[cscheid]

Upgrades q2's pinned pandoc from 3.12.1 to 3.13 everywhere: native pandoc, CI, and the pandoc.wasm that hub-client uses for "Download as" and document import. Quarto 1's 1.12 prereleases are moving to 3.13 as well (quarto-dev/quarto-cli#15320). Braid: bd-dti84hkx.

Changes

Pins (all moved together; cargo xtask lint checks that they agree). PANDOC_PIN, PANDOC_VERSION in test-suite.yml, ts-test-suite.yml and q2-preview-spa-e2e.yml, dev-setup's PANDOC_HYBRID_MIN_VERSION, the filters README, the vendored.toml entries, and pampa's PANDOC_ORACLE_MAX_VERSION (cargo xtask pandoc-check: all 4 oracle tests pass on 3.13).

pandoc.wasm asset name. Upstream renamed the release asset from pandoc-3.12.1.wasm.zip to pandoc-3.13-wasm.zip (the folder inside the zip changed too). Five places got the version by stripping a .wasm.zip suffix. resources/pandoc-wasm.json now has an explicit version field, and every consumer reads it: fetch-pandoc-wasm.mjs, capture_pandoc_recordings, the recording replay check, and vendored.toml. New zip and wasm SHA-256s; the two request goldens' hash and job_id change to match.

Minimum version. The version floor follows the pin's major.minor, so q2 now rejects pandoc < 3.13 with Q-20-2 (as the 3.12 bump did for 3.11). The docs still said "3.11 or newer" and now say 3.13.

Workflow comment. Replaced "pinned to match Quarto 1.9". It dates from the 3.8.3 pin in February and has been wrong since the 3.10 bump. The new comment says what actually governs the pin. The bump runbook (dev-docs/pandoc-wasm-bump.md) is updated, including a warning that upstream's asset names change.

Fixtures. Only the basic-docx import recording changes: 3.13's docx reader fixes a regression introduced in 3.11 (jgm/pandoc#11969), so a right-aligned table column now imports as right-aligned (| ----: |). The native pandoc-recordings were re-captured too, but that re-capture is not committed: all ~85 changed files were capture noise (machine paths, the capture date, random EPUB uuids, temp-dir names), none caused by pandoc, and the existing recordings replay unchanged under 3.13. Cleaning up that non-determinism and the machine-path leaks is filed as bd-b8jy5t5p.

Also checked. Pandoc's default.csl is byte-identical in 3.13 (re-recorded). The 3.13 switch to YAML 1.2 parsing (yes/no are strings; duplicate keys are errors) doesn't reach our pandoc inputs: metadata goes to pandoc as JSON, and our one defaults file only emits true/false and an integer.

User-facing changes (hub-client changelog entry included)

• Imported Word tables keep each column's alignment again.
• Imported RTF no longer drops the letter after a non-ASCII character.
• In Word output, a list item with several paragraphs stays a single list (Converting from Markdown to DOCX doesn't convert paragraphs inside list items correct jgm/pandoc#9197).

Local verification (macOS, pandoc 3.13)

• cargo nextest run --workspace --no-fail-fast with -D warnings: 19196/19197 pass. The one failure is capture_classifies_pieces, which is unrelated and also fails on main whenever R and rlang are installed (knitr capture reports every chunk error as rlang_error (knitr wraps errors via rlang::entrace) #1129). CI doesn't install R, so it skips there.
• cargo xtask verify --skip-rust-tests: all green (lint, clippy, fmt, builds, hub test:ci, test:wasm 473/473 against pandoc.wasm 3.13).
• pandoc browser harness: Chromium 348 passed, WebKit (macOS) 79 passed.
• Windows: not cross-checked. The Rust changes are JSON field reads and constants, with no platform-specific code.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.