From 25e02ea976e7d5df40a8ea6c05869b0b3b4a9896 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Tue, 3 Nov 2026 15:41:40 +0100 Subject: [PATCH 1/4] Bump esbuild 0.28.2, typst-gather 0.2.4, veraPDF 1.30.3 Simple, low-risk bumps for the v1.12 dependency cycle, prepared ahead of S3 archival so Carlos can archive everything in one pass: - esbuild 0.28.2: patch release fixing a CSS minification bug with '&' and a TypeScript import-alias tree-shaking bug. - typst-gather 0.2.4: license files and crate metadata only, no functional change. - veraPDF 1.30.3: archiveOnly dependency, never downloaded during configure (only via `quarto install verapdf`), so the bump cannot break configure or CI before archival. None of these appear in the check.ts versionConstraints array (only Pandoc, Dart Sass, Deno and Typst do), so no check.ts sync is needed. Configure against this branch requires the three versions to be archived to S3 first (quarto-bld archive-bin-deps). --- configuration | 6 +++--- news/changelog-1.12.md | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/configuration b/configuration index e9e9bf7a3de..b66eb50735b 100644 --- a/configuration +++ b/configuration @@ -15,10 +15,10 @@ export DENO=v2.9.8 export DENO_DOM=v0.1.41-alpha-artifacts export PANDOC=3.10 export DARTSASS=1.101.0 -export ESBUILD=0.28.1 +export ESBUILD=0.28.2 export TYPST=0.15.1 -export TYPST_GATHER=0.2.3 -export VERAPDF=1.28.2 +export TYPST_GATHER=0.2.4 +export VERAPDF=1.30.3 # NB: we can't put comments in the same line as export statements because it diff --git a/news/changelog-1.12.md b/news/changelog-1.12.md index 9cdcba12205..d9f0bced0cc 100644 --- a/news/changelog-1.12.md +++ b/news/changelog-1.12.md @@ -26,3 +26,9 @@ All changes included in 1.12: - ([#15225](https://github.com/quarto-dev/quarto-cli/pull/15225)): Fix several Brazilian Portuguese (`pt-BR`) translations, including the table of contents title (now "Sumário") and the proof title (now "Demonstração"), and translate the `link-external-newwindow-label` language key. (author: @bonijoao) - ([#15268](https://github.com/quarto-dev/quarto-cli/issues/15268)): Translate the `skip-to-content` language key in Bulgarian, Catalan, Czech, Danish, Finnish, Hebrew, Indonesian, Korean, Lithuanian, Norwegian Bokmål, Norwegian Nynorsk, Polish, Russian, Serbian (Latin), Slovak, Slovenian, Swedish, Turkish and Ukrainian, using reviewed machine translation. - ([#15271](https://github.com/quarto-dev/quarto-cli/issues/15271)): Translate the `tools-share` and `tools-download` language keys in Catalan, Chinese, Czech, Danish, Dutch, Finnish, French, German, Hebrew, Indonesian, Italian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Norwegian Nynorsk, Polish, Portuguese, Russian, Slovak, Swedish, Turkish and Ukrainian, and `tools-share` in Serbian (Latin), using reviewed machine translation. + +## Dependencies + +- Update `esbuild` to 0.28.2 (fixes a CSS minification bug involving `&` and a TypeScript import-alias tree-shaking bug). +- Update `typst-gather` to 0.2.4. +- Update `verapdf` to 1.30.3 (used by `quarto install verapdf` for PDF/A validation). From cb85b16e78d244753ab341e5747710054225c228 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Tue, 3 Nov 2026 15:52:43 +0100 Subject: [PATCH 2/4] Fix veraPDF 1.30.3 install path: default version and pack names quarto install verapdf in packaged Quarto does not read configuration; latestRelease() falls back to kDefaultVersion, which was still 1.28.2, so the configuration bump alone would never reach end users. Also update the auto-install.xml pack list: 1.30.x consolidated the 1.28-era "Mac and *nix Scripts", "Batch files" and "Validation model" packs into a single "veraPDF CLI" pack. Verified benign either way (both pack lists produce the same working CLI-only install against the real 1.30.3 IzPack installer, and the installed verapdf reports "veraPDF 1.30.3"), but the stale names contradicted the code comment claiming they must match the installer configuration. --- src/tools/impl/verapdf.ts | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/tools/impl/verapdf.ts b/src/tools/impl/verapdf.ts index 0f3303257c5..0bb6949559d 100644 --- a/src/tools/impl/verapdf.ts +++ b/src/tools/impl/verapdf.ts @@ -24,7 +24,7 @@ import { isWindows } from "../../deno_ral/platform.ts"; // Download base URL (quarto.org redirects to S3 bucket) const kDownloadBaseUrl = "https://quarto.org/download"; -const kDefaultVersion = "1.28.2"; +const kDefaultVersion = "1.30.3"; // Minimum Java version required const kMinJavaVersion = 8; @@ -231,7 +231,10 @@ async function install( } // Create auto-install.xml for headless installation - // Panel IDs and pack names must match the IzPack installer configuration + // Panel IDs and pack names must match the IzPack installer configuration. + // Pack names verified against the 1.30.3 installer (resources/packs.info in + // the installer JAR): 1.30.x consolidated scripts and validation model into + // a single "veraPDF CLI" pack. const autoInstallXml = ` @@ -240,11 +243,9 @@ async function install( - - - - - + + + From 7b7336a94409da10fe0081cb597db4e14faa8084 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Tue, 3 Nov 2026 17:14:21 +0100 Subject: [PATCH 3/4] Bump Dart Sass 1.101.0 to 1.107.1 Changelog review of the 12 releases in range (1.102.0 through 1.107.1): no breaking @use/@forward or module-system changes, and no deprecations introduced or removed; the first-class modules added in 1.105.0 are additive and opt-in. Dart Sass is in the check.ts versionConstraints array, so the expected version is synced here. Configure against this commit requires the 1.107.1 archives on S3 first (quarto-bld archive-bin-deps); installer notarization must be re-verified for this bump since the sass.snapshot container format flipped to Mach-O once before and invalidated notarization (PR #14664). --- configuration | 2 +- news/changelog-1.12.md | 1 + src/command/check/check.ts | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/configuration b/configuration index b66eb50735b..a43d27058d9 100644 --- a/configuration +++ b/configuration @@ -14,7 +14,7 @@ export DENO=v2.9.8 # TODO figure out where 0.1.41 apple silicon libs are available export DENO_DOM=v0.1.41-alpha-artifacts export PANDOC=3.10 -export DARTSASS=1.101.0 +export DARTSASS=1.107.1 export ESBUILD=0.28.2 export TYPST=0.15.1 export TYPST_GATHER=0.2.4 diff --git a/news/changelog-1.12.md b/news/changelog-1.12.md index d9f0bced0cc..4a6b251b0c0 100644 --- a/news/changelog-1.12.md +++ b/news/changelog-1.12.md @@ -29,6 +29,7 @@ All changes included in 1.12: ## Dependencies +- Update `dart-sass` to 1.107.1. - Update `esbuild` to 0.28.2 (fixes a CSS minification bug involving `&` and a TypeScript import-alias tree-shaking bug). - Update `typst-gather` to 0.2.4. - Update `verapdf` to 1.30.3 (used by `quarto install verapdf` for PDF/A validation). diff --git a/src/command/check/check.ts b/src/command/check/check.ts index 443c07cac4d..5943f64d5a2 100644 --- a/src/command/check/check.ts +++ b/src/command/check/check.ts @@ -301,7 +301,7 @@ async function checkVersions(conf: CheckConfiguration) { // with our installers const versionConstraints: [string | undefined, string, string][] = [ [pandocVersion, "3.10.0", "Pandoc"], - [sassVersion, "1.101.0", "Dart Sass"], + [sassVersion, "1.107.1", "Dart Sass"], [denoVersion, "2.9.8", "Deno"], [typstVersion, "0.15.1", "Typst"], ]; From 7357f18ffacc34d203b8261d5e4d20da6fba9514 Mon Sep 17 00:00:00 2001 From: Christophe Dervieux Date: Wed, 4 Nov 2026 13:24:44 +0100 Subject: [PATCH 4/4] Move Dependencies changelog section to the top per changelog rules .claude/rules/changelog.md puts ## Dependencies right after ## Regression fixes and keeps ## Other fixes and improvements last; the merge resolution had appended it at the bottom. Also folds the four bumps into one entry referencing the PR, matching the 1.10 batch style. --- news/changelog-1.12.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/news/changelog-1.12.md b/news/changelog-1.12.md index 4a6b251b0c0..6c8126360b9 100644 --- a/news/changelog-1.12.md +++ b/news/changelog-1.12.md @@ -1,5 +1,13 @@ All changes included in 1.12: +## Dependencies + +- ([#15275](https://github.com/quarto-dev/quarto-cli/pull/15275)): Update dependencies: + - Update `dart-sass` to 1.107.1. + - Update `esbuild` to 0.28.2 (fixes a CSS minification bug involving `&` and a TypeScript import-alias tree-shaking bug). + - Update `typst-gather` to 0.2.4. + - Update `verapdf` to 1.30.3 (used by `quarto install verapdf` for PDF/A validation). + ## Formats ### `pdf` @@ -26,10 +34,3 @@ All changes included in 1.12: - ([#15225](https://github.com/quarto-dev/quarto-cli/pull/15225)): Fix several Brazilian Portuguese (`pt-BR`) translations, including the table of contents title (now "Sumário") and the proof title (now "Demonstração"), and translate the `link-external-newwindow-label` language key. (author: @bonijoao) - ([#15268](https://github.com/quarto-dev/quarto-cli/issues/15268)): Translate the `skip-to-content` language key in Bulgarian, Catalan, Czech, Danish, Finnish, Hebrew, Indonesian, Korean, Lithuanian, Norwegian Bokmål, Norwegian Nynorsk, Polish, Russian, Serbian (Latin), Slovak, Slovenian, Swedish, Turkish and Ukrainian, using reviewed machine translation. - ([#15271](https://github.com/quarto-dev/quarto-cli/issues/15271)): Translate the `tools-share` and `tools-download` language keys in Catalan, Chinese, Czech, Danish, Dutch, Finnish, French, German, Hebrew, Indonesian, Italian, Japanese, Korean, Lithuanian, Norwegian Bokmål, Norwegian Nynorsk, Polish, Portuguese, Russian, Slovak, Swedish, Turkish and Ukrainian, and `tools-share` in Serbian (Latin), using reviewed machine translation. - -## Dependencies - -- Update `dart-sass` to 1.107.1. -- Update `esbuild` to 0.28.2 (fixes a CSS minification bug involving `&` and a TypeScript import-alias tree-shaking bug). -- Update `typst-gather` to 0.2.4. -- Update `verapdf` to 1.30.3 (used by `quarto install verapdf` for PDF/A validation).