[dependabot]

Bumps the npm-minor-and-patch group with 23 updates in the / directory:

Package	From	To
@openai/agents	0.18.0	0.21.0
@tauri-apps/api	2.11.1	2.12.4
@tauri-apps/plugin-dialog	2.7.3	2.8.3
@tauri-apps/plugin-fs	2.5.2	2.7.1
express	5.2.1	5.3.0
express-rate-limit	8.7.0	8.7.1
katex	0.18.7	0.19.0
lucide-react	1.45.0	1.61.0
multer	2.3.0	2.4.0
@types/multer	2.2.0	2.3.0
openai	7.15.0	7.39.0
pdfjs-dist	6.3.289	6.4.299
react	19.3.0	19.3.1
react-dom	19.3.0	19.3.1
sharp	0.35.4	0.35.5
tsx	4.23.13	4.23.15
zod	4.6.2	4.6.7
@playwright/cli	0.1.19	0.1.22
@tauri-apps/cli	2.11.4	2.12.3
@types/multer	2.2.0	2.3.0
@types/node	26.5.1	26.6.5
@vitejs/plugin-react	6.1.1	6.1.2
concurrently	10.0.5	10.0.6
vite	8.3.0	8.3.5

Updates @openai/agents from 0.18.0 to 0.21.0

Release notes

Sourced from @​openai/agents's releases.

@​openai/agents-core@​0.21.0

Minor Changes

• 989513a: fix: Preserve bounded nested numeric token usage breakdowns across streamed runs, usage accounting, and saved run state (schema 1.23, with backward reads of earlier snapshots; #2082); usage detail values now require narrowing to numbers before arithmetic.
• 7b05470: feat: Remove the Runloop sandbox provider and its public API; see the migration guide for supported alternatives.

Patch Changes

• 976579e: fix: recognize GPT-6 Astra, Sol, Luna, and GPT-6.1 Sol in sandbox dynamic compaction thresholds (#2068).

@​openai/agents-extensions@​0.21.0

Minor Changes

• 7b05470: feat: Remove the Runloop sandbox provider and its public API; see the migration guide for supported alternatives.

Patch Changes

• 4521cf5: fix: refresh WebSocket dependencies and development tooling.
• 980423f: fix: preserve Twilio audio format defaults when session audio configuration is omitted (#2072).
• Updated dependencies [989513a]
• Updated dependencies [7b05470]
• Updated dependencies [976579e]
  • @​openai/agents-core@​0.21.0

@​openai/agents-openai@​0.21.0

Patch Changes

• 989513a: fix: Preserve bounded nested numeric token usage breakdowns across streamed runs, usage accounting, and saved run state (schema 1.23, with backward reads of earlier snapshots; #2082); usage detail values now require narrowing to numbers before arithmetic.
• 1163b0c: fix: Preserve image detail when reading user messages from OpenAI Conversations sessions (#2078).
• Updated dependencies [989513a]
• Updated dependencies [7b05470]
• Updated dependencies [976579e]
  • @​openai/agents-core@​0.21.0

@​openai/agents-realtime@​0.21.0

Patch Changes

• 4521cf5: fix: refresh WebSocket dependencies and development tooling.
• 9687b54: fix: Reject WebRTC connections when the server reports an error before the initial session configuration is acknowledged (#466).
• 980423f: fix: preserve Twilio audio format defaults when session audio configuration is omitted (#2072).
• 0dd1ef8: fix: update the Realtime browser bundler to Vite 8.
• Updated dependencies [989513a]
• Updated dependencies [7b05470]
• Updated dependencies [976579e]
  • @​openai/agents-core@​0.21.0

@​openai/agents@​0.21.0

Patch Changes

• Updated dependencies [4521cf5]

... (truncated)

Commits

• 304e436 chore: update versions (#2061)
• 989513a fix: preserve nested token usage details (#2083)
• 1163b0c fix: preserve conversation user image detail (#2084)
• 9687b54 fix(realtime): reject WebRTC startup on server errors (#2076)
• 976579e fix: recognize GPT-6 models in sandbox compaction thresholds (#2074)
• 980423f fix: preserve Twilio session audio defaults (#2073)
• ef6985a docs(sandbox): remove Runloop provider guidance (#2069)
• 7b05470 feat(sandbox): remove Runloop provider (#2070)
• 89a9ddf fix: prevent Dependabot from adopting the parent pnpm workspace (#2060)
• b4370e2 ci: prefetch the Docker test image from ECR Public (#2062)
• Additional commits viewable in compare view

Updates @tauri-apps/api from 2.11.1 to 2.12.4

Release notes

Sourced from @​tauri-apps/api's releases.

@​tauri-apps/api v2.12.4

All found vulnerabilities were already reviewed and decided to be ignored
1 ignored: 1 high

[2.12.4]

What's Changed

• dc637db65 (#16260) Improve menu documentation.

$ pnpm build && cd ./dist && pnpm publish --access public --loglevel debug --no-git-checks
$ rollup -c --configPlugin typescript
�[36m
�[1m./src/app.ts, ./src/core.ts, ./src/dpi.ts, ./src/event.ts, ./src/image.ts, ./src/index.ts, ./src/menu.ts, ./src/mocks.ts, ./src/path.ts, ./src/tray.ts, ./src/webview.ts, ./src/webviewWindow.ts, ./src/window.ts�[22m → �[1m./dist, ./dist�[22m...�[39m
�[32mcreated �[1m./dist, ./dist�[22m in �[1m955ms�[22m�[39m
�[36m
�[1msrc/index.ts�[22m → �[1m../../crates/tauri/scripts/bundle.global.js�[22m...�[39m
�[32mcreated �[1m../../crates/tauri/scripts/bundle.global.js�[22m in �[1m1.5s�[22m�[39m
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 128ms
📦 @tauri-apps/api@2.12.4 → https://registry.npmjs.org/
GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/21//idtoken/c37ddb61-7d6d-84f8-af6e-d0b7e7d7955a/56cb7a72-c3b4-5319-90d2-88ed76ba30ee?api-version=2.0&audience=sigstore 200 58ms
Signed provenance statement with source and build information
✅ Published package @tauri-apps/api@2.12.4

@​tauri-apps/api v2.12.3

All found vulnerabilities were already reviewed and decided to be ignored
3 ignored: 3 high

[2.12.3]

... (truncated)

Commits

• 59b63ab Apply Version Updates From Current Changes (#16255)
• 55883af fix(bundler): Update rpm-rs to 0.30 (#15639)
• 744ff2b chore(deps): bump rustls to 0.23.46
• c95be46 fix(cli): xcode-script tauri CWD rewrite (#16287)
• dc637db chore: add missing api change file (#16260)
• b948762 fix(macos-sign): import the signing certificate as an explicit pkcs12 (fix: #...
• 7b673dd fix(core): drop late mobile plugin responses instead of panicking (#16146)
• 5a61498 fix(bundler): keep script stderr in errors and hint at the Finder permission ...
• 5a3cbfc fix(macos-codesign): Inline apple-codesign code (#16279)
• 141d1c0 fix(acl): resolve permission files after the target dir is moved (#16199)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-dialog from 2.7.3 to 2.8.3

Release notes

Sourced from @​tauri-apps/plugin-dialog's releases.

dialog-js v2.8.3

[2.8.3]

Dependencies

• Upgraded to fs-js@2.7.1

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-dialog@2.8.3
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 3.5kB README.md
npm notice 7.1kB dist-js/index.cjs
npm notice 15.1kB dist-js/index.d.ts
npm notice 7.0kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 657B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-dialog
npm notice version: 2.8.3
npm notice filename: tauri-apps-plugin-dialog-2.8.3.tgz
npm notice package size: 6.8 kB
npm notice unpacked size: 34.3 kB
npm notice shasum: 1ef5cbd8833d50c911dedc3b50b94c6ba7ec2db5
npm notice integrity: sha512-Hd/yBfk2R5v2M[...]S+gBDNe3nHspw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3253692258
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-dialog@2.8.3

dialog v2.8.3

[2.8.3]

Dependencies

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-fs from 2.5.2 to 2.7.1

Release notes

Sourced from @​tauri-apps/plugin-fs's releases.

opener-js v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-opener@2.7.1
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 3.1kB dist-js/index.cjs
npm notice 2.0kB dist-js/index.d.ts
npm notice 3.1kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 730B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-opener
npm notice version: 2.7.1
npm notice filename: tauri-apps-plugin-opener-2.7.1.tgz
npm notice package size: 3.5 kB
npm notice unpacked size: 14.1 kB
npm notice shasum: e8719fb7c89a681460f6b5b42a6b7d71746b4c92
npm notice integrity: sha512-XkXdt30rontti[...]F1sFsmu6uyywQ==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3189619091
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-opener@2.7.1

opener v2.7.1

[2.7.1]

• 42ae8b45 (#3684) On iOS, mark the plugin's init_plugin_* entry point public so release builds made with Xcode 27 keep it global and link.

... (truncated)

Commits

• 44293a5 Publish New Versions (v2) (#3689)
• 7550f7c chore(deps): bump rustls to 0.23.46
• 36d8e40 feat(geolocation): support for non-GMS devices (#3377)
• 57297f3 feat(clipboard-manager): add support for writing secrets (#3376)
• 1ab9304 fix(opener): avoid blocking-runtime panic in reveal_item_in_dir (#3565)
• 0e17675 fix(http): decode header values as ISO-8859-1 (#3586)
• 62b3565 chore(deps): update quinn-proto (lockfile-only) (#3707)
• d80b1be feat: add torch plugin for iOS and Android (#3551)
• c91a9e6 feat(sql): add autoCreate option to Database.load (#3702)
• 0374bec [feat] [biometric] Adding the capability of encrypting/decrypting data using ...
• Additional commits viewable in compare view

Updates express from 5.2.1 to 5.3.0

Release notes

Sourced from express's releases.

v5.3.0

Highlights

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Changelog

Sourced from express's changelog.

5.3.0

🐞 Bug fixes

• Fixed HTTP header conflict between Content-Length and Transfer-Encoding in res.send - by @​YuryShkoda in #4893

  Fixed the behavior of res.send() to prevent conflicts between Content-Length and Transfer-Encoding HTTP headers in responses. The Content-Length header in res.send() is now only added when a Transfer-Encoding header is not present, complying with the HTTP specification that states both headers should not coexist in the same response. ETag generation is unaffected by the presence of a Transfer-Encoding header - by @​cuishuang in #7459

• Upgrade qs to ^6.16.0, which fixes CVE-2026-2391 (GHSA-w7fw-mjwx-w883), CVE-2026-82417 (GHSA-4mjr-xmp4-gh2g) and CVE-2026-82562 (GHSA-x5fp-wj9c-mxmx): arrayLimit bypasses in comma parsing and a denial of service via an attacker-controlled isBuffer - by @​davetashner in #7057 and #7478, and @​cyphercodes in #7305

• Upgrade proxy-addr to ^2.0.8, which fixes CVE-2026-90711 - by @​lazerg in #7474

🚀 Improvements

• Allow conditional revalidation for QUERY requests. req.fresh previously only validated freshness for GET and HEAD requests, so QUERY responses never returned 304 despite a matching validator. Since QUERY is a safe, idempotent, and cacheable method that supports conditional requests, it is now included in the freshness check - by @​Cherry in #7366

  // QUERY /reports with If-None-Match: "12345"
  app.query('/reports', (req, res) => {
    res.set('ETag', '"12345"');
    res.send(results); // now responds 304 Not Modified
  });

• Improve HTML structure in res.redirect() responses when HTML format is accepted by adding <!DOCTYPE html>, <title>, and <body> tags for better browser compatibility - by @​Bernice55231 in #5167

• When calling app.render with options set to null, the locals object is handled correctly, preventing unexpected errors and making the method behave the same as when options is omitted or an empty object is passed - by AkaHarshit in #6903

  app.render('index', null, callback); // now works as expected

• Upgrade content-type to ^2.0.0, bringing a faster parser (~1.5x quicker Content-Type parsing/formatting in res.send()) along with a behavior change: res.send() now keeps any existing parameters when adding the charset and no longer throws on a Content-Type that fails to parse. type-is is upgraded to ^2.1.0 as part of the same change - by @​blakeembrey in #7234

  res.set('Content-Type', 'text/plain; foo=bar').send('hey');
  // -> Content-Type: text/plain; foo=bar; charset=utf-8

• The default error handler now logs the full error object instead of only its stack trace, so nested details such as Error.cause and library-specific properties (e.g. Sequelize's parent/original) are no longer swallowed - by @​Nitin-Mohapatra in #6464

• Upgrade content-disposition to ^2.0.1, which changes the Content-Disposition header emitted by res.download(), res.attachment(), and res.sendFile(): file names that are valid HTTP tokens are no longer wrapped in quotes. This is equivalent per RFC 6266, but applications asserting on the exact header bytes should update their expectations - by @​blakeembrey in #7233

  res.attachment('user.html');
  // before -> Content-Disposition: attachment; filename="user.html"
  // after  -> Content-Disposition: attachment; filename=user.html

... (truncated)

Commits

• cf6722b 5.3.0 (#7468)
• 8c2fcfc docs: fix typos and a stale API reference in lib comments (#7512)
• 9efc29e docs: fix pass-through typos (#7509)
• 2717ae3 build(deps): bump the github-actions group with 3 updates (#7499)
• de77771 build(deps-dev): bump hbs from 4.3.0 to 4.3.1 (#7500)
• 9169cbe docs: add missing apostrophe in example (#7483)
• 7ef9844 build(deps-dev): bump morgan from 1.12.0 to 1.12.1 (#7493)
• 3b7e39f deps: bump qs minimum to 6.16.0 (#7478)
• 98bd4cd deps: proxy-addr@^2.0.8 (#7474)
• 9a34acf fix(res.send): preserve ETag generation with Transfer-Encoding (#7459)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for express since your current version.

Updates express-rate-limit from 8.7.0 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)
• 7f401b7 chore(deps): bump actions/setup-node from 4.4.0 to 7.0.0 (#693)
• 7a49bb0 ci: add guard that fails the build on unpinned GitHub Actions (companion to #...
• 784c447 ci: pin GitHub Actions to immutable commit SHAs (#690)
• Additional commits viewable in compare view

Updates katex from 0.18.7 to 0.19.0

Release notes

Sourced from katex's releases.

v0.19.0

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

v0.18.11

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

v0.18.10

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Changelog

Sourced from katex's changelog.

0.19.0 (2026-10-01)

Documentation

• note strict changes shipped in 0.18.11 (#4300) (cbb1fce)

BREAKING CHANGES

• Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

0.18.11 (2026-10-01)

Features

• handle character metrics warnings via strict (#4243) (4237070)

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

Commits

• 6ea2dc9 chore(release): 0.19.0 [ci skip]
• cbb1fce docs: note strict changes shipped in 0.18.11 (#4300)
• d5bed9f chore(release): 0.18.11 [ci skip]
• 4237070 feat: handle character metrics warnings via strict (#4243)
• 411da70 chore(release): 0.18.10 [ci skip]
• a477b2e feat: make KaTeX fallback to browsr math font before Times New Roman (#4298)
• 5a6a8f8 chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 (#4297)
• 71a7bc0 chore(release): 0.18.9 [ci skip]
• aafa187 feat(types): add contrib module declarations (#4250)
• e749fd1 chore(release): 0.18.8 [ci skip]
• Additional commits viewable in compare view

Updates lucide-react from 1.45.0 to 1.61.0

Release notes

Sourced from lucide-react's releases.

Version 1.61.0

What's Changed

• feat(icons): added circle-chevrons-down, circle-chevrons-left, circle-chevrons-right and 1 more icons by @​ypotti in lucide-icons/lucide#5025

New Contributors

• @​ypotti made their first contribution in lucide-icons/lucide#5025

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

• feat(icons): added tombstone icon by @​ryck in lucide-icons/lucide#4929
• feat(icons): added smartphone-user-round icon by @​hitanshu-machhi in lucide-icons/lucide#4586
• feat(icons): added bacon icon by @​devkamani9313-lab in lucide-icons/lucide#4694
• fix(site): Fix build by @​ericfennis in lucide-icons/lucide#5033
• chore(docs): Update icon count comparison with Feather Icons by @​noahweidig in lucide-icons/lucide#5022
• feat(icons): added letter-spacing icon by @​madebyoz in lucide-icons/lucide#3038
• chore(deps): bump the vue-deps group with 2 updates by @​dependabot[bot] in lucide-icons/lucide#5027
• chore(deps-dev): bump react-native from 0.87.1 to 0.88.0 in the react-native-deps group by @​dependabot[bot] in lucide-icons/lucide#5030
• feat(icons): added line-height icon by @​madebyoz in lucide-icons/lucide#3039
• chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates by @​dependabot[bot] in lucide-icons/lucide#5028
• chore(deps): bump the react-deps group across 1 directory with 2 updates by @​dependabot[bot] in lucide-icons/lucide#5026
• feat(icons): added brain-off icon by @​ej52 in lucide-icons/lucide#3535
• feat(icons): added graph-hub icon by @​Carlito-la-banane in lucide-icons/lucide#4974
• feat(svelte): export __iconData and __iconNode across per-icon modules (#4936) by @​ronitgupta138 in lucide-icons/lucide#4957

New Contributors

• @​hitanshu-machhi made their first contribution in lucide-icons/lucide#4586
• @​devkamani9313-lab made their first contribution in lucide-icons/lucide#4694
• @​noahweidig made their first contribution in lucide-icons/lucide#5022
• @​madebyoz made their first contribution in lucide-icons/lucide#3038
• @​ej52 made their first contribution in lucide-icons/lucide#3535
• @​Carlito-la-banane made their first contribution in lucide-icons/lucide#4974
• @​ronitgupta138 made their first contribution in lucide-icons/lucide#4957

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

• feat(docs): Adds search field to docs pages by @​ericfennis in lucide-icons/lucide#5012
• fix(icons): changed chess-queen icon by @​karsa-mistmere in lucide-icons/lucide#4613

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

• feat(docs): add third-party package lucide-jte by @​sgruendel in lucide-icons/lucide#5000
• chore(integration-tests): Add Svelte integration tests for @ucide/svelte by @​ericfennis in lucide-icons/lucide#5005
• chore(deps-dev): bump the angular-deps group across 1 directory with 10 updates by @​dependabot[bot] in lucide-icons/lucide#5004

... (truncated)

Commits

• fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
• 3f1255e chore(deps-dev): bump @​vitejs/plugin-react (#4995)
• 949bc6d test(lucide-react): add tests for DynamicIcon fallback and ref forwarding (#4...
• 98331e2 chore(deps): bump the react-deps group across 1 directory with 3 updates (#4951)
• 09aa9c5 chore(deps): Upgrade to vite 8 (#4950)
• e042fec fix(packages): declare @types/react as an optional peer dependency (#4892)
• f06ac67 chore(typchecking): More typecheck jobs for all packages (#4885)
• See full diff in compare view

Updates multer from 2.3.0 to 2.4.0

Release notes

Sourced from multer's releases.

v2.4.0

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')
const upload = multer({
storage: multer.memoryStorage(),
streamHandler: (req, busboy) => {
// Cloud Functions / Firebase expose the pre-read body here
if (req.rawBody) busboy.end(req.rawBody)
else req.pipe(busboy)
}
})
app.post('/upload', upload.single('file'), (req, res) => {
res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• docs: remove README translations by @​UlisesGascon in expressjs/multer#1463
• ci: add macOS to the test matrix by @​kilisamemarisaaa in expressjs/multer#1464
• feat. improve wording for LIMIT_UNEXPECTED_FILE error code by @​flashbag in expressjs/multer#426
• feat: add filename to file errors by @​UjjwalKumar239 in expressjs/multer#1416
• refactor: remove concat-stream dependency by @​Phillip9587 in expressjs/multer#1356
• fix: reject non-integer fileSize limits by @​abhu85 in expressjs/multer#1395
• fix: allow exactly limits.parts parts by @​deepakganesh78 in expressjs/multer#1446
• fix: do not consume maxCount for files skipped by fileFilter by @​Sagargupta16 in expressjs/multer#1426
• fix: validate all limits at construction time by @​ShubhamOulkar in expressjs/multer#1335
• test: cover storage engine _removeFile invocation semantics by @​kilisamemarisaaa in expressjs/multer#1460
• feat: accept a function for limits by @​hossein-zare in expressjs/multer#1133...

  Description has been truncated