deps: bump the npm-minor-and-patch group across 1 directory with 24 updates

[dependabot]

Bumps the npm-minor-and-patch group with 24 updates in the / directory:

Package	From	To
@chenglou/pretext	0.0.5	0.0.9
@modelcontextprotocol/sdk	1.31.0	1.32.1
@octokit/rest	22.0.0	22.0.1
@rdfjs/parser-n3	2.1.0	2.2.0
cors	2.8.5	2.8.6
electron-log	5.4.3	5.4.4
express-rate-limit	8.5.2	8.7.1
heic-to	1.5.2	1.6.6
hono	4.13.11	4.13.13
jsonwebtoken	9.0.2	9.0.3
papaparse	5.5.3	5.7.0
react-virtuoso	4.18.3	4.18.16
sparql-http-client	3.0.1	3.1.0
use-debounce	10.0.5	10.1.1
zustand	5.0.3	5.0.15
@cloudflare/workers-types	5.20260929.1	5.20261011.1
@playwright/test	1.63.0	1.64.0
@testing-library/react	16.3.0	16.3.3
@testing-library/user-event	14.6.1	14.6.7
electron	44.5.0	44.7.0
eslint-plugin-react	7.35.0	7.37.5
eslint-plugin-react-refresh	0.4.11	0.5.7
wait-on	9.0.3	9.5.1
wrangler	4.144.0	4.149.0

Updates @chenglou/pretext from 0.0.5 to 0.0.9

Changelog

Sourced from @​chenglou/pretext's changelog.

Upgrading from 0.0.9

• layoutNextLine() and layoutNextLineRange() take the width before the cursor, (prepared, maxWidth, start?), as layoutNextRichInlineLineRange() does, and give the first line without a cursor: swap the second and third arguments at every call. TypeScript reports each call left in the old order; in JavaScript, search for the two names, since a call left in the old order never returns null (#496).
• Rich-inline cursors are only for passing back: a line's end and a fragment range's start and end no longer index the item's own text, and a materialized fragment's type no longer has start and end, so code that read them there no longer compiles. Read its sourceStart and sourceEnd instead, and keep the range of a line you pass back (#460, #483).
• The type of a prepareWithSegments() handle shows only segments, kinds and widths, all read-only: copy one before passing it on as an array or calling array methods on widths (prepared.segments.slice(), Array.from(prepared.widths)), call measureNaturalWidth() for a text's width, and read a line's width for a line's (#450).
• segLevels is gone: paint each paragraph of mixed-direction text as one DOM element with its direction set (#258).
• In kinds, 'glue' is gone, a run of no-break spaces being 'text', and 'zero-width-glue' and 'control' are new (#240, #340).
• setLocale(locale) now sets the language text is laid out under, in place of <html lang>: pass the page's language, not the user's, or drop the call. setLocale() with no argument goes back to <html lang>, and setLocale('') no longer does (#340, #356).
• Don't deep-freeze a handle, and prepare the text again in place of a handle that 0.0.9 made (#340, #460).
• A letterSpacing that isn't finite now throws a RangeError when preparing (#356).
• A font string that Canvas ignores, such as '', '16px' or 'Arial 16px', now throws a RangeError when preparing: check what getComputedStyle(el).font gave before passing it on (#502).
• Put the space next to a break: 'never' item in the text beside it: the item's own leading and trailing white space no longer makes a gap, and an item of only white space is an empty box as wide as its extraWidth. An item of only a zero-width space or soft hyphens, such as an editor's placeholder, gets no fragment on a line whose start consumes it, as after a space that ends the line before (#369, #460).
• In TypeScript, an entry of prepareRichInline()'s list may be a box, so check its text before reading its font; a run type of your own can't carry a width; a fragment range built by hand needs gapItemIndex, and a materialized fragment sourceStart and sourceEnd too, and no start or end; and paragraphs.map(prepareRichInline) needs an arrow function, items => prepareRichInline(items) (#310, #379, #387, #460, #483).
• The demos are in the repository, no longer in the package (#342).

Added

• Rich inline takes boxes, { width } (RichInlineBox), for an image, a custom emoji, a formula or a badge inside a line, in place of a character with break: 'never' and an extraWidth that made up the rest of the object's width. A line can break before and after a box, as at an <img>, whatever text touches it, and its fragment has the box's width and no text. Heights stay yours: give each box vertical-align: top, and each line is as tall as the paragraph's line height or its tallest box, whichever is taller. prepareRichInline() now takes Array<RichInlineItem | RichInlineBox>, so code typed from its parameter checks an item's text before reading its text or font, and RichInlineItem has width?: never, so an app whose own run type carries a width beside its text no longer type-checks at prepareRichInline(): pass such runs without that field, or name it otherwise; at run time such an item still lays out as text (#387).
• prepareRichInline() takes an options argument, { whiteSpace: 'pre-wrap' }, for CSS white-space: pre-wrap on the paragraph, as prepare() does: every item but an atomic one keeps its spaces, tabs and newlines, spaces at a line's end hang past it across a change of style, tab stops count from the line's start, and a newline ends its line, so an editor's paragraph split into styled runs takes the lines the browser gives it. White space after an atomic item wider than the line stays on that item's line, whatever items it spans; in Firefox, such white space that runs into a tab moves to the next line with the tab. A tab counts its stops in its own item's font, as Safari does; Chrome and Firefox count them in the paragraph's font, so a tab inside a span in another font, such as a code span, can land a whole stop from theirs. paragraphs.map(prepareRichInline) no longer type-checks, since map() hands its index where the options go: write items => prepareRichInline(items) (#381, #386, #395, #419, #460).
• prepareRichInline()'s options argument also takes { wordBreak: 'keep-all' }, for CSS word-break: keep-all on the paragraph, as prepare() does, so Korean, Chinese and Japanese messages with mentions, bold runs or code spans break where the browser breaks them under keep-all (#379).
• Rich-inline fragments now have gapItemIndex, the index of the item whose collapsed space gapBefore measures, or -1 when no space precedes the fragment on its line. A painter can draw that space inside the element of the item whose font measured it, and can tell a space that takes no room apart from no space (#310).
• Materialized rich-inline fragments now have sourceStart and sourceEnd, where the fragment's text sits in its item's text, as UTF-16 offsets: of the items Ship and it now, the fragment it now is 1 to 7. Read them where code written for 0.0.9 read the fragment's start and end as cursors into the item's own text, which they no longer are (under Changed). TypeScript that builds a fragment by hand, as a test does, now has to give it these two and gapItemIndex, and to leave out start and end, which a materialized fragment's type no longer has; a fragment range built by hand needs gapItemIndex (#460, #483).
• walkLineRanges(), measureLineStats(), measureNaturalWidth() and layoutNextLineRange() now also take a prepare() handle, so an app that only needs line counts, widths or cursors, such as a chat bubble shrunk to its widest line, no longer has to keep every segment's string in memory with prepareWithSegments(). layoutWithLines(), layoutNextLine() and materializeLineRange(), which return text, still need prepareWithSegments() (#449).

Changed

• Bundles that import Pretext are larger than with 0.0.9: the main entry is about 40 KB gzipped (95 KB minified), up from 16 KB (48 KB), and @chenglou/pretext/rich-inline about 44 KB (107 KB), up from 16 KB (49 KB). About 23 KB gzipped of each is each browser's line-break and grapheme data with the code that reads it, which replace Pretext's own break rules and the Unicode bidi-class table that 0.0.9 bundled for segLevels. The npm package is 56 files and about 1,030 KB unpacked, where 0.0.9 was 69 files and 887 KB, 534 KB of it the demos, which have left the package (#258, #311, #340, #342, #344, #392, #394, #403, #460, #515).
• Speed against 0.0.9, timed in Chrome 154, Firefox 157 and Safari 27 on an M5 Max MacBook Pro, on chat-like messages (#338, #340, #344, #351, #365, #375, #383, #400, #407, #435, #445, #453, #460, #497, #512, #513, #515):
  • Faster: layout() at a new width is three to six times as fast. measureLineStats() and walkLineRanges() are 1.8 to 4.9 times as fast, layoutWithLines() 1.3 to 1.7 times and layoutNextLineRange() 1.1 to 2.2 times. prepare() of text it has measured before, as when a list prepares its messages again, is 1.1 to 13 times as fast: two to three and a half times for English text, 6 to 13 times for Chinese and Japanese, least for Thai. Text it hasn't measured before is about 1.5 to 2.1 times as fast for English, Chinese and Japanese, 1.1 to 1.6 times for messages that mix scripts, and from level to 1.7 times for Arabic and Thai. Rich inline, timed on the Markdown chat demo's paragraphs (English, most of them one item), prepares and measures new ones about 1.4 to 1.9 times as fast and ones it has measured before 2.3 to 4.8 times as fast. measureRichInlineStats() is two to three times as fast there, and walkRichInlineLineRanges() and layoutNextRichInlineLineRange() 1.1 to 1.9 times, least on paragraphs of several styled items. Worst-case text, such as letter-spaced CJK, soft hyphens among combining marks, long unbroken runs and pre-wrap text, is faster too, in prepare() and in layout().
  • Slower: loading the library, timed as a bundle of both entry points, takes about 0.4 ms more on each page in Chrome, 0.7 ms in Safari and 1.1 ms in Firefox, and the first text a page prepares, its first few hundred to a thousand characters, takes about 0.5 to 0.8 ms more in Chrome, 0.6 to 1.1 ms in Safari and up to 0.3 ms in Firefox; in Chrome and Safari the text after that is already level or faster. In Safari, letter-spaced Hindi and Arabic text prepared again after clearCache() takes 9% to 15% longer, since Pretext now asks Canvas how many glyphs Safari spaces (#513, under Fixed). The first prepare() of interface labels is slower in some languages, most of them with long words, though labels of 35 languages mixed are level or faster in the three browsers. Most of that cost is the widths a word 80px or wider now gets for each of its letters when it is first prepared, for a line narrower than the word, which cuts it between letters.
• In pre-wrap text, tab stops now follow each browser. Chrome and Firefox count letter spacing in every stop, so a run of tabs under negative letterSpacing no longer collapses to one stop's width. A tab closer to its stop than the browser's minimum, half a space in Chrome and Safari and half a 0 in Firefox, takes the stop after it. In Firefox, which doesn't hang tabs, a word whose tab doesn't fit moves to the next line with the tab, so tab-separated text such as a pasted table or indented code wraps where Firefox wraps it (#240, #395).
• A rich-inline atomic item's (break: 'never') own leading or trailing white space no longer gives a gap before or after it, as browsers trim that white space inside the item's box: where only that white space stood, gapBefore is now 0, and gapItemIndex -1, where 0.0.9 measured a space in the atomic item's font. An atomic item of only white space is an empty box as wide as its extraWidth, as browsers lay out an inline-block that holds only white space, where 0.0.9 made it a collapsed space with no extraWidth (#369, #460).
• Pretext now finds grapheme clusters with the character rules each browser ships instead of Intl.Segmenter, which it needs only for text in Thai, Lao, Khmer, Myanmar and the other Southeast Asian scripts written without spaces (#344).
• Chrome, Safari and Firefox now find where lines can break with ports of each browser's own line breaker and its data, in place of Pretext's own rules, so lines break where the browser breaks them in many more cases, such as around CJK punctuation and quotes, dashes, URLs and Thai (#340). Among the breaks that moved (#228, #232, #233, #234, #240, #243, #245, #249, #250, #270, #276, #288, #289, #290, #291, #309):
  • Lines can break after ؟, ؛ or ۔ before a following word, after a ? that follows a space or a zero-width space, and after ! or ? before a symbol such as ©, ¿ or €. In Chrome and Safari they can also break after ? before $, %, +, | or -, while ! still stays with those and with a following ASCII letter or digit; in Firefox they can break after ! before a letter or digit, and ! and ? stay with a following - or |.
  • In Chrome and Safari, a hyphen or dash at the start of a word, such as U+2010 HYPHEN, U+2012 FIGURE DASH or U+2013 EN DASH, stays with the letter after it; - does so only before a letter outside ASCII in Chrome, such as é, and outside Latin-1 in Safari. In Firefox, a hyphen stays with a number after it, as in 2025-08-01 or log-2026, and a line can break after / before a letter, as in and/or or example.com/docs, though not before a number, as in 1/2.
  • A figure space (U+2007) keeps the text on both sides of it on one line, like a no-break space, and a zero-width joiner keeps the character after it. A next-line character (U+0085) stays on the same line as the text before it, and lines can still break after it.
  • Lines no longer start with closing punctuation or other marks that can't start a line, such as 。, ，, 」, ､, ］ or ゛: such a mark stays with the text before it, CJK or not, as in xxxx， or 😀。, and after CJK text so do ', /, |, ‼ and ％. A word that doesn't fit a line with its mark breaks before the mark.
  • After CJK text, ., ,, :, ;, ), ], % or " keeps a following word or number on its line, and !, }, / or | keeps what each browser keeps: Chrome ASCII letters and digits; Safari digits, and letters only after a } that follows an ideograph or Hangul syllable; Firefox only digits after /. A time or number before closing punctuation such as a full-width comma, as in 00:00:00，, stays whole.
  • In Chrome, lines can break between a fullwidth closing bracket such as 」 or ） and a following ideograph, kana or Hangul syllable.
  • Small kana and ー after CJK text can start a line in Chrome, in Safari only on pages whose <html lang> is Japanese or Korean, and not in Firefox; where they can't, they also stay with a letter or digit before them, as in 約3ヶ月.
  • With word-break: keep-all, lines in Chrome and Firefox no longer break after ー in words such as ラーメン, nor in Chrome after an iteration mark such as 々. In Chrome and Firefox they can break before an opening bracket after CJK text, as in 서울(한국)에서, before 「 or （ after Latin letters or digits, and next to Thai text; in Chrome also next to emoji and symbols such as ★, and before an opening quotation mark or after a closing one between CJK characters, as in 他说“你好”然后; in Firefox also after a flag emoji.
  • Text that stays together on a line, such as 漢。 or 「漢, breaks between characters when it doesn't fit a line, instead of overflowing, and a run of opening brackets stays with the word after it, as in 「「tail.
• Rich inline now lays its items out as one paragraph, as a browser lays out a paragraph's spans: it finds where lines can break in the items' joined text once and measures each item in its own font, so its lines break where the same text in one element does. Each item continues the line before it, and a line ends between items, or inside one, only where the joined text has a break opportunity, in every browser, in engines Pretext doesn't recognize and in runtimes such as Node, Bun or jsdom. 0.0.9 prepared every item apart and laid each out as if it started a line, so a line could end at any item boundary, or between the letters of an item's first word to fill the line (#241, #287, #301, #327, #359, #369, #372, #373, #460, #483):
  • Punctuation such as , or ) at the start of an item stays with the word before it, and a word split across items wraps as one word, moving to the next line whole where it doesn't fit. Items without a space between them still break where the joined text allows it, such as between CJK characters, at Thai word boundaries or after -. In Chrome and Firefox, where items split a word, as when part of a Thai or Myanmar word is styled, lines end at that word's own breaks. In Safari, breaks inside each item still come from that item's own text, as Safari wraps each span, so a Thai, Lao, Khmer or Myanmar word split across items wraps like Safari's spans.
  • A soft hyphen that starts an item after other text, or ends an item, is a break there, and a line that ends at it ends with a hyphen, which its width counts and its fragment's text shows; 0.0.9 painted and counted none there. In Firefox that holds before a combining mark too; after an ideograph or emoji such a break needs no room for a hyphen, as Firefox draws none there; two soft hyphens that start an item break as in one element; and so does one right after a space, with no hyphen.
  • An item holding only a soft hyphen is such a break too, and keeps the collapsed space before it, which its fragment names in gapItemIndex; an item that starts with a soft hyphen and a space keeps that space after other text on the line. White space between the soft hyphens of such an item takes room after other text in Chrome and Safari, as in one element, and a line too narrow for anything ends at its first soft hyphen. An item of only soft hyphens or a zero-width space gets no fragment on a line whose start consumes it, where 0.0.9 gave it one that took no room.
  • In Firefox, white space collapses across soft hyphens and bidi controls, invisible direction characters such as U+202A, from one item into the next, as Firefox collapses one run of them whichever element holds it, so an item holding only white space and bidi controls such as LRM between words takes the room of one space, not two, and a soft hyphen or bidi control that starts an item ends that run. In Chrome, a newline next to a zero-width space in the item before or after it goes, as in one element, instead of leaving a space.
  • Cursors changed meaning, which breaks code that read them as places in an item's own text. A line's end and a fragment's start and end now count segments of the item's part of the paragraph, and are only for passing back to layoutNextRichInlineLineRange() and materializeRichInlineLineRange(). On 0.0.9 they indexed the item's own prepared text, prepareWithSegments(item.text), and they no longer do: they differ, among others, for an item that starts with white space after another item's text, whose first segment is now that space; for an atomic item, which is one segment; for an item that starts inside a word whose breaks depend on the whole word, as a Thai word's do in Chrome and Firefox; and for an item with extraWidth that starts with a zero-width space, whose start is now a segment of its own before that space. A paragraph of one text item that isn't atomic and has no extraWidth keeps that text's own cursors. To find a fragment's text in its item, read the materialized fragment's sourceStart and sourceEnd (under Added): its type no longer has start and end, so TypeScript that reads them there no longer type-checks. Nor does a materialized line or fragment where a range is asked, as when a line is passed back to materializeRichInlineLineRange(): keep the range of a line you pass back.
  • Four things got worse. A zero-width space in an item of its own, such as the placeholder an editor keeps in an empty styled run, no longer gets the line of its own that the browser gives it: after a space that ends its line, where the paragraph comes out a line shorter than the browser's for the few pixels of width where that line's text fits and the space doesn't; and after content wider than its line, such as text laid out at a width narrower than a letter or, in Chrome and Safari, an atomic item that doesn't fit. In Chrome and Safari, an item with extraWidth that holds only a zero-width space, such as an empty code span kept open with one, stays on a line where only half its extraWidth, the end padding, doesn't fit, so that line's width is more than maxWidth; 0.0.9 moved it to the next line, which is where those browsers put it after a space. In Firefox, a line that ends at a space before a soft hyphen in another item reports that space in its width, one space wider than Firefox paints. Also in Firefox, where an item ends with a space and the next starts with a bidi control, such as U+200E, and another space, a one-word line that ends at the first space reports that space in its width as well, and a longer line that fits only without that space now gives up its last word to the next line, which Firefox does in some such paragraphs and not in others, so the paragraph can come out a line taller than Firefox's.

... (truncated)

Commits

• 8460bf9 Release 0.0.9
• 934141a Simplify preparation and rich line materialization
• 172eeed Validate browser measurement environments and report ownership
• f37d482 Merge pull request #222 from chenglou/codex/wrapping-observation-production-2...
• f85abc3 Link shared line layout fix to PR 222
• d92ad71 Retain independent native extraction observations
• d5810ef Preserve reviewed line-walker fixes in wrapping comparisons
• 2b73992 Unify complex line layout decisions
• cdc34f1 Merge pull request #221 from chenglou/codex/linear-work-20260905
• 7a0b4a8 Bound whitespace and streamed breakpoint searches
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.31.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in modelcontextprotocol/typescript-sdk#2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in modelcontextprotocol/typescript-sdk#2942
• chore: bump version to 1.32.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

Commits

• ff07b00 chore: bump version to 1.32.1 (#2954)
• 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
• a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
• 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
• 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
• Additional commits viewable in compare view

Updates @octokit/rest from 22.0.0 to 22.0.1

Release notes

Sourced from @​octokit/rest's releases.

v22.0.1

22.0.1 (2025-10-31)

Bug Fixes

• deps: update octokit monorepo (major) (#538) (ded2f17)

Commits

• daa3ec9 ci(action): update actions/setup-node action to v6 (#534)
• 1dec0c7 ci(action): update peter-evans/create-or-update-comment action to v5 (#531)
• ded2f17 fix(deps): update octokit monorepo (major) (#538)
• 0e0eaea chore(deps): update dependency @​types/node to v24 (#537)
• c04acc8 chore(deps): update vitest monorepo to v4 (major) (#536)
• e6dd306 chore(deps): update dependency undici to v7 (#474)
• 5f380d0 build(deps-dev): Bump form-data from 4.0.2 to 4.0.4 in /docs (#520)
• dc6827d build(deps-dev): Bump tar-fs from 2.1.2 to 2.1.3 in /docs (#516)
• See full diff in compare view

Updates @rdfjs/parser-n3 from 2.1.0 to 2.2.0

Commits

• 9342f5f 2.2.0
• 17717a5 Merge pull request #30 from rdfjs-base/n3-update
• 35df859 Merge pull request #29 from rdfjs-base/ci-update
• daf713d chore: updated ci dependencies
• 01b9daf feat: updated n3.js dependency, added support/tests for triple terms
• 4148a09 Merge pull request #27 from rdfjs-base/dependabot/npm_and_yarn/c8-11.0.0
• 73ac52b Bump c8 from 10.1.3 to 11.0.0
• a31aaa2 Merge pull request #24 from rdfjs-base/dependabot/github_actions/actions/chec...
• dde2259 Bump actions/checkout from 5 to 6
• 37db73d Merge pull request #23 from rdfjs-base/dependabot/github_actions/actions/setu...
• Additional commits viewable in compare view

Updates cors from 2.8.5 to 2.8.6

Release notes

Sourced from cors's releases.

v2.8.6

What's Changed

• Build: Node.js@12.16 and Node.js.13.12 by @​smondal in expressjs/cors#189
• Update README.md for origin function callback parameters by @​dstudzinski in expressjs/cors#180
• Suggest passing false for disallowed domains, not erroring by @​shackpank in expressjs/cors#175
• Changed the term whitelist to allowlist in Documentation by @​jkasun in expressjs/cors#200
• Fix typo in README by @​alex-grover in expressjs/cors#207
• Added new link & website in the README by @​manjunath00 in expressjs/cors#269
• Fix functions call with extra parameter by @​LuisEGR in expressjs/cors#245
• 🐛 Fix readme status badge by @​homersimpsons in expressjs/cors#306
• chore: add support for OSSF scorecard reporting by @​inigomarquinez in expressjs/cors#321
• ci: fix errors in ci github action for node 8 by @​inigomarquinez in expressjs/cors#322
• test: improved test robustness by @​Alex-GF in expressjs/cors#320
• chore: upgrade scorecard workflow pinned action versions by @​carpasse in expressjs/cors#341
• ci: add CodeQL (SAST) by @​bjohansebas in expressjs/cors#340
• docs: remove broken link to demo site by @​dpopp07 in expressjs/cors#344
• OSSF Scorecard recommendations by @​UlisesGascon in expressjs/cors#350
• build(deps): bump github/codeql-action from 3.24.7 to 3.28.19 by @​dependabot[bot] in expressjs/cors#351
• build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by @​dependabot[bot] in expressjs/cors#353
• build(deps): bump actions/checkout from 4.1.1 to 4.2.2 by @​dependabot[bot] in expressjs/cors#354
• build(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.2 by @​dependabot[bot] in expressjs/cors#355
• build(deps-dev): bump express from 4.17.1 to 4.21.2 by @​dependabot[bot] in expressjs/cors#356
• build(deps): bump actions/upload-artifact from 4.5.0 to 4.6.2 by @​dependabot[bot] in expressjs/cors#352
• build(deps-dev): bump mocha from 9.1.1 to 9.2.2 by @​dependabot[bot] in expressjs/cors#358
• update the docs for per request config by @​jonchurch in expressjs/cors#338
• (fix): readme updated for #271 origin option for * by @​dhananjaysa92 in expressjs/cors#289
• ci: upgrade Node versions by @​UlisesGascon in expressjs/cors#359
• chore: add funding to package.json by @​bjohansebas in expressjs/cors#363
• build(deps): bump github/codeql-action from 3.28.19 to 4.31.2 by @​dependabot[bot] in expressjs/cors#371
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @​dependabot[bot] in expressjs/cors#370
• docs: Cleanup README by @​efekrskl in expressjs/cors#374
• chore: add node v25 by @​imangas in expressjs/cors#375
• Extend CI test matrix by @​imangas in expressjs/cors#376
• docs: simplify code examples with header comments by @​jonchurch in expressjs/cors#386
• docs: tweak intro, add note w/ browser enforcement, FAQ by @​jonchurch in expressjs/cors#385
• chore: remove HISTORY.md and nonexistent CONTRIBUTING.md from tarball by @​Phillip9587 in expressjs/cors#388
• Release: 2.8.6 by @​UlisesGascon in expressjs/cors#390

New Contributors

• @​smondal made their first contribution in expressjs/cors#189
• @​dstudzinski made their first contribution in expressjs/cors#180
• @​shackpank made their first contribution in expressjs/cors#175
• @​jkasun made their first contribution in expressjs/cors#200
• @​alex-grover made their first contribution in expressjs/cors#207
• @​manjunath00 made their first contribution in expressjs/cors#269
• @​LuisEGR made their first contribution in expressjs/cors#245
• @​homersimpsons made their first contribution in expressjs/cors#306
• @​inigomarquinez made their first contribution in expressjs/cors#321
• @​Alex-GF made their first contribution in expressjs/cors#320
• @​carpasse made their first contribution in expressjs/cors#341

... (truncated)

Changelog

Sourced from cors's changelog.

2.8.6 / 2026-01-22

• Improve documentation (API, context, examples...)
• Remove additional markdown files from tarball

Commits

• f00a8c1 2.8.6 (#390)
• 848e2bd chore: remove HISTORY.md and nonexistent CONTRIBUTING.md from tarball (#388)
• cf8947e docs: tweak intro, add note w/ browser enforcement, FAQ (#385)
• bbf62a5 docs: simplify code examples with header comments (#386)
• f442e77 Extend CI test matrix (#376)
• d5cf6cd ci: add support for node@25 (#375)
• 7e6f7ee docs: revamp content (#374)
• b25644c build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#370)
• f881e91 build(deps): bump github/codeql-action from 3.28.19 to 4.31.2 (#371)
• 9a9a760 chore: add funding to package.json (#363)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for cors since your current version.

Updates electron-log from 5.4.3 to 5.4.4

Commits

• afa8fc2 5.4.4
• e4e6557 fix(ci): latest electron version breaks CI tests (#484)
• 73319b4 feat: add exports field to package.json for ESM subpath resolution (#483)
• 46a6de3 5.4.3
• 14c3a95 chore(init): Warn on double initialization fixes #475
• c9dd519 chore(docs): Update types in console.md and file.md (#474)
• See full diff in compare view

Updates express-rate-limit from 8.5.2 to 8.7.1

Release notes

Sourced from express-rate-limit's releases.

v8.7.1

You can view the changelog here.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

v8.6.1

You can view the changelog here.

v8.6.0

You can view the changelog here.

Commits

• c2e30b3 8.7.1
• b40a390 v8.7.1 changelog
• ccbee88 fix: correct es2020/es2022 version mismatch between tsconfig and esbuild comm...
• 11a143a chore: fix duplicate entries in pnpm-lockfile.yaml (#685)
• 92f685d chore(deps): bump softprops/action-gh-release from 1 to 3 (#692)
• 0c7c066 chore(deps): bump actions/checkout from 4.4.0 to 7.0.1 (#694)
• 9735b69 chore(deps): bump pnpm/action-setup from 3.0.0 to 6.1.0 (#695)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.