Bump the npm-minor-and-patch group across 1 directory with 21 updates

[dependabot]

Bumps the npm-minor-and-patch group with 21 updates in the / directory:

Package	From	To
@openai/agents	0.18.0	0.20.0
@tauri-apps/api	2.11.1	2.12.3
@tauri-apps/plugin-dialog	2.7.3	2.8.2
@tauri-apps/plugin-fs	2.5.2	2.7.0
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
katex	0.18.7	0.19.0
lucide-react	1.45.0	1.57.0
multer	2.3.0	2.4.0
@types/multer	2.2.0	2.3.0
openai	7.15.0	7.33.0
pdfjs-dist	6.3.289	6.4.299
sharp	0.35.4	0.35.5
tsx	4.23.13	4.23.15
zod	4.6.2	4.6.7
@playwright/cli	0.1.19	0.1.22
@tauri-apps/cli	2.11.4	2.12.2
@types/multer	2.2.0	2.3.0
@types/node	26.5.1	26.6.5
@vitejs/plugin-react	6.1.1	6.1.2
concurrently	10.0.5	10.0.6
vite	8.3.0	8.3.4

Updates @openai/agents from 0.18.0 to 0.20.0

Release notes

Sourced from @​openai/agents's releases.

@​openai/agents-core@​0.20.0

Minor Changes

• 836cb50: fix: default automatic MCP tool discovery to 64 pages; set maxListPages explicitly for larger listings
• 8ee5055: fix: Require trusted Python 3 for UnixLocal file operations and reject disabled protection. Honor runAs for file tools and replace edited files without modifying other hardlinks. Updates now require writable parent directories and preserve ordinary permissions and ownership.
• 8567e09: fix: count model calls after approval resumes toward maxTurns; callers needing a follow-up model response at the limit must increase maxTurns.

Patch Changes

• 40f7de2: fix: redact unchecked terminal tool output in cancelled session checkpoints while preserving completion history; defer validation for caller-owned RunState resumes
• 05241c7: fix: preserve hosted MCP discovery provenance across tool identity collisions and session reuse; older namespace-only history requires rediscovery.
• 4137680: fix: recognize namespace-shaped tool search discovery for deferred hosted MCP calls (#2044).
• b89905c: fix: Preserve computer tool initializers and serialize each run's resolved computer across overlapping runs.
• d8fa6c3: fix: Warn when computer calls have pending safety checks without an onSafetyCheck handler, and clarify the callback's opt-in behavior.
• 9e32e88: fix: Bound streamable HTTP session termination by the client session timeout and cancel stalled cleanup requests.
• 2f3591b: fix: preserve sticky permission bits through manifest normalization and local and remote materialization, and reapply manifest sticky intent to restored Unix-local and Docker snapshot directories

@​openai/agents-extensions@​0.20.0

Minor Changes

• edfa410: fix: Use current Vercel authentication configuration for restored sessions and disable legacy authentication fallback when current authentication is configured; retain per-create authentication choices for live sessions. Keep restoration credentials runtime-only and honor per-run resume overrides.

Patch Changes

• 2f3591b: fix: preserve sticky permission bits through manifest normalization and local and remote materialization, and reapply manifest sticky intent to restored Unix-local and Docker snapshot directories
• Updated dependencies [40f7de2]
• Updated dependencies [836cb50]
• Updated dependencies [05241c7]
• Updated dependencies [4137680]
• Updated dependencies [8ee5055]
• Updated dependencies [b89905c]
• Updated dependencies [d8fa6c3]
• Updated dependencies [9e32e88]
• Updated dependencies [2f3591b]
• Updated dependencies [8567e09]
  • @​openai/agents-core@​0.20.0

@​openai/agents-openai@​0.20.0

Patch Changes

• Updated dependencies [40f7de2]
• Updated dependencies [836cb50]
• Updated dependencies [05241c7]
• Updated dependencies [4137680]
• Updated dependencies [8ee5055]
• Updated dependencies [b89905c]
• Updated dependencies [d8fa6c3]
• Updated dependencies [9e32e88]
• Updated dependencies [2f3591b]
• Updated dependencies [8567e09]

... (truncated)

Commits

• 33e2741 chore: update versions (#2033)
• 05241c7 fix: separate hosted MCP discovery from user namespaces (#2046)
• 4137680 fix: recognize namespace-shaped hosted MCP discovery (#2045)
• 40f7de2 fix: preserve redacted terminal checkpoints after cancellation (#2036)
• d8fa6c3 fix: warn when pending computer safety checks have no handler (#2042)
• 8ee5055 fix: use consistent UnixLocal file operations (#2038)
• 6c00d74 fix: bind AI SDK UI demo conversations to browser cookies (#2034)
• df20529 fix(realtime): preserve playback interruption after audio generation (#2027)
• 2f3591b fix: preserve sticky sandbox permissions (#2029)
• 836cb50 fix(mcp): default automatic tool discovery to 64 pages (#2028)
• Additional commits viewable in compare view

Updates @tauri-apps/api from 2.11.1 to 2.12.3

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

Bug Fixes

• 0204f6f3a (#16244) Keep delivering Channel messages after the onmessage handler throws. The error is rethrown asynchronously so it is still reported as uncaught, instead of leaving every later message queued.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m911ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.3s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 239ms
📦 @tauri-apps/api@2.12.3 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/173//idtoken/7aa7f391-8187-8dab-bf55-bf43b72d0bd0/62377c8c-1199-5374-9168-2a108b628dd5?api-version=2.0&audience=sigstore 200 81ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.3

@​tauri-apps/api v2.12.2

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.2]

... (truncated)

Commits

• 5b23c82 apply version updates (#16243)
• 05354a8 chore(deps): update swift-rs to 1.0.9
• c48e1ca fix(ios): make @_cdecl entry points public so release builds link on Xcode ...
• eeeaa0f fix(nsis): block downgrades in silent, passive and update modes (#16230)
• 0204f6f fix(api): keep Channel messages flowing after the handler throws (#16244)
• 7fcd8a7 fix(ci): retry switching to the Android webview context in e2e (#16239)
• fd319dd chore(deps): update base64 to 0.23
• 413cbdb Apply Version Updates From Current Changes (#16213)
• 587ae48 chore: disable CODEOWNERS file (#16236)
• a98038e fix: menu append doesn't take options like MenuItemOptions (#16235)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.7.3 to 2.8.2

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

http-js v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-http@2.8.2
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.6kB README.md
npm notice 7.7kB dist-js/index.cjs
npm notice 3.4kB dist-js/index.d.ts
npm notice 7.7kB dist-js/index.js
npm notice 655B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-http
npm notice version: 2.8.2
npm notice filename: tauri-apps-plugin-http-2.8.2.tgz
npm notice package size: 5.5 kB
npm notice unpacked size: 23.0 kB
npm notice shasum: 2c9d8f56a25f10bcf19fc3ceca2acd40457487b2
npm notice integrity: sha512-xVHnZdIkPY9+/[...]BWzSjWEVAvvUA==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189625257
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-http@2.8.2

http v2.8.2

[2.8.2]

Dependencies

• Upgraded to fs-js@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.5.2 to 2.7.0

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

fs-js v2.7.0

[2.7.0]

• a934743b (#3637) Added the scopeDroppedPaths plugin config option (plugins > fs > scopeDroppedPaths in tauri.conf.json). Set it to false to stop adding the paths dropped onto any window to the fs scope, which otherwise gives every webview with an fs permission access to them (directories recursively). Defaults to true, the current behaviour.
• 085a0283 (#3636) Fixed a panic on Android when a content provider returns no file descriptor for a content:// URI (e.g. virtual files). The fs command now fails with an error instead.
• f81f0447 (#3635) Fixed reading uncompressed Android assets ($RESOURCE files such as images or audio that are stored uncompressed in the APK) returning the bytes of the APK instead of the asset. Assets are now always read from a copy in the app cache, like compressed ones.
• e03dca60 (#3628) startAccessingSecurityScopedResource and stopAccessingSecurityScopedResource now accept absolute paths on iOS, as documented, instead of silently doing nothing unless given a file:// URL.
• 5de7ebfc (#3634) Security: the open command no longer accepts a customFlags option from the webview. It was not part of the JavaScript types and let the webview pass arbitrary open(2) flags (e.g. O_TRUNC) to files it may only read. OpenOptionsExt::custom_flags still works from Rust.
• 5e6c023a (#3626) FileHandle.read no longer allocates a buffer of the requested size up front: the length is capped to the rest of the file (64 MiB for files of unknown size), an allocation failure is reported as an error instead of aborting the app, and only the bytes that were read are sent back to the webview.
• 3a900017 (#3627) Security: the fs scope check now resolves symlinks in the ancestors of paths that do not exist yet, and resolves relative symlink targets against the link's directory instead of the process working directory. Previously a new file created below a symlinked directory inside the scope (writeFile, mkdir, create, rename, copyFile, ...) was written outside of the scope. Deny patterns now also apply to the path as given, so they can name a symlink, and a path whose symlinks cannot be resolved (e.g. a loop) is rejected.
• 77d00a4f (#3633) FileHandle.seek now rejects a negative offset with SeekMode.Start instead of seeking to a huge position.
• 5c144e74 (#3631) Fixed readTextFileLines with a UTF-16 encoding splitting lines on a 0x0A 0x00 (LE) or 0x00 0x0A (BE) byte sequence that is not aligned on a code unit, e.g. ਗĀ, which garbled every following line.
• dcc8cb03 (#3629) Fixed writeFile with a ReadableStream leaving the end of the previous contents in place when the new data is shorter. The file is now truncated first unless append is set, like when writing a buffer.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-fs@2.7.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 2.4kB README.md
npm notice 39.9kB dist-js/index.cjs
npm notice 41.1kB dist-js/index.d.ts
npm notice 39.2kB dist-js/index.js
npm notice 697B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-fs
npm notice version: 2.7.0
npm notice filename: tauri-apps-plugin-fs-2.7.0.tgz
npm notice package size: 25.6 kB
npm notice unpacked size: 124.3 kB
npm notice shasum: e76d4d07b05063de6911fd1c42948ab0264ac20e
npm notice integrity: sha512-8RQbPkuYuLZ2r[...]GdKJVqDokyDgQ==
npm notice total files: 6
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189606635
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-fs@2.7.0

... (truncated)

Commits

• 6bbd44d publish new versions (#3675)
• fc18d05 fix(global-shortcut): release the shortcuts lock before running handlers (#3683)
• 42ae8b4 fix(ios): make init_plugin_* entry points public so release builds link on ...
• 818d2e0 fix(single-instance): limit second instance's wait on Windows (#3645)
• 323fe80 fix(single-instance): forward non-Unicode arguments and cwd (#3644)
• 6772581 test(e2e): fix __name usage on FS test
• 46f7c87 chore: fmt
• a8acd17 feat(shell): add process group spawn option (fix #1332) (#3351)
• e03dca6 fix(fs): accept absolute paths in the iOS security-scope commands (#3628)
• 3a90001 fix(fs): resolve symlinks of missing paths before checking the scope (#3627)
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates katex from 0.18.7 to 0.19.0

Release notes

Sourced from katex's releases.

v0.19.0

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

v0.18.11

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

v0.18.10

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Changelog

Sourced from katex's changelog.

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Commits

• 6ea2dc9 chore(release): 0.19.0 [ci skip]
• cbb1fce docs: note strict changes shipped in 0.18.11 (#4300)
• d5bed9f chore(release): 0.18.11 [ci skip]
• 4237070 feat: handle character metrics warnings via strict (#4243)
• 411da70 chore(release): 0.18.10 [ci skip]
• a477b2e feat: make KaTeX fallback to browsr math font before Times New Roman (#4298)
• 5a6a8f8 chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 (#4297)
• 71a7bc0 chore(release): 0.18.9 [ci skip]
• aafa187 feat(types): add contrib module declarations (#4250)
• e749fd1 chore(release): 0.18.8 [ci skip]
• Additional commits viewable in compare view

Updates lucide-react from 1.45.0 to 1.57.0

Release notes

Sourced from lucide-react's releases.

Version 1.57.0

What's Changed

• feat(icons): added folder-user and folder-user icons by @​rrod497 in lucide-icons/lucide#4603
• feat(icons): added calendar-chevrons-left icon by @​karsa-mistmere in lucide-icons/lucide#5001
• feat(icons): added users-collaboration icon by @​rrod497 in lucide-icons/lucide#4922
• feat(icons): added Belarusian ruble icon by @​js-best in lucide-icons/lucide#4984
• feat(icons): added circle-fading-play icon by @​tatianatsiguleva in lucide-icons/lucide#4990
• feat(icons): add cpu-ai icon by @​signalgridco in lucide-icons/lucide#4992
• feat(icons): added guitar-electric icon by @​rrod497 in lucide-icons/lucide#4917
• feat(icons): added graph-star icon by @​Nitero in lucide-icons/lucide#4983
• chore(deps-dev): bump the svelte-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#4996
• chore(deps-dev): bump preact from 11.0.0 to 11.0.1 in the preact-deps group by @​dependabot[bot] in lucide-icons/lucide#4999
• chore(deps-dev): bump @​vitejs/plugin-react from 6.1.1 to 6.1.2 in the react-deps group by @​dependabot[bot] in lucide-icons/lucide#4995
• feat(icons): added perfume icon by @​rrod497 in lucide-icons/lucide#4426

New Contributors

• @​js-best made their first contribution in lucide-icons/lucide#4984
• @​tatianatsiguleva made their first contribution in lucide-icons/lucide#4990
• @​signalgridco made their first contribution in lucide-icons/lucide#4992
• @​Nitero made their first contribution in lucide-icons/lucide#4983

Full Changelog: lucide-icons/lucide@1.56.0...1.57.0

Version 1.56.0

What's Changed

• feat(icons): added server-nas icon by @​benhaube in lucide-icons/lucide#4537
• fix(icons,categories): fix notifications category name and refine circle-x tags by @​Rachit315 in lucide-icons/lucide#4994
• feat(icons): add message-circle-text icon by @​ericfennis in lucide-icons/lucide#4898

New Contributors

• @​Rachit315 made their first contribution in lucide-icons/lucide#4994

Full Changelog: lucide-icons/lucide@1.55.0...1.56.0

Version 1.55.0

What's Changed

• feat(icons): added mail-dot icon by @​elenakovelskikh in lucide-icons/lucide#3230
• ci(lint): split lint jobs and annotate Prettier and JSON schema errors in PRs by @​ericfennis in lucide-icons/lucide#4982
• chore(deps-dev): bump sharp from 0.35.4 to 0.35.5 by @​dependabot[bot] in lucide-icons/lucide#4987
• chore(deps): bump next from 16.3.6 to 16.3.8 by @​dependabot[bot] in lucide-icons/lucide#4988
• test(lucide): add tests for empty icons error and DocumentFragment root in createIcons by @​grzdev in lucide-icons/lucide#4967
• feat(icons): added phone-log icon by @​Levi-Bensley in lucide-icons/lucide#3598
• chore(copilot-instruction): Adjust instruction text to allow more then 4 use-cases by @​ericfennis in lucide-icons/lucide#4989
• feat(icons): added wifi-lock icon by @​benhaube in lucide-icons/lucide#4913
• feat(icons): Add handle-bottom-right icon by @​ocavue in lucide-icons/lucide#1793
• test(lucide-react): add tests for DynamicIcon fallback and ref forwarding by @​grzdev in lucide-icons/lucide#4966
• feat(icons): added screw icon by @​edik17 in lucide-icons/lucide#4932
• feat(icons): added user-round-star icon by @​karsa-mistmere in lucide-icons/lucide#3469
• feat(icons): added shield-house icon by @​benhaube in lucide-icons/lucide#4602

... (truncated)

Commits

• 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950<...

  Description has been truncated