build(deps): Bump the vectojs group across 1 directory with 4 updates

[dependabot]

Bumps the vectojs group with 4 updates in the / directory: @vectojs/core, @vectojs/devtools, @vectojs/graph3d and @vectojs/ui.

Updates @vectojs/core from 1.24.0 to 1.36.0

Commits

• 970b3fa chore: release @​vectojs/core 1.36.0
• 80ecb39 perf(core): raise idle auto-throttle floor from 2 FPS to 60 FPS (#536)
• 1e14de8 fix(desktop): support dynamic theme switching and viewport resize (#535)
• 3c746cc fix(desktop): window interaction, focus transfer, maximize resize (#534)
• 6e99bea fix(desktop): window hit targets, content fill, app default size (#533)
• 35552ef chore: release desktop 0.2.0, ui 2.16.7, graph3d 0.4.0, kg 0.2.0 (#532)
• a5315da fix(desktop): review fixes for pointer coords, restack, a11y focus (#531)
• 149fbf3 feat(desktop): add @​vectojs/desktop WebOS skeleton (#530)
• d4aa4c8 fix(knowledge-graph): loadSnapshot replaces graph instead of merging
• dd40f36 fix(graph3d,knowledge-graph): address full package code review
• Additional commits viewable in compare view

Updates @vectojs/devtools from 0.11.0 to 0.11.1

Updates @vectojs/graph3d from 0.3.0 to 0.4.0

Updates @vectojs/ui from 2.5.0 to 2.16.7

Changelog

Sourced from @​vectojs/ui's changelog.

2.16.7

Patch Changes

• a5315da: Desktop review (CTX-0368): VectoJSEvent local/scene coords for window chrome; restack without Entity.remove; release a11y on blur; start-menu height; syncLayoutToScene; pointercancel ends drag. Button.setLabel remeasures content-driven width.

2.16.6

Patch Changes

• 66a97b1: ScrollView no longer consumes wheel events when its content already fits the viewport (#525). The handler used to preventDefault before asking whether there was anything to scroll, so a short ScrollView turned its whole band into a page-scroll dead zone: the wheel did nothing inside it and the page underneath never moved. The wheel now passes through to the page whenever maxScroll is zero.

2.16.5

Patch Changes

• d86f5ce: P3 defects from the 2026-08-13 review, across core, markdown and ui.

  • core: Entity.remove now unregisters the detached subtree from the batched-driver candidate set (off-tree drivers no longer tick until completion, and re-attach resumes them); WasmBackendFacade.syncStore clears _aabbsFresh on both rejection returns so a fused hit gather never reads the previous frame's AABBs after a transient kernel rejection; the content-grid zero-measurement branch publishes vectoGridReady from a frame callback like the probe-free branch; parseColorToRGBA returns opaque black for unparseable input instead of the previous parse's canvas color; sanitizeUrl decodes HTML character references before scheme detection so entity-encoded javascript: payloads rewrite to #; SplineEntity bakes at the renderer's clamped pixelRatio and re-bakes on change; WebGLPointRenderer.setTexture commits the pending sprite batch before an atlas swap; GridTextEntity.updateGrid sizes cols from the widest row; Scene.step docstring unit corrected to milliseconds.
  • markdown: CodeBlock.setCode zeroes the highlight-segment reuse prefix when the language changes; the worker's per-instance raw cache is bounded with oldest-entry eviction.
  • ui: TreeView catches lazy-load rejections, clears the loading state and rebuilds rows; virtualized Table.layout() re-syncs string cells of mounted rows; reassigning the public tabs/options arrays re-syncs the a11y hotspot pools; non-keyed VirtualList.setItems zeroes _velY so a replace no longer overshoots the content edge.

• 4323645: Five P2 fixes from the 2026-08-13 review:

  • RichText: syncHotspots now reassigns each existing link hotspot's href on every reconcile, so a setSpans that keeps the link count but changes the urls no longer leaves clicks and the projected <a> serving stale hrefs (#472).
  • VirtualList/Tree/Table: the hand-rolled scroll integrators are dt-aware. The old per-frame gain (0.12) and decay (0.82) are the 60Hz discretization of a 7.2/s gain and an 84ms time constant (τ = −16.67/ln(0.82)), and the position step scales by dt/16.67 — a 60Hz tick reproduces the old feel exactly while the settle trajectory no longer depends on display refresh rate (#473).
  • Popover/Overlay: the Overlay constructor now seeds the full hidden state (a11yHidden = true alongside interactive = false), Popover no longer forces interactive = true at construction, and showAt/showAtPoint restore interactive and clear a11yHidden symmetrically with hide() — a never-shown popover no longer projects itself or its children, and show→hide→show cycles keep projecting (#474).
  • TextArea: caret/selection offsets for RTL content are based on the line's minimum sourceIndex instead of the visually-leftmost node (nodes[0] after x-sort), fixing caret, selection highlight, and composition geometry for mixed RTL/LTR lines (#475).
  • ProgressBar: now sets interactive = true like other draw-only semantic surfaces (Image, ScrollView), so its declared role="progressbar"/aria-valuenow actually projects into the a11y DOM (#476).

2.16.4

Patch Changes

• 2c8d9e3: Fix an infinite loop in Entity.destroy() when a ScrollView's internal content layer was destroyed leaf-first. ScrollView.remove() redirected every child to this.content.remove(child), so when the content layer self-detached inside its own destroy() (a leaf-first tree teardown that walks children before parents), content.remove(content) was a no-op and the destroyed content stayed in ScrollView.children. Entity.destroy()'s drain loop (while (children.length > 0) children.at(-1).destroy()) then spun forever because the already-destroyed child returned immediately without detaching, freezing the page main thread. ScrollView.remove() now detaches direct children (the content layer) via super.remove() and only routes nested children through the content layer.

2.16.3

Patch Changes

• d573b8d: fix selection carriers drifting from painted glyphs by the accumulated kerning delta

  The layout engine positions every glyph by summing isolated per-grapheme advances (no kerning), and the canvas paint is guaranteed to stay within 0.5px of those positions. But the DOM selection carriers measured shaped text — RichText.logicalRuns pinned run widths to whole-string measureText, and Scene's per-grapheme carrier path measured shaped prefix differences of the whole line — so carriers included kerning the canvas never painted. On kerning-heavy Latin text this drifted the native selection box up to 5-8px across a ~300px line in both Gecko and Blink, per word and

... (truncated)

Commits

• 35552ef chore: release desktop 0.2.0, ui 2.16.7, graph3d 0.4.0, kg 0.2.0 (#532)
• a5315da fix(desktop): review fixes for pointer coords, restack, a11y focus (#531)
• 8104132 chore: release core 1.35.3, ui 2.16.6, markdown 0.20.3 (upstream UX fixes) (#...
• 66a97b1 fix: wheel pass-through on fitting ScrollView, unselectable a11y mirrors, Cod...
• aaafd06 chore: release the 2026-08-13 fix campaign (P1+P2+P3) (#523)
• d86f5ce fix: core/markdown/ui P3 defects from review (#492 #493 #494) (#520)
• 4323645 fix(ui): rich text href sync, dt-aware scroll integrators, popover, textarea ...
• b020b48 chore: bump the dependencies group with 4 updates (#462)
• 55a1a8f chore: release @​vectojs/ui@​2.16.4
• 2c8d9e3 fix(ui): detach ScrollView content via super.remove so leaf-first destroy can...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions