Bump the minor-and-patch group across 2 directories with 14 updates

[dependabot]

Bumps the minor-and-patch group with 12 updates in the /canvas directory:

Package	From	To
@tldraw/commenting	5.4.2	5.5.2
cn	0.3.0	0.4.0
dompurify	3.4.15	3.4.16
marked	18.0.13	18.0.14
remend	1.3.1	1.4.0
tldraw	5.4.2	5.5.2
@types/node	26.6.1	26.6.4
jsdom	30.1.0	30.1.1
oxlint	1.83.0	1.86.0
sharp	0.35.4	0.35.5
vite	8.3.0	8.3.2
vitest	5.0.1	5.0.3
@types/node	26.6.1	26.6.4

Bumps the minor-and-patch group with 3 updates in the /desktop directory: @types/node, electron and electron-builder.

Updates @tldraw/commenting from 5.4.2 to 5.5.2

Release notes

Sourced from @​tldraw/commenting's releases.

v5.5.2

Generated from commits between v5.5.1 and HEAD

Bug Fixes

fix(editor): validate license domain for pages loaded from blob URLs (#11040)

• Fix license domain validation for pages loaded from blob: URLs

v5.5.1

Generated from commits between v5.5.0 and HEAD

Bug Fixes

fix(editor): move default cursor hotspot down toward the visible tip (#11033)

• Fix shape hover and selection feeling offset below shapes, caused by the default cursor's hotspot sitting above its visible tip.

v5.5.0

This release is a broad reliability pass over the SDK. Shapes keep changes made by other commands while they are being dragged, resized, rotated, or cropped; touch gestures no longer stick when the browser cancels a pointer; selection, draw, line, note, frame, and arrow interactions survive shapes being deleted or locked mid-interaction; SVG exports embed every resource they reference; and there are fixes across the store, signals, sync, and local persistence. Rich text gets smart typography and wraps a selection in the bracket or quote you type, pasting a link onto a selected shape sets its link, and the note shape's attribution badge can be hidden or replaced. tldraw now re-exports TipTap's extension API, so custom rich text extensions no longer need their own @tiptap/* install, and Editor.setCamera rejects non-finite values instead of quietly coercing them.

What's new

Smart typography in rich text (#10767)

Text typed on the canvas now reads like typeset text. Straight quotes curl, -- becomes an em dash, ... an ellipsis, and -> an arrow. Pressing Backspace straight after a rewrite restores what you typed. The rules are TipTap's Typography extension, added as a standalone entry in getTipTapDefaultExtensions(), so filter it out to keep literal punctuation.

With text selected, typing an opening bracket or quote wraps the selection instead of replacing it: select a word and press ( to get (word). Pressing ` over a selection toggles inline code. Quotes stay straight inside code and in the mono font. The new WrapSelectionExtension does the wrapping, and defaultWrappingPairs lists the pairs it uses.

API changes

• 💥 Editor.setCamera now throws on a non-finite x, y, or z instead of silently coercing it to 0 or the current zoom level, and no longer mutates the point object passed to it. (#9903)

• 💥 store.query.filterHistory() now returns its own change counter rather than a value that always matches store.history.get(). After a rolled-back transaction it can be ahead of the store's counter, and it reports a change even for record types the transaction didn't touch. (#10200)

• Re-export TipTap's extension surface from tldraw: Node, Mark, Extension, mergeAttributes, and getSchema, the Extensions and JSONContent types, and the TaskList and TaskItem extensions. Custom rich text extensions no longer need their own @tiptap/* dependency, which also rules out loading two copies of TipTap. (#10691)

  import { Mark, mergeAttributes } from 'tldraw'

• Add MESSAGE_TOO_LARGE to TLSyncErrorCloseEventReason. Clients that switch on the reason to pick an error message will want a case for it. (#10810)

• Add LruCache.delete(key) to @tldraw/utils. (#10338)

• Add an AttributionComponent option to NoteShapeUtil to hide or replace the note's "last edited by" badge, on the canvas and in exports. Pass null to hide it, or a component that receives TLNoteShapeAttributionProps. The default is exported as DefaultNoteShapeAttribution. (#9407)

  <Tldraw shapeUtils={[NoteShapeUtil.configure({ AttributionComponent: null })]} />

• Add shapeId to TLUrlExternalContent. defaultHandleExternalUrlContent sets the url as that shape's link instead of creating a bookmark or embed. (#10765)

... (truncated)

Commits

• be4d5b3 v5.5.2 [skip ci]
• c0bc882 fix(editor): validate license domain for pages loaded from blob URLs (#11040)
• 0fc68fd v5.5.1 [skip ci]
• 10128a8 fix(editor): move default cursor hotspot down toward the visible tip (#11033)
• 206096a docs(releases): update release notes (#10999)
• d153829 v5.5.0
• 53d76ec Add VSCode extension v2.369.0 [skip ci]
• 14eccf6 Deploy from hotfix (7b1f1217da46a9aca1f77d9b1978990b3f1721a0) at 2026-09-29T1...
• 7b1f121 [HOTFIX] fix(dotcom): give every MCP account a home workspace (#10988)
• 68ff40b Deploy from hotfix (85648170e07ef814c0d195fa38ccda07d802f7d6) at 2026-09-29T1...
• Additional commits viewable in compare view

Updates cn from 0.3.0 to 0.4.0

Release notes

Sourced from cn's releases.

cn@0.4.0

Minor Changes

• #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

cn@0.3.3

Patch Changes

• #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

• #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

cn@0.3.2

Patch Changes

• #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

cn@0.3.1

Patch Changes

• #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

Changelog

Sourced from cn's changelog.

0.4.0

Minor Changes

• #153 2691a38 Thanks @​shadcn! - cn build and the plugins now register the theme scales declared in your Tailwind CSS.

0.3.3

Patch Changes

• #152 00daa7e Thanks @​shadcn! - Calls with an interpolated argument, such as cn(base, "translate-x-[" + x + "px]"), no longer thrash the argument cache. 2,213 → 80 ns per call on that shape; stable arguments are unchanged.

• #150 6f5ccfa Thanks @​shadcn! - cn build -o *.ts output now typechecks under noUncheckedIndexedAccess and the rest of the @tsconfig/strictest flags. The .mjs output is unchanged.

0.3.2

Patch Changes

• #147 e703bfe Thanks @​shadcn! - Custom animate-* classes are no longer merged, matching tailwind-merge. Only the default theme animations (spin, ping, pulse, bounce), animate-none, and arbitrary values share the animate group, so plugin classes such as animate-in, animate-once, and animate-duration-500 are never dropped.

0.3.1

Patch Changes

• #144 19a9a66 Thanks @​shadcn! - Axis utilities now override the logical sides they cover, matching tailwind-merge 3.7.0. px-2 replaces ps-* and pe-*, py-2 replaces pbs-* and pbe-*, and the same applies to mx/my, inset-x/inset-y, border-x/border-y widths and colors, and scroll-mx/scroll-my/scroll-px/scroll-py.

Commits

• 84db832 chore(release): version packages (#154)
• 2691a38 feat(build): register theme scales from the Tailwind CSS entry (#153)
• acfba70 chore(release): version packages (#151)
• 00daa7e fix(engine): stop the arg cache thrashing on interpolated arguments (#152)
• 6f5ccfa fix(build): typecheck .ts output under noUncheckedIndexedAccess (#150)
• 210353b chore(release): version packages (#148)
• e703bfe fix(config): stop merging custom animate classes (#147)
• 8f12110 chore(release): version packages (#145)
• 19a9a66 fix(config): override logical sides with axis utilities (#144)
• See full diff in compare view

Updates dompurify from 3.4.15 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

Commits

• b9b9d80 release: 3.4.16 (#1636)
• See full diff in compare view

Updates marked from 18.0.13 to 18.0.14

Release notes

Sourced from marked's releases.

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

Commits

• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• 5196d98 docs: add commonmark and gfm as versions in demo (#4094)
• de2320a docs: add marked-gitlab to known extensions (#4092)
• 7d05530 fix: allow indented lines in setext heading text (#4095)
• c7ee43a fix: strip whitespace when normalizing link reference labels (#4091)
• cead8de fix: decode numeric character references in text (#4076)
• e136da7 fix: preserve internal tabs in list item content (#4086)
• Additional commits viewable in compare view

Updates remend from 1.3.1 to 1.4.0

Release notes

Sourced from remend's releases.

remend@1.4.0

Minor Changes

• fdd1351: Rework code-region detection and double-underscore counting.

  A shared single-pass scanner now classifies fences and inline code spans, replacing the per-character rescans that made healing quadratic on delimiter-heavy input. Fence and span detection follows CommonMark, so ~~~ fences, fences inside block quotes and list items, CRLF line endings, and multi-backtick spans are all recognized, and content inside code is never healed as prose.

  Double underscores are counted per maximal run with flanking rules, so identifiers containing __ (like snake__case) no longer invent or swallow emphasis closers.

  Healing is now idempotent. Healed output re-heals to itself, and text-only link mode resolves every unmatched bracket in one call.

Patch Changes

• cf0ac1c: Stop the incomplete-HTML-tag handler from truncating math expressions.

  handleIncompleteHtmlTag guarded against code blocks but not math, so an ordinary comparison inside math — $$ I = \sum_{j<k} p_j $$ — matched the incomplete-tag pattern and deleted everything from the < to the end of the string. The trailing $$ was then auto-closed by the katex handler, so KaTeX rendered a parse error and the rest of the message never reached the DOM.

  The handler now skips candidates inside math blocks ($, $$, \(, \[), matching the guard the emphasis handlers already had. Because the pattern is leftmost-matching, it also walks forward to later candidates instead of bailing out, so a genuine incomplete tag after a math expression is still stripped.

• e0ce123: Incomplete images during streaming now render a loading placeholder instead of being removed entirely. Incomplete images (e.g. ![alt](https://exampl) are replaced with ![alt](https://github.com/vercel/streamdown/tree/HEAD/packages/remend/blob/HEAD/streamdown:incomplete-image) by remend, and the streamdown ImageComponent renders an animated skeleton for this special URL. This mirrors the existing behavior for incomplete links (streamdown:incomplete-link). The streamdown protocol is allowlisted for img[src] in the default sanitize schema so the sentinel survives rehype-sanitize + rehype-harden.

Changelog

Sourced from remend's changelog.

1.4.0

Minor Changes

• fdd1351: Rework code-region detection and double-underscore counting.

  A shared single-pass scanner now classifies fences and inline code spans, replacing the per-character rescans that made healing quadratic on delimiter-heavy input. Fence and span detection follows CommonMark, so ~~~ fences, fences inside block quotes and list items, CRLF line endings, and multi-backtick spans are all recognized, and content inside code is never healed as prose.

  Double underscores are counted per maximal run with flanking rules, so identifiers containing __ (like snake__case) no longer invent or swallow emphasis closers.

  Healing is now idempotent. Healed output re-heals to itself, and text-only link mode resolves every unmatched bracket in one call.

Patch Changes

• cf0ac1c: Stop the incomplete-HTML-tag handler from truncating math expressions.

  handleIncompleteHtmlTag guarded against code blocks but not math, so an ordinary comparison inside math — $$ I = \sum_{j<k} p_j $$ — matched the incomplete-tag pattern and deleted everything from the < to the end of the string. The trailing $$ was then auto-closed by the katex handler, so KaTeX rendered a parse error and the rest of the message never reached the DOM.

  The handler now skips candidates inside math blocks ($, $$, \(, \[), matching the guard the emphasis handlers already had. Because the pattern is leftmost-matching, it also walks forward to later candidates instead of bailing out, so a genuine incomplete tag after a math expression is still stripped.

• e0ce123: Incomplete images during streaming now render a loading placeholder instead of being removed entirely. Incomplete images (e.g. ![alt](https://exampl) are replaced with ![alt](https://github.com/vercel/streamdown/blob/main/packages/remend/streamdown:incomplete-image) by remend, and the streamdown ImageComponent renders an animated skeleton for this special URL. This mirrors the existing behavior for incomplete links (streamdown:incomplete-link). The streamdown protocol is allowlisted for img[src] in the default sanitize schema so the sentinel survives rehype-sanitize + rehype-harden.

Commits

• 08da224 Version Packages (#600)
• fdd1351 fix: rework remend code-region detection (#637)
• cf0ac1c fix(remend): guard incomplete HTML tag handler against math blocks (#617)
• 38775ee build(deps): bump the npm_and_yarn group across 2 directories with 5 updates ...
• e0ce123 feat: render loading placeholder for incomplete streaming images (#504)
• See full diff in compare view

Updates tldraw from 5.4.2 to 5.5.2

Release notes

Sourced from tldraw's releases.

v5.5.2

Generated from commits between v5.5.1 and HEAD

Bug Fixes

fix(editor): validate license domain for pages loaded from blob URLs (#11040)

• Fix license domain validation for pages loaded from blob: URLs

v5.5.1

Generated from commits between v5.5.0 and HEAD

Bug Fixes

fix(editor): move default cursor hotspot down toward the visible tip (#11033)

• Fix shape hover and selection feeling offset below shapes, caused by the default cursor's hotspot sitting above its visible tip.

v5.5.0

This release is a broad reliability pass over the SDK. Shapes keep changes made by other commands while they are being dragged, resized, rotated, or cropped; touch gestures no longer stick when the browser cancels a pointer; selection, draw, line, note, frame, and arrow interactions survive shapes being deleted or locked mid-interaction; SVG exports embed every resource they reference; and there are fixes across the store, signals, sync, and local persistence. Rich text gets smart typography and wraps a selection in the bracket or quote you type, pasting a link onto a selected shape sets its link, and the note shape's attribution badge can be hidden or replaced. tldraw now re-exports TipTap's extension API, so custom rich text extensions no longer need their own @tiptap/* install, and Editor.setCamera rejects non-finite values instead of quietly coercing them.

What's new

Smart typography in rich text (#10767)

Text typed on the canvas now reads like typeset text. Straight quotes curl, -- becomes an em dash, ... an ellipsis, and -> an arrow. Pressing Backspace straight after a rewrite restores what you typed. The rules are TipTap's Typography extension, added as a standalone entry in getTipTapDefaultExtensions(), so filter it out to keep literal punctuation.

With text selected, typing an opening bracket or quote wraps the selection instead of replacing it: select a word and press ( to get (word). Pressing ` over a selection toggles inline code. Quotes stay straight inside code and in the mono font. The new WrapSelectionExtension does the wrapping, and defaultWrappingPairs lists the pairs it uses.

API changes

• 💥 Editor.setCamera now throws on a non-finite x, y, or z instead of silently coercing it to 0 or the current zoom level, and no longer mutates the point object passed to it. (#9903)

• 💥 store.query.filterHistory() now returns its own change counter rather than a value that always matches store.history.get(). After a rolled-back transaction it can be ahead of the store's counter, and it reports a change even for record types the transaction didn't touch. (#10200)

• Re-export TipTap's extension surface from tldraw: Node, Mark, Extension, mergeAttributes, and getSchema, the Extensions and JSONContent types, and the TaskList and TaskItem extensions. Custom rich text extensions no longer need their own @tiptap/* dependency, which also rules out loading two copies of TipTap. (#10691)

  import { Mark, mergeAttributes } from 'tldraw'

• Add MESSAGE_TOO_LARGE to TLSyncErrorCloseEventReason. Clients that switch on the reason to pick an error message will want a case for it. (#10810)

• Add LruCache.delete(key) to @tldraw/utils. (#10338)

• Add an AttributionComponent option to NoteShapeUtil to hide or replace the note's "last edited by" badge, on the canvas and in exports. Pass null to hide it, or a component that receives TLNoteShapeAttributionProps. The default is exported as DefaultNoteShapeAttribution. (#9407)

  <Tldraw shapeUtils={[NoteShapeUtil.configure({ AttributionComponent: null })]} />

• Add shapeId to TLUrlExternalContent. defaultHandleExternalUrlContent sets the url as that shape's link instead of creating a bookmark or embed. (#10765)

... (truncated)

Commits

• be4d5b3 v5.5.2 [skip ci]
• c0bc882 fix(editor): validate license domain for pages loaded from blob URLs (#11040)
• 0fc68fd v5.5.1 [skip ci]
• 10128a8 fix(editor): move default cursor hotspot down toward the visible tip (#11033)
• 206096a docs(releases): update release notes (#10999)
• d153829 v5.5.0
• 53d76ec Add VSCode extension v2.369.0 [skip ci]
• 14eccf6 Deploy from hotfix (7b1f1217da46a9aca1f77d9b1978990b3f1721a0) at 2026-09-29T1...
• 7b1f121 [HOTFIX] fix(dotcom): give every MCP account a home workspace (#10988)
• 68ff40b Deploy from hotfix (85648170e07ef814c0d195fa38ccda07d802f7d6) at 2026-09-29T1...
• Additional commits viewable in compare view

Updates @types/node from 26.6.1 to 26.6.4

Commits

• See full diff in compare view

Updates jsdom from 30.1.0 to 30.1.1

Release notes

Sourced from jsdom's releases.

v30.1.1

• Fixed spurious window blur and focusout events and incorrect event.relatedTarget values when focusing an element after removing the previously focused element, which regressed in v30.1.0. (@​asamuzaK)
• Fixed focus and blur behavior across frames, and focusing the document's viewport through document.documentElement.focus(). (@​asamuzaK)
• Fixed focus targets removed or disabled by blur listeners becoming active, and text selections made by focus and blur listeners being overwritten. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing disabled form controls and <input type="hidden"> elements with tabindex="". (@​scttcper)
• Fixed invalid style.setProperty() calls changing existing !important priorities, serialized styles, or mutation records. (@​FedgeNo)
• Fixed !important handling when updating CSS longhands after shorthands, using variables or CSS-wide keywords, and assigning style properties directly. (@​FedgeNo)
• Fixed <noscript> parsing with includeNodeLocations: true or inside frames to honor the runScripts option.
• Fixed the storageQuota option being ignored by frames.
• Fixed encoding detection of HTML and XML byte input to honor XML encoding declarations and detect UTF-16 without a byte order mark.
• Fixed exceptions caused by truncated charset parameters in <meta> elements, and encoding detection incorrectly using incomplete <meta> tags. (@​FedgeNo)
• Fixed XML serialization errors for namespaces named constructor, toString, __proto__, or "null", and incorrect reuse of namespace prefixes declared on sibling elements.
• Fixed element.innerHTML and element.outerHTML in XML documents to reject invalid characters in attribute values and avoid stack overflows on large strings.
• Fixed selector matching for :lang(), :nth-child(... of ...) after mutations, and :has() with duplicate IDs or nested logical pseudo-classes. (@​asamuzaK)

Commits

• 0a117f4 30.1.1
• 103f67d Remove unnecessary window cleanup from API tests
• cdda00a Test HTTP/2 document and subresource loading
• 7ab92ce Update @​asamuzakjp/dom-selector to v9.2.1
• d940c20 Share jsdom settings across descendant windows
• 6ba40cb Fix and simplify option propagation
• 3b3be70 Preserve CSS priorities across declaration updates
• 97b2758 Align focusing and unfocusing with HTML
• b7b460b Update w3c-xmlserializer to v6
• 71d562f Update html-encoding-sniffer to v7
• Additional commits viewable in compare view

Updates oxlint from 1.83.0 to 1.86.0

Release notes

Sourced from oxlint's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

oxlint v1.85.0

🚀 Features

• 415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (#26763) (leaysgur)

Changelog

Sourced from oxlint's changelog.

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

... (truncated)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
• e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
• 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
• 288d8cc release(apps): oxlint v1.85.0 && oxfmt v0.70.0 (#26903)
• f02a64a release(apps): oxlint v1.84.0 && oxfmt v0.69.0 (#26874)
• See full diff in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.2

Release notes

Sourced from vite's releases.

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correc...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[cloudflare-workers-and-pages]

Deploying super-prototyping with    Cloudflare Pages

Latest commit:	779e25a
Status:	✅  Deploy successful!
Preview URL:	https://85a3f6cc.super-prototyping.pages.dev
Branch Preview URL:	https://dependabot-bun-canvas-minor-4nyx.super-prototyping.pages.dev

View logs

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🟡 Incomplete images render broken placeholders

remend 1.4 rewrites unfinished images to a streamdown: sentinel. renderMarkdown strips that URL and leaves an unusable image during streaming.

Learn more

Remend 1.4 replaces an unfinished Markdown image with an image whose URL uses the streamdown:incomplete-image sentinel. Streamdown recognizes that sentinel with a custom image component and explicitly permits its protocol during sanitization. This canvas instead sends Remend output through ordinary Marked and DOMPurify in renderMarkdown. DOMPurify removes the unknown protocol, but the generated <img> remains and renders as missing or broken content while the assistant streams.

Example: While the assistant has emitted ![preview](https://example.com/im but not the closing URL and parenthesis, the chat renders an unusable image node. Before this update, Remend removed the unfinished image until more text arrived.

Recommended fix: Either keep Remend 1.3 until the canvas supports the new sentinel, or detect streamdown:incomplete-image in renderMarkdown and render an intentional loading placeholder while allowing only that exact sentinel through sanitization. Add a streaming Markdown test for an unfinished image.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔍 Document the new canvas text behavior

The tldraw update enables smart typography in canvas text, but the PR adds no ## Unreleased entry. The contributing rules require one for user-visible changes.

---

Was this helpful? React with 👍 or 👎 to provide feedback.