in Pages (#2590). package.json now says docx needs Node.js 16 or later, as it already did in practice.

What's Changed

New Contributors

Full Changelog: dolanmiu/docx@9.13.0...9.14.0

9.13.0 adds three features and drops two dependencies. A document can now have VBA macros, which makes it a macro-enabled .docm. Write them from VBA code with createMacros, from the new docx/macros entry, or pass in the vbaProject.bin from a .docm that Word saved (#471). A numbered paragraph can restart its list with numbering: { restart: true }, so you no longer have to make up instance numbers (#3037). Runs can use Word's Two Lines in One and Horizontal in Vertical with eastAsianLayout (#1943). docx now reads and writes XML itself, so it no longer depends on xml and xml-js, which are no longer maintained (#3471). There are also fixes for several long-standing issues. patchDocument can read a template from a stream (#2321). An index entry field no longer scrambles the document in Word (#1546), and a table row with no cells is left out, since Word can't open it (#2724). Components made by another copy of docx, such as one bundled with a plugin, are written correctly (#2988). When page numbers come from docx/layout, a numbered heading's table of contents entry now starts with its number (#1130).

What's Changed

... (truncated)

Commits
  • 07286f3 chore: Version bump to 9.14.0
  • eadca50 fix: define the TOC 1 to TOC 9 styles, so LibreOffice keeps the levels of a t...
  • d8a3a73 build(deps-dev): bump eslint-plugin-jsdoc from 65.3.11 to 65.3.12 (#3820)
  • 799bc7f feat: choose what fills the space before a table of contents' page numbers, s...
  • 5050cc0 feat: draw diagonal lines across table cells, to split a header cell (#3121) ...
  • 8a84c59 fix: write a half-inch default tab stop, so tabs and list text line up in Pag...
  • a82643b build(deps-dev): bump markdown-it (#3815)
  • b873832 feat: cite sources and list them in a bibliography, in each of Word's styles,...
  • 9397bbd feat: write Word's Caption style, and document captions and cross-references ...
  • ba2b4e2 feat: protect a document from changes in Word, with a password and editable r...
  • Additional commits viewable in compare view

Updates officeparser from 8.1.1 to 8.2.0

Release notes

Sourced from officeparser's releases.

v8.2.0: 🧩 Template Conditions, Loops & Formatting, Fonts in the Native PDF Engine

I am pleased to announce the release of officeParser v8.2.0! Word templates grow from fill-in fields into real documents: conditions, loops over paragraphs and table rows, and Word's own number and date formats. The native PDF engine now draws in fonts you give it, so any script converts, and writes a bookmark outline. PDF parsing can keep to the headings a document tags, Excel date and time cells read as the sheet shows them, and allowRemoteAssets: false makes sure a parse fetches nothing from a CDN.

Thanks to @​MasaGon and @​L4XB, whose reports and fixes drove this release.

A huge shoutout to Raymond Camden (@​cfjedimaster), whose ideas shaped this release's template work: conditions, loops and Word's number and date formats grew out of his suggestions.

[!WARNING] Behavior changes

  • Excel date and time cells are text. A cell formatted as a date, a time or a duration reads as ISO text (2024-09-30, 14:05:00, 36:00:00), where it read as the number Excel stores (45565, 0.25, 1.5). If you converted serial numbers yourself, drop that step.
  • Templates read tags they left as typed before. {{ if paid }} and {{ for line in lines }} are now blocks, so one without its closing tag rejects with TEMPLATE_SYNTAX, and {{ name | upper }} or {{ total | format "0.00" }} is now filled. {{else}}, {{endif}} and {{endfor}} are block tags: a field with one of those names is no longer filled, and one with no block to belong to rejects. {{if}} and {{for}} alone, which were filled as fields named if and for, are now left as text. A block keyword spelt as other template languages spell it (elseif, elif, end if) rejects, naming the spelling to use. With custom delimiters made of letters or digits, a tag is the shortest stretch between a start and an end delimiter.
  • A template is held to decompressionLimits.maxXmlElements, as a parse is: a template whose elements, tags and the tokens in its tags together number more than that rejects with XML_ELEMENT_LIMIT_EXCEEDED.
  • A template field whose value is a list, an object or a function rejects with TEMPLATE_DATA_INVALID, where it was written as [object Object], its items joined by commas, or the function's source. Loop over a list, or name the field you want ({{ customer.name }}).
  • A Markdown table's header row is a header, and no longer bold. It is written as <th> in a <thead>, and in DOCX, ODT, RTF and LaTeX as a repeating header row without added bold, as a header row from HTML or Word already was. Bold an author typed in a header cell is kept. RTF now writes every header row with \trhdr and reads a \trhdr row as the header.
  • HTML output loads Chart.js only for a page that draws a chart. With no chart script to draw with (htmlConfig.chartJsSrc: '', or a parse under allowRemoteAssets: false), a chart is written as a table of its values, with a CONTENT_NOT_REPRESENTABLE warning.
  • The native PDF engine's CONTENT_NOT_REPRESENTABLE warnings carry details.reason, and the one for text that could not be drawn comes once, when the conversion ends, with a count and a sample. A chart raises it too.
  • An embed size or video id that is not one is not read. A Markdown or HTML width or height must be a CSS length, and a video id an id; a ::youtube directive with an id that is not one stays text.

🌟 Key Highlights

1. Template Conditions and Loops

OfficeTemplate.render now keeps or drops content with {{ if }} and repeats it with {{ for }}. Where the tags sit decides what they cover, so a template needs no special markup:

Where the tags are What repeats or is kept
In one paragraph The text between them
In paragraphs of their own The paragraphs between them (the tag paragraphs go too, leaving no blank line)
In different cells of one table Whole table rows 
{{ for line in lines }}  {{ line.item }}  {{ line.qty }}  {{ line.price | format "$#,#[#0](https://github.com/harshankur/officeParser/issues/0).00" }}  {{ endfor }}
{{ if total > 1000 }}Free shipping.{{ else }}Shipping: $15.{{ endif }}

Conditions compare and combine fields, numbers, strings, dates, true, false and null. Inside a loop, loop.index, loop.number, loop.first, loop.last and loop.length describe the pass. Each copy of a picture, bookmark, paragraph, content control, footnote or comment gets ids of its own, so the output opens in Word without repair, and a footnote in a loop reads that pass's item. Two new errors name the tag and the part when something does not fit: TEMPLATE_SYNTAX and TEMPLATE_DATA_INVALID. decompressionLimits.maxRepeatedContent bounds what loops can add.

2. Word's Number and Date Formats

{{ total | format "$#,#[#0](https://github.com/harshankur/officeParser/issues/0).00" }}       ->  $1,250.50
{{ due | format "MMMM d, yyyy" }}      ->  November 1, 2026
{{ name | upper }}                     ->  ACME CORP

The pictures are Word's own (its \# and \@ switches), with sections for negative numbers and zero, percentages and quoted text. Formatting is done by officeParser, not the runtime's Intl, so a template renders the same in every Node version and browser. numberSeparators, dateNames and utcOffsetMinutes set what it writes, and formatters adds filters of your own.

... (truncated)

Changelog

Sourced from officeparser's changelog.

[8.2.0] - 2026-10-20

Added

  • Templates take conditions and loops. OfficeTemplate.render fills {{ if cond }} ... {{ else if cond }} ... {{ else }} ... {{ endif }}, which keeps one branch, and {{ for item in list }} ... {{ endfor }}, which repeats its content once per item. Where the tags sit decides what they cover: the text between them in one paragraph, the paragraphs between them (when every tag of the block has a paragraph of its own, those paragraphs are removed with the tags, so no blank line is left), or whole table rows when they are in different cells of one table, so a row with {{ for line in lines }} in its first cell and {{ endfor }} in its last repeats once per line. Conditions compare (==, !=, <, <=, >, >=) and combine (and, or, not, parentheses) fields, numbers, strings, dates, true, false and null; keywords are case-insensitive and quotes may be curly, as Word's AutoCorrect writes them. Inside a loop, loop.index, loop.number, loop.first, loop.last and loop.length describe the pass. Data can be nested objects and lists, read by path ({{ customer.address.city }}, {{ items.0.name }}). onMissing covers the new tags: 'keep' leaves a block whose field is missing as typed, 'empty' treats the field as empty, 'error' rejects. Two new errors name the tag and the part: TEMPLATE_SYNTAX, for blocks that do not pair (naming a tag that could not be read, such as {{ if a = 1 }}, where that is why) or tags that cannot enclose content together (one in a table and the other outside it, one inside a tracked change, one in a Word field and the other outside it), and TEMPLATE_DATA_INVALID, for a value that does not fit its tag (a loop over text, a comparison of text with a number). A block keyword spelt as other template languages spell it (elseif, elif, end if) rejects at once with TEMPLATE_SYNTAX, naming the spelling to use. Copies of pictures, bookmarks (their names too), paragraphs and content controls get fresh ids, a footnote, endnote or comment in a copy gets a copy of its own, filled in for that pass (so {{ item }} in a footnote reads the pass's item), a table a loop left with no row is removed, and decompressionLimits.maxRepeatedContent bounds what loops add. A template is held to decompressionLimits.maxXmlElements as a parse is, its tags and their tokens (operands, filters, picture parts) counted with its elements (XML_ELEMENT_LIMIT_EXCEEDED).
  • Templates format values with pictures, as Word does. {{ total | format "$#,#[#0](https://github.com/harshankur/officeParser/issues/0).00" }} writes $1,250.50 and {{ due | format "MMMM d, yyyy" }} writes November 1, 2026: Word's number and date pictures (its \# and \@ switches; Excel's number formats read number pictures the same way, apart from Excel's thousands scaling, which a picture rejects, while in a date picture m is the minute, as in Word), with sections for negative numbers and zero, percentages and quoted text. Text that is a number or an ISO 8601 date is taken too, as form data carries them. The formatting is the library's own, not the runtime's Intl, so a template renders the same in every Node version and browser; numberSeparators, dateNames and utcOffsetMinutes set what it writes. upper and lower change case, filters chain, and formatters adds filters of your own. A picture given the wrong kind of value rejects with TEMPLATE_DATA_INVALID (reason unformattable).
  • PDF: headingDetection: 'tags' gives only the headings a document tags. Under 'auto' a heading is either one the PDF's structure tree tags (H, H1..H6) or one the font-size and weight heuristic makes of text read from geometry: an untagged PDF, a page whose tags cover too little of its text, or a line outside the tags on a tagged page. Under 'tags' a tagged heading keeps its tagged level and text read from geometry is never a heading, so an untagged PDF, and any PDF under useTags: false, has none. The text is the same as under 'auto': only whether a block is a heading or a paragraph differs. The CLI takes it as --pdfParserConfig.headingDetection=tags. (#117)
  • The native PDF engine draws in fonts you give it. pdfConfig.engine: 'native' drew in the Standard-14 Helvetica and Courier fonts only, so a Greek, Cyrillic, Hindi, Arabic, Chinese, Japanese or Korean document converted to a PDF of question marks. pdfConfig.fonts (regular, bold, italic, boldItalic, mono) and pdfConfig.fallbackFonts take font files (.ttf/.otf bytes): each character is drawn in the first font that has it, so one document can mix scripts, and measuring uses the font a word is drawn in. Words are shaped by the font (ligatures, Arabic joining, Indic conjuncts) and a right-to-left line starts at the right edge with its words in visual order. Fonts are subset to the glyphs used (pdfConfig.subsetFonts: false embeds the files whole). Embedding needs the new optional peer dependency @pdf-lib/fontkit; without fonts nothing changes. A value that is not a font file's bytes (a file name, an empty file) is reported (INVALID_CONFIG_VALUE), as is a style name fonts does not know (UNRECOGNIZED_CONFIG_OPTION). The CLI takes font file paths (--pdfConfig.fonts.regular=, --pdfConfig.fallbackFonts=a.ttf,b.otf).
  • The native PDF engine writes a bookmark outline. pdfConfig.outline: true was an HTML-engine option only. The native engine now writes one entry per heading, nested by heading level, each pointing at its heading.
  • allowRemoteAssets: false makes a parse fail where it would fetch from a CDN. With pdfWorkerSrc left out, the non-slim builds load the pdf.js worker from jsDelivr, and OCR loads Tesseract's worker, core and language data from a CDN unless ocrConfig.workerPath, corePath and langPath say where they are. For an application that must make no request to another site, one forgotten option was a third-party request. With allowRemoteAssets: false such a parse rejects with the new REMOTE_ASSET_BLOCKED error, which names the options to set. An address you pass yourself is used as given, and output written from such a parse names no chart script address unless htmlConfig.chartJsSrc is set.
  • ocrConfig.cacheMethod. Tesseract keeps the language data it loads (IndexedDB in the browser). 'none' neither reads nor stores it, and 'readOnly' and 'refresh' are passed through as well; the default is Tesseract's own, 'write'. Another value is reported (INVALID_CONFIG_VALUE) and the default used. The CLI takes --ocrConfig.cacheMethod.
  • maxPassword...

    Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 26, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ⚠️ Failed 2026-10-26T09:06:42.821900Z
We couldn’t complete this review. Comment @codex review to try again.		 e776e82 New commits
🔒 Security Review ⚠️ Failed 2026-10-26T09:05:32.428716Z
We couldn’t complete this review. Comment @codex security review to try again.		 e776e82 New commits
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@gansx
gansx enabled auto-merge October 26, 2026 06:19
@gansx

gansx commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@gansx

gansx commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot dependabot Bot changed the title fix: bump the production-dependencies group with 7 updates fix: bump the production-dependencies group across 1 directory with 7 updates Oct 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-c2dc63873c branch from b1b2fa5 to 4c337e8 Compare October 26, 2026 07:12
chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 26, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4c337e85cd

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread apps/desktop/package.json
"dependencies": {
"@ling-stack/browser-host": "workspace:*",
"@napi-rs/canvas": "1.0.11",
"@napi-rs/canvas": "1.0.13",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add distribution evidence for canvas 1.0.13

Desktop packaging now installs @napi-rs/canvas@1.0.13, but collectCanvasMaterials only accepts 0.1.80 and 1.0.11, and the accompanying source manifest has no 1.0.13 entry. Consequently every distribution collection records native_vendor_source_and_notice_materials_missing, leaving the manifest blocked and causing verifyMaterials/release packaging to fail until the new native binary's evidence is added.

Useful? React with 👍 / 👎.

Comment thread apps/desktop/package.json
"react": "^19.2.8",
"react-dom": "^19.2.8",
"@napi-rs/keyring": "2.1.1",
"@napi-rs/keyring": "2.1.2",

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the keyring version assertion

The dependency is bumped to 2.1.2, but apps/desktop/tests/engine-secret-package.test.mjs:8 still asserts that the desktop package pins 2.1.1; whenever this desktop test runs after the dependency installation, it fails immediately with an assertion error. Update the test expectation alongside the package bump.

Useful? React with 👍 / 👎.

@dependabot
fix: bump the production-dependencies group across 1 directory with 7…
e776e82 
… updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@napi-rs/canvas](https://github.com/Brooooooklyn/canvas) | `1.0.11` | `1.0.13` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.58.0` | `1.61.0` |
| [@napi-rs/keyring](https://github.com/Brooooooklyn/keyring-node) | `2.1.1` | `2.1.2` |
| [@tanstack/react-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/react-virtual) | `3.14.21` | `3.14.22` |
| [docx](https://github.com/dolanmiu/docx) | `9.11.0` | `9.14.0` |
| [officeparser](https://github.com/harshankur/officeParser) | `8.1.1` | `8.2.0` |
| [zod](https://github.com/colinhacks/zod) | `4.6.6` | `4.6.7` |



Updates `@napi-rs/canvas` from 1.0.11 to 1.0.13
- [Release notes](https://github.com/Brooooooklyn/canvas/releases)
- [Changelog](https://github.com/Brooooooklyn/canvas/blob/main/CHANGELOG.md)
- [Commits](Brooooooklyn/canvas@v1.0.11...v1.0.13)

Updates `lucide-react` from 1.58.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide-react)

Updates `@napi-rs/keyring` from 2.1.1 to 2.1.2
- [Release notes](https://github.com/Brooooooklyn/keyring-node/releases)
- [Commits](Brooooooklyn/keyring-node@v2.1.1...v2.1.2)

Updates `@tanstack/react-virtual` from 3.14.21 to 3.14.22
- [Release notes](https://github.com/TanStack/virtual/releases)
- [Changelog](https://github.com/TanStack/virtual/blob/main/packages/react-virtual/CHANGELOG.md)
- [Commits](https://github.com/TanStack/virtual/commits/@tanstack/react-virtual@3.14.22/packages/react-virtual)

Updates `docx` from 9.11.0 to 9.14.0
- [Release notes](https://github.com/dolanmiu/docx/releases)
- [Commits](dolanmiu/docx@9.11.0...9.14.0)

Updates `officeparser` from 8.1.1 to 8.2.0
- [Release notes](https://github.com/harshankur/officeParser/releases)
- [Changelog](https://github.com/harshankur/officeParser/blob/master/CHANGELOG.md)
- [Commits](harshankur/officeParser@v8.1.1...v8.2.0)

Updates `zod` from 4.6.6 to 4.6.7
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.6.6...v4.6.7)

---
updated-dependencies:
- dependency-name: "@napi-rs/canvas"
  dependency-version: 1.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@napi-rs/keyring"
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: "@tanstack/react-virtual"
  dependency-version: 3.14.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: docx
  dependency-version: 9.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: lucide-react
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: officeparser
  dependency-version: 8.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: zod
  dependency-version: 4.6.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-c2dc63873c branch from 4c337e8 to e776e82 Compare October 26, 2026 09:01
This was referenced Oct 26, 2026
Merged
Merged
@gansx

gansx commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

安全子集已拆到 #597（lucide-react、react-virtual、docx、officeparser、zod）。canvas 1.0.13 需要补桌面发布供应商证据、keyring 2.1.2 需要同步测试断言，这两个原生包等专门的证据收集任务再升，届时 Dependabot 会单独提。

@gansx gansx closed this Oct 26, 2026
auto-merge was automatically disabled October 26, 2026 15:48

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-c2dc63873c branch October 26, 2026 15:48
@gansx gansx mentioned this pull request Oct 26, 2026
Closed
gansx added a commit that referenced this pull request Oct 26, 2026
@gansx
Merge pull request #597 from ling-stack-org/gansx/prod-deps-safe-subset
790eb2d 
fix(deps): bump safe production dependencies from #588
@gansx gansx mentioned this pull request Oct 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@tianxiaochannel-oss88 tianxiaochannel-oss88 Awaiting requested review from tianxiaochannel-oss88 tianxiaochannel-oss88 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gansx