build(deps): bump @dicebear/core from 9.4.3 to 10.3.0 in /web

[dependabot]

Bumps @dicebear/core from 9.4.3 to 10.3.0.

Release notes

Sourced from @​dicebear/core's releases.

DiceBear 10.3 - Release Notes

For 10.3 we searched public code on GitHub to find which language was calling the DiceBear API the most without a native library of its own. The answer was Dart, mostly from Flutter apps: DiceBear now speaks Dart 🎯

That makes six official implementations: JavaScript, PHP, Python, Rust, Go, and now Dart. The API is the same in all of them, and the same seed and style definition produce byte-identical SVGs everywhere.

🎯 Dart Support

DiceBear is now available as a Dart package (Dart 3.4+), and it runs in Flutter apps too. As with the other languages, you need two packages: the core library dicebear_core and the avatar style definitions dicebear_styles. Each style is a string constant in its own library, so a compiled app only embeds the styles it actually imports.

• https://www.dicebear.com/how-to-use/dart-library/
• https://pub.dev/packages/dicebear_core
• https://pub.dev/packages/dicebear_styles

Example:

dart pub add dicebear_core
dart pub add dicebear_styles

import 'package:dicebear_core/dicebear_core.dart';
import 'package:dicebear_styles/lorelei.dart';
final style = Style.parse(lorelei);
final avatar = Avatar(style, {
'seed': 'Felix',
// ... other options
});
final svg = avatar.svg;

🧩 The same Avatar(style, …) call everywhere

Dart, Rust, and Go already required you to wrap a definition in a Style before building an avatar. With this release the JavaScript, PHP, and Python libraries move the same way, so every port now constructs an avatar with the same Avatar(style, options) call.

Passing a raw style definition straight to Avatar is therefore deprecated in JavaScript, PHP, and Python. Wrap it in a Style first:

import { Style, Avatar } from '@dicebear/core';
import lorelei from '@dicebear/styles/lorelei.json' with { type: 'json' };
const style = new Style(lorelei);
const avatar = new Avatar(style, { seed: 'Felix' });

The old definition input still works and renders identically, but it now emits a deprecation warning (a one-time console.warn in JS, E_USER_DEPRECATED in PHP, DeprecationWarning in Python) and will be removed in v11. Building the Style once also lets you reuse it across many avatars instead of re-validating the definition every time.

... (truncated)

Changelog

Sourced from @​dicebear/core's changelog.

[10.3.0] - 2026-06-13

Added

• Core: Every rendered SVG now starts with the generator comment <!-- Generated by DiceBear (https://dicebear.com) --> as the first child of the root <svg> element. The comment is byte-identical across the JavaScript, PHP, Python, Rust, Go, and Dart libraries. The byte output of every avatar changes as a result, including data URIs and content hashes, so consumers that compare rendered SVGs against stored snapshots need to update them. SVG optimizers that strip comments (e.g. SVGO with default settings) remove it again.
• Dart library: A new Dart implementation (the dicebear_core package) that produces identical output to the JavaScript library when given the same styles and options. It validates style definitions and options against the shared schemas (via dicebear_schema) and pairs with the dicebear_styles package.
• Core (PHP, Python): Added Style::fromJson() (PHP) and Style.from_json() (Python) to build a style from a raw JSON string without a separate json_decode(..., true) / json.loads(...) call. Malformed JSON raises the language's native parse error (JsonException / json.JSONDecodeError); an invalid definition raises the usual StyleValidationError. Mirrors Style::from_str (Rust) and Style.parse (Dart); the existing array/dict constructor is unchanged.

Deprecated

• Core (JS, PHP, Python): Passing a raw style definition to Avatar is deprecated; pass a Style instead (new Avatar(new Style(definition), options)), which also lets you reuse one parsed style across many avatars. The definition still works for now and renders identically, but emits a deprecation warning (a one-time console.warn in JS, E_USER_DEPRECATED in PHP, DeprecationWarning in Python) and will be removed in v11. The Dart, Rust and Go libraries already require a Style, so this brings every port to the same Avatar(style, …) call.

[10.2.0] - 2026-06-10

Added

• Go library: A new Go implementation (the github.com/dicebear/dicebear-go/v10 module) that produces identical output to the JavaScript library when given the same styles and options.

Fixed

• Core: Color.luminance() now derives the sRGB linearization from a precomputed lookup table (one entry per 8-bit channel value) instead of calling pow at runtime. pow is not required to be correctly rounded and

... (truncated)

Commits

• 19387fd v10.3.0
• fa2d087 fix: keep the Dart and Python packages green on their CI lower bounds
• 5b5aaff refactor: improve clarity and consistency in component descriptions and comments
• 5f52e37 feat(core)!: require a Style when constructing an Avatar (deprecate raw defin...
• c17bcb7 docs: construct an explicit Style in the JS examples
• 56b7576 feat(core): add Style::fromJson (PHP) and Style.from_json (Python)
• 8120316 feat(dart): add the Dart core port (dicebear_core)
• 3b37bfe Add a DiceBear generator comment to rendered avatars
• 00c0149 docs: update README
• d0931c8 Polish docs wording and apply Prettier formatting
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.