Skip to content

build(deps): bump the production group across 1 directory with 13 updates - #216

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-adebc76020
Open

build(deps): bump the production group across 1 directory with 13 updates#216
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/production-adebc76020

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the production group with 13 updates in the / directory:

Package From To
@cantoo/pdf-lib 2.8.1 2.11.1
@composio/core 0.14.1 0.27.0
@slack/web-api 7.17.0 7.19.0
convex 1.43.0 1.48.0
docx 9.7.1 9.14.0
grammy 1.45.1 1.46.0
linkedom 0.18.13 0.18.14
playwright-core 1.62.1 1.64.1
undici 7.29.0 7.30.1
unpdf 1.8.0 1.9.1
ws 8.21.3 8.22.0
@anthropic-ai/claude-code 2.1.227 2.1.312
yaml 2.9.0 2.9.1

Updates @cantoo/pdf-lib from 2.8.1 to 2.11.1

Changelog

Sourced from @​cantoo/pdf-lib's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[2.11.0]

  • Keep the modular TypeScript UPNG rewrite and port Photopea's current quantize (KD-tree + k-means), framize, and lossy cnum encode into it (quantize.ts, framize.ts, dither.ts). Drop the temporary Hopding UPNG.js restore; compression stays on fflate.
  • Document Cantoo fork benefits vs upstream in the root README and in @cantoo/upng / @cantoo/standard-fonts READMEs.
  • Modernize @cantoo/standard-fonts metric scripts (fs/promises + Node Buffer, shared compressJson helper, yarn standard-fonts:metrics via esbuild). Remove the legacy Makefile.js / shelljs / ts-node / mz / base64-arraybuffer path.
  • Replace color with culori for CSS color string parsing (colorString). Move html-entities to a peer dependency (also pulled in by node-html-better-parser). Drop unused node-fetch / @types/node-fetch / @types/color. Align ESLint 9 with @typescript-eslint v8 and @eslint/js v9; upgrade Husky to v9 and TypeScript to v5 (@types/culori as a devDependency).
  • Vendor @cantoo/upng and @cantoo/standard-fonts under src/packages/ (publishable subpackages + @cantoo/pdf-lib/upng / @cantoo/pdf-lib/standard-fonts exports). Replace pako with fflate for FlateDecode compression and the vendored packages (aligned with @cantoo/fontkit).
  • First npm releases of @cantoo/upng and @cantoo/standard-fonts (1.0.0).

[2.10.0]

  • Prefer Cantoo's maintained @cantoo/fontkit (≥2.0.9) for custom font embedding (devDependency, docs, web/Deno demos). It ships TypeScript types, a default export, and UMD builds (dist/fontkit.umd.js / dist/fontkit.umd.min.js). Upstream fontkit and @pdf-lib/fontkit remain supported via registerFontkit. Dropped the @types/fontkit devDependency.

[2.9.2]

  • Decrypt PDFs whose /Encrypt crypt filters (/CF, /StdCF, …) are indirect objects (e.g. iText 2.x). CipherTransformFactory now resolves those entries with lookup instead of get.

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates @composio/core from 0.14.1 to 0.27.0

Release notes

Sourced from @​composio/core's releases.

@​composio/core@​0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

@​composio/core@​0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

  • 3dd9a2c: Strip string format values that OpenAI structured outputs rejects from strict tool schemas

... (truncated)

Changelog

Sourced from @​composio/core's changelog.

0.27.0

Minor Changes

  • c2bbfa8: Add session hooks. A hook can block a tool call before it runs, or block its result before the agent sees it.

    create() and update() accept hooks. On update(), hooks replaces the whole list and null removes every hook. hooks cannot be combined with experimental.sessionConfigId.

    const session = await composio.create('user_123', {
  hooks: [
    {
      type: 'before_execute',
      id: 'no_external_email',
      name: 'No external email',
      appliesTo: { toolkits: ['gmail'] },
      handler: {
        type: 'condition_check',
        condition: 'Sending email to anyone outside example.org',
        action: 'block',
      },
    },
  ],
});

    A blocked call comes back from session.execute() and session.executeMeta() with resultType: 'blocked', empty data, the hook's message in error, and blockReason. Provider integrations hand it to the agent as a failed call with that message. Every result also carries hookResults when a hook applied.

    session.proxyExecute() and ctx.proxyExecute() now return resultType: 'completed' or resultType: 'blocked'. A blocked request has no HTTP response, so TypeScript code that reads status has to check resultType first.

0.26.0

Minor Changes

  • e08c84f: Requires @composio/client 2.0.0-rc.18. The SDK now hands the API client its credential as the client's auth option and its organization and project as scope, instead of placing them in default headers. The apiKey, userApiKey, orgApiKey, orgId and projectId options, their environment fallbacks and the credentials sent on each request are unchanged, with one exception: with apiKey: null and only an organization API key (the orgApiKey option, COMPOSIO_ORG_API_KEY, or an x-org-api-key default header), every request now carries x-org-api-key, and so do trigger channel authorization and session.mcp.headers. Before, only the organization-owner operations did, and every other request went out without a credential.

    Credential and scope headers in defaultHeaders or createSession({ headers }) keep working, but the SDK folds them into its own options instead of forwarding them: an x-user-api-key or x-org-api-key entry becomes the credential every request carries, an x-api-key entry becomes the project key, and x-org-id / x-project-id entries become orgId / projectId. getConfig() reports the folded values (for example apiKey: null and userApiKey for an x-user-api-key entry) and no longer lists those entries under defaultHeaders. Setting more than one of x-api-key, x-user-api-key and x-org-api-key now throws a ComposioError; the API rejected every such request.

    On the client returned by getClient(), apiKey, userApiKey and orgApiKey are read-only and deprecated (read the keys from getConfig(), or authMode and scope from the client), and a per-call headers option can no longer name a credential or scope header. The API client no longer reads the environment itself: the SDK still honours COMPOSIO_ALLOW_INSECURE_HTTP=1, and no longer applies COMPOSIO_CUSTOM_HEADERS; pass defaultHeaders instead.

    The deprecated customConnectionData now requires val.access_token for S2S_OAUTH2, as the API does.

  • 57de614: Requires @composio/client 2.0.0-rc.19. The SDK forwards the API client's log lines through a Console-shaped object instead of the client's removed Logger interface; what is logged, and at which SDK level, is unchanged. With rc.19, the client returned by getClient() no longer has apiKey, userApiKey, orgApiKey or logger, and its baseURL, maxRetries, timeout and logLevel are read-only: read the keys from getConfig(), and derive a client with withOptions() to change the others.

Patch Changes

  • 9d26fb8: Fold OpenAPI nullable into the type in strict tool schemas

    toStrictJsonSchema no longer passes OpenAPI nullable through. Anthropic strict tool use rejects it on an object schema with a 400 for the whole request. A node with nullable: true now accepts null through its type (["object", "null"]) or a null branch, matching how the tool's arguments are validated, and the rewrite is reported as a nullable-converted change. nullable: false is removed as an unsupported-keyword-stripped change. omitNullToolArguments now keeps a null for a property marked nullable: true, as it already does for one whose type includes null.

... (truncated)

Commits
  • 19a8404 Release: update version (#5057)
  • 9a4977f feat(core): add session hooks to TS and Python sessions (#4958)
  • a15956a Release: update version (#4928)
  • bff8c4a feat(core): rename hook handlers to condition_check and prompt_injection_check
  • 9d26fb8 fix(core): fold OpenAPI nullable into the type in strict tool schemas (#4997)
  • f1898b6 fix(sdk): enforce hooks/session-config parity and precise hook_results errors
  • f744fdf fix(core): match the hooks contract on staging
  • c2bbfa8 feat(core): add session hooks to TS and Python sessions
  • be12ce1 feat(core): warn once per deprecated toolkit version reported by the API (PLE...
  • 3dd9a2c fix(core): strip string formats strict mode rejects (#4936)
  • Additional commits viewable in compare view

Updates @slack/web-api from 7.17.0 to 7.19.0

Release notes

Sourced from @​slack/web-api's releases.

@​slack/web-api@​7.19.0

Minor Changes

  • a795b86: feat: expand app manifest types — add agent_view and assistant_view features, recent agent events (app_context_changed, assistant_thread_started, assistant_thread_context_changed), optional OAuth scopes (bot_optional/user_optional), and event metadata_subscriptions

@​slack/web-api@​7.18.0

Minor Changes

  • 07744de: feat: make thread_ts optional for assistant.threads.setSuggestedPrompts
Commits

Updates convex from 1.43.0 to 1.48.0

Changelog

Sourced from convex's changelog.

1.48.0

  • Convex deployments can now sign their own JWTs with an internally managed key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs can be verified with the public key in the JWKS hosted at ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

  • npx convex dev --verbose and npx convex deploy --verbose no longer print environment variable values. The logged list of environment variables shows every value as <redacted>, and values of 8 or more characters are also redacted wherever else they appear in the logged push response and diff, such as auth providers that auth.config.ts builds from process.env.

  • When an AI agent runs npx convex env list or npx convex env default list, they now list only names by default, so secrets stay out of the agent's context. Agents are detected from the environment variables they set. Pass --include-values to print the values.

  • Fixed npx convex ai-files install and npx convex ai-files update reporting success and exiting 0 when the guidelines download or the agent skills install failed. They now exit with code 1.

  • ctx.storage.store() and ctx.storage.get() are now available in mutations, not just actions. Files stored and read in a mutation count toward its transaction limits.

1.47.0

  • Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always failed because dev is reserved for your default dev deployment. It now suggests a dev/my-feature reference and passes --select.
  • npx convex deploy now asks for confirmation before creating or changing an index on a large table, since the deploy blocks until the index is backfilled. Stage the index (staged: true) to backfill it in the background instead, or pass the new --skip-large-indexes-check flag to proceed without confirmation. That flag also covers deleting large indexes, replacing the hidden --allow-deleting-large-indexes flag, which keeps working.
  • The envList MCP tool now returns only environment variable names by default, so secrets stay out of the agent's context. Pass includeValues: true to get the values too, or use envGet to read a single variable.
  • npx convex env list and npx convex env default list have a new --include-values flag for printing values explicitly. Values are still printed by default. The docs and help text now use --include-values wherever the values are needed, like npx convex env list --include-values > .env.convex, and --names-only for just listing variables.
  • Added .staged() to defineTable for validating a schema change in the background instead of blocking the deploy on a scan of the table. Pass the fields to add or change, set a field to undefined to remove it, or pass a full validator. The current validator stays enforced while Convex checks existing documents and new writes against the staged one. npx convex deploy

... (truncated)

Commits

Updates docx from 9.7.1 to 9.14.0

Release notes

Sourced from docx's releases.

9.14.0 adds citations, captions, document protection and embedded files, and fixes tables of contents in LibreOffice. A document can now cite its sources and list them in a bibliography, in each of Word's citation styles, from the new docx/bibliography entry, and style: "Caption" now gives captions Word's Caption style, with a new guide to captions and cross-references (#557). protection makes a document read-only in Word, or keeps parts of it editable with EditableRangeStart and EditableRangeEnd, with an optional password (#2271). EmbeddedFileRun, from the new docx/embedded-files entry, embeds a file such as a spreadsheet as an object that opens when double-clicked (#719). There are smaller additions too. fitText fits a run's text to a width (#2597). Table cell borders take diagonalDown and diagonalUp to split a header cell (#3121). TableOfContents takes a tabLeader, so the space before page numbers can be blank or hyphens rather than dots (#1696). styles.default.lineNumber styles a section's line numbers (#551), and patchDocument can set a document's properties, such as its title and author (#2701). On the fixes side, docx now defines the TOC1 to TOC9 styles that table of contents entries use, so LibreOffice keeps the levels indented after it updates the table (#3819). It also writes a half-inch default tab stop, so tabs and list text line up in Pages (#2590). package.json now says docx needs Node.js 16 or later, as it already did in practice.

What's Changed

New Contributors

Full Changelog: dolanmiu/docx@9.13.0...9.14.0

9.13.0 adds three features and drops two dependencies. A document can now have VBA macros, which makes it a macro-enabled .docm. Write them from VBA code with createMacros, from the new docx/macros entry, or pass in the vbaProject.bin from a .docm that Word saved (#471). A numbered paragraph can restart its list with numbering: { restart: true }, so you no longer have to make up instance numbers (#3037). Runs can use Word's Two Lines in One and Horizontal in Vertical with eastAsianLayout (#1943). docx now reads and writes XML itself, so it no longer depends on xml and xml-js, which are no longer maintained (#3471). There are also fixes for several long-standing issues. patchDocument can read a template from a stream (#2321). An index entry field no longer scrambles the document in Word (#1546), and a table row with no cells is left out, since Word can't open it (#2724). Components made by another copy of docx, such as one bundled with a plugin, are written correctly (#2988). When page numbers come from docx/layout, a numbered heading's table of contents entry now starts with its number (#1130).

What's Changed

... (truncated)

Commits
  • 07286f3 chore: Version bump to 9.14.0
  • eadca50 fix: define the TOC 1 to TOC 9 styles, so LibreOffice keeps the levels of a t...
  • d8a3a73 build(deps-dev): bump eslint-plugin-jsdoc from 65.3.11 to 65.3.12 (#3820)
  • 799bc7f feat: choose what fills the space before a table of contents' page numbers, s...
  • 5050cc0 feat: draw diagonal lines across table cells, to split a header cell (#3121) ...
  • 8a84c59 fix: write a half-inch default tab stop, so tabs and list text line up in Pag...
  • a82643b build(deps-dev): bump markdown-it (#3815)
  • b873832 feat: cite sources and list them in a bibliography, in each of Word's styles,...
  • 9397bbd feat: write Word's Caption style, and document captions and cross-references ...
  • ba2b4e2 feat: protect a document from changes in Word, with a password and editable r...
  • Additional commits viewable in compare view

Updates grammy from 1.45.1 to 1.46.0

Release notes

Sourced from grammy's releases.

v1.46.0

What's Changed

Full Changelog: grammyjs/grammY@v1.45.1...v1.46.0

Commits

Updates linkedom from 0.18.13 to 0.18.14

Commits

Updates playwright-core from 1.62.1 to 1.64.1

Release notes

Sourced from playwright-core's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates undici from 7.29.0 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Updates unpdf from 1.8.0 to 1.9.1

Release notes

Sourced from unpdf's releases.

v1.9.1

   🐞 Bug Fixes

    View changes on GitHub

v1.9.0

   🚀 Features

    View changes on GitHub

v1.8.1

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 1e14452 chore: release v1.9.1
  • b93e371 fix: keep getMeta metadata intact with parseDat...

    Description has been truncated

@dependabot
build(deps): bump the production group across 1 directory with 13 upd…
6ac871b 
…ates

Bumps the production group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@cantoo/pdf-lib](https://github.com/cantoo-scribe/pdf-lib) | `2.8.1` | `2.11.1` |
| [@composio/core](https://github.com/ComposioHQ/composio/tree/HEAD/ts/packages/core) | `0.14.1` | `0.27.0` |
| [@slack/web-api](https://github.com/slackapi/node-slack-sdk) | `7.17.0` | `7.19.0` |
| [convex](https://github.com/convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.43.0` | `1.48.0` |
| [docx](https://github.com/dolanmiu/docx) | `9.7.1` | `9.14.0` |
| [grammy](https://github.com/grammyjs/grammY) | `1.45.1` | `1.46.0` |
| [linkedom](https://github.com/WebReflection/linkedom) | `0.18.13` | `0.18.14` |
| [playwright-core](https://github.com/microsoft/playwright) | `1.62.1` | `1.64.1` |
| [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.30.1` |
| [unpdf](https://github.com/unjs/unpdf) | `1.8.0` | `1.9.1` |
| [ws](https://github.com/websockets/ws) | `8.21.3` | `8.22.0` |
| [@anthropic-ai/claude-code](https://github.com/anthropics/claude-code) | `2.1.227` | `2.1.312` |
| [yaml](https://github.com/eemeli/yaml) | `2.9.0` | `2.9.1` |



Updates `@cantoo/pdf-lib` from 2.8.1 to 2.11.1
- [Changelog](https://github.com/cantoo-scribe/pdf-lib/blob/master/CHANGELOG.md)
- [Commits](https://github.com/cantoo-scribe/pdf-lib/commits)

Updates `@composio/core` from 0.14.1 to 0.27.0
- [Release notes](https://github.com/ComposioHQ/composio/releases)
- [Changelog](https://github.com/ComposioHQ/composio/blob/next/ts/packages/core/CHANGELOG.md)
- [Commits](https://github.com/ComposioHQ/composio/commits/@composio/core@0.27.0/ts/packages/core)

Updates `@slack/web-api` from 7.17.0 to 7.19.0
- [Release notes](https://github.com/slackapi/node-slack-sdk/releases)
- [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/web-api@7.17.0...@slack/web-api@7.19.0)

Updates `convex` from 1.43.0 to 1.48.0
- [Release notes](https://github.com/convex/convex-backend/releases)
- [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `docx` from 9.7.1 to 9.14.0
- [Release notes](https://github.com/dolanmiu/docx/releases)
- [Commits](dolanmiu/docx@9.7.1...9.14.0)

Updates `grammy` from 1.45.1 to 1.46.0
- [Release notes](https://github.com/grammyjs/grammY/releases)
- [Commits](grammyjs/grammY@v1.45.1...v1.46.0)

Updates `linkedom` from 0.18.13 to 0.18.14
- [Commits](WebReflection/linkedom@v0.18.13...v0.18.14)

Updates `playwright-core` from 1.62.1 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.64.1)

Updates `undici` from 7.29.0 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.30.1)

Updates `unpdf` from 1.8.0 to 1.9.1
- [Release notes](https://github.com/unjs/unpdf/releases)
- [Commits](unjs/unpdf@v1.8.0...v1.9.1)

Updates `ws` from 8.21.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.21.3...8.22.0)

Updates `@anthropic-ai/claude-code` from 2.1.227 to 2.1.312
- [Release notes](https://github.com/anthropics/claude-code/releases)
- [Commits](anthropics/claude-code@v2.1.227...v2.1.312)

Updates `yaml` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: "@cantoo/pdf-lib"
  dependency-version: 2.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@composio/core"
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@slack/web-api"
  dependency-version: 7.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: convex
  dependency-version: 1.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: docx
  dependency-version: 9.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: grammy
  dependency-version: 1.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: linkedom
  dependency-version: 0.18.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: playwright-core
  dependency-version: 1.64.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: unpdf
  dependency-version: 1.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production
- dependency-name: "@anthropic-ai/claude-code"
  dependency-version: 2.1.312
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
- dependency-name: yaml
  dependency-version: 2.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026
@github-actions

github-actions Bot commented Nov 1, 2026

Copy link
Copy Markdown
Contributor

@dependabot merge

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Bhasvanth-Dev9380 Bhasvanth-Dev9380 Awaiting requested review from Bhasvanth-Dev9380 Bhasvanth-Dev9380 is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants