Repository navigation
Update Dart Sass, esbuild, typst-gather and veraPDF for v1.12 - #15275
Merged
Merged
Conversation
Collaborator
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
cderv
marked this pull request as ready for review
November 4, 2026 12:16
Simple, low-risk bumps for the v1.12 dependency cycle, prepared ahead of S3 archival so Carlos can archive everything in one pass: - esbuild 0.28.2: patch release fixing a CSS minification bug with '&' and a TypeScript import-alias tree-shaking bug. - typst-gather 0.2.4: license files and crate metadata only, no functional change. - veraPDF 1.30.3: archiveOnly dependency, never downloaded during configure (only via `quarto install verapdf`), so the bump cannot break configure or CI before archival. None of these appear in the check.ts versionConstraints array (only Pandoc, Dart Sass, Deno and Typst do), so no check.ts sync is needed. Configure against this branch requires the three versions to be archived to S3 first (quarto-bld archive-bin-deps).
quarto install verapdf in packaged Quarto does not read configuration; latestRelease() falls back to kDefaultVersion, which was still 1.28.2, so the configuration bump alone would never reach end users. Also update the auto-install.xml pack list: 1.30.x consolidated the 1.28-era "Mac and *nix Scripts", "Batch files" and "Validation model" packs into a single "veraPDF CLI" pack. Verified benign either way (both pack lists produce the same working CLI-only install against the real 1.30.3 IzPack installer, and the installed verapdf reports "veraPDF 1.30.3"), but the stale names contradicted the code comment claiming they must match the installer configuration.
Changelog review of the 12 releases in range (1.102.0 through 1.107.1): no breaking @use/@forward or module-system changes, and no deprecations introduced or removed; the first-class modules added in 1.105.0 are additive and opt-in. Dart Sass is in the check.ts versionConstraints array, so the expected version is synced here. Configure against this commit requires the 1.107.1 archives on S3 first (quarto-bld archive-bin-deps); installer notarization must be re-verified for this bump since the sass.snapshot container format flipped to Mach-O once before and invalidated notarization (PR #14664).
.claude/rules/changelog.md puts ## Dependencies right after ## Regression fixes and keeps ## Other fixes and improvements last; the merge resolution had appended it at the bottom. Also folds the four bumps into one entry referencing the PR, matching the 1.10 batch style.
cderv
force-pushed
the
chore/deps-v1.12-simple
branch
from
November 4, 2026 13:35
bc6aeba to
7357f18
Compare
1 of 5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bump four bundled tools for the v1.12 cycle: Dart Sass 1.101.0 to 1.107.1, esbuild 0.28.1 to 0.28.2, typst-gather 0.2.3 to 0.2.4, and veraPDF 1.28.2 to 1.30.3. Pandoc 3.13 is not part of this PR and will follow separately once the template sync is done.
The versions are changed in
configuration(plussrc/command/check/check.tsfor Dart Sass, whichcheck-versions-no-mismatchkeeps in sync). The new binaries are archived to S3.The Dart Sass changelog for the 12 releases in range shows no breaking
@use/@forwardor module-system change and no deprecation added or removed. Because thesass.snapshotcontainer format flipped once before and broke notarization (#14664), a non-publishing installer build was run on this branch: macOS notarization and Windows signing both pass.esbuild 0.28.2 is a patch release (a CSS minification bug involving
&and a TypeScript import-alias tree-shaking bug). typst-gather 0.2.4 only changes license files and crate metadata.veraPDF is only downloaded by
quarto install verapdf, not byconfigure. A packaged Quarto does not readconfigurationand falls back to the default version insrc/tools/impl/verapdf.ts, so that default is bumped too. The installer pack list inauto-install.xmlis updated because 1.30.x merged three of the 1.28-era packs into one "veraPDF CLI" pack. Both pack lists produce the same CLI-only install with the 1.30.3 installer.Checklist
I have (if applicable):
AI-assisted PR
Note: autonomous AI agents submitting PRs without human oversight are not permitted — see the Code of Conduct.