Repository navigation
fix(deps): update dependency @adobe/spectrum-wc - #194
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate
branch
from
November 2, 2026 15:37
c7fd8e9 to
3ec791c
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate
branch
from
November 4, 2026 17:14
3ec791c to
2a2fde9
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate
branch
from
November 4, 2026 21:26
2a2fde9 to
439a5ef
Compare
renovate
Bot
force-pushed
the
renovate
branch
from
November 6, 2026 05:37
439a5ef to
8c643c4
Compare
renovate
Bot
force-pushed
the
renovate
branch
from
November 9, 2026 22:32
8c643c4 to
0417a65
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate
branch
from
November 10, 2026 21:58
0417a65 to
cdc7e5e
Compare
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
2.0.0-beta.6→2.0.0-beta.75.61.0→5.64.0>=24.22.1 <25→>=24.22.1 <279.0.6→9.0.77.2.4→7.2.5Release Notes
adobe/spectrum-web-components (@adobe/spectrum-wc)
v2.0.0-beta.7Compare Source
Minor Changes
card:
258169dThanks @aramos-adobe! - feat(card):<swc-card>now exposes--swc-card-base-grid-template-rowsto override the row track sizes of its media, content, and footer grid areas. Defaults toauto 1fr auto.upload-attachment:
#6767
258169dThanks @aramos-adobe! - feat(upload-attachment):type="media"now composesswc-card(variant="quiet") internally instead of hand-rolled surface markup, reusing itspreview/mediaslot and grid machinery. The public slot API (thumbnail,badge,title,subtitle,actions) is unchanged.Added:
progress(0-100): shows aswc-progress-circleoverlay on thetype="media"preview while an upload is in flight. Hidden when unset or at 100 (complete); thethumbnailslot is hidden while loading so the overlay reads against a plain background instead of stacking on the image. The overlay itself is delayed by 1 second afterprogressis first set, so a fast upload doesn't flash the loading state.size(m/l, defaultm): 64px vs. 96px tile fortype="media". Has no effect ontype="card".Removed/renamed custom properties (
type="media"sizing is now driven bysizeinstead):--swc-upload-attachment-preview-sizeremoved; usesize="m"/size="l".--swc-upload-attachment-card-thumbnail-inline-sizeand--swc-upload-attachment-card-thumbnail-block-sizemerged into--swc-upload-attachment-card-thumbnail-size.--swc-upload-attachment-dismiss-icon-inline-sizeand--swc-upload-attachment-dismiss-icon-block-sizemerged into--swc-upload-attachment-dismiss-icon-size.Also composes
swc-assetinto thethumbnailslot in docs/examples for image loading, fit, and background handling, and documents thatbadgeshould only be used atsize="l"and above (it crowds the default 64pxsize="m"tile).Added VRT coverage (
test/vrt/upload-attachment.vrt.ts,test/vrt/upload-attachment-custom-properties.vrt.ts) for both types, both sizes, the badge and progress overlays, title truncation/subtitle overflow, forced:focus-visible, forced colors, and CJK text.Patch Changes
avatar:
6d781e9Thanks @cdransf! - fix(avatar): Changed the defaultsizeof<swc-avatar>from500(40 px) to100(24 px), the same size value as 1st-gen's default (20pxthere) and the React Spectrum S2 default. Usesize="75"for20px. Invalidsizevalues now fall back to100. To keep the previous default, setsize="500".button, close-button:
5126fecThanks @rise-erpelding! - fix(button, close-button): Fixed static-white and static-black secondary and outlineswc-buttonlabels andswc-close-buttonicons to use opaque white or black in default, hover, pressed, and focus-visible states, improving contrast and keeping their colors consistent. Border, background, focus-indicator, and disabled-state colors are unchanged.prompt-field:
#6769
9aed44dThanks @rubencarvalho! - fix(prompt-field): Attachment-strip fixes for<swc-prompt-field>.>moves the tile that is partly hidden at the trailing edge to the start, and<does the same in reverse. It also reaches both ends of the strip when a tile is wider than the space between the chevrons. After paging, Tab moves to the first tile that is shown, not to a tile in the middle of the strip. A tile whose edge only reaches into the lighter half of an edge fade counts as shown.Also routes the
size="s"variant's property overrides through private custom properties instead of re-declaring the properties in the variant selector (no visual change).tabs:
#6811
0e9d1e4Thanks @rubencarvalho! - fix(tabs):<swc-tabs>now links tabs that are added after the initial render to their panels.The tab panels were only linked when the
tab-panelslot changed, and<swc-tab>only got itsidafter its first render. When the slotted tabs were swapped out and the panels stayed, the new tabs had noaria-controlsand the panels kept anaria-labelledbythat pointed to the removed tabs.<swc-tab>now sets itsroleandidwhen it connects, and<swc-tabs>relinks the panels when the tabs change. It clears a stalearia-labelledbywhen no matching tab remains and a stalearia-controlswhen no matching panel remains, but keeps values that you set yourself.#6643
5b6abf5Thanks @rubencarvalho! - docs(*): The published Custom Elements Manifest now expands referenced type aliases into their literal values via@wc-toolkit/type-parser. Properties typed as a union alias (e.g.variant,fill-style,static-color) now list their allowed values in the Storybook API table and generate aselectcontrol automatically, without inlining the union in source or hand-wiringargTypes.optionsper story. Aliases reaching a component through a mixin, and default values of accessor-backed properties, are resolved as well. Structural expansions are no longer written to the manifest, because they embedded compiler-internal symbol ids that made the published artifact non-reproducible.#6880
e9fd2c0Thanks @miwha-adobe! - Remove duplicate CSS custom property entries from the published Custom Elements Manifest for Button, Illustrated message, Tab, and Tabs so API reference tables show each property once. Component runtime behavior does not change.algolia/algoliasearch-client-javascript (algoliasearch)
v5.64.0Compare Source
v5.63.0Compare Source
algoliaDefinedordering in external sources (#7212) by @aiordachenodejs/node (node)
v26.13.1: 2026-11-11, Version 26.13.1 'Lithium' (LTS), @aduh95Compare Source
This is a security release.
Notable Changes
Commits
7b777661f5] - build: respect OpenSSL's configured API level (Filip Skokan) #669534518c7501f] - crypto: fix builds with older OpenSSL 3.0 (Filip Skokan) #6693194b73673b8] - deps: brotli: cherry-picke230f47(liujiahui) #61003e315236158] - deps: update llhttp to 9.4.4 (Antoine du Hamel) nodejs-private/node-private#10388e714f7daa] - deps: update undici to 8.12.4 (Node.js GitHub Bot) #67272af48b1a4d5] - deps: update brotli to 1.2.1 (Node.js GitHub Bot) #6699060316405bb] - deps: update undici to 8.12.3 (Node.js GitHub Bot) #6699389b17baef4] - deps: update sqlite to 3.54.1 (Node.js GitHub Bot) #66816d14db811c7] - http: redact proxy credentials in invalid proxy URL errors (Matteo Collina) nodejs-private/node-private#10019183db64fe] - http2: retain streams during pending writes (Matteo Collina) nodejs-private/node-private#104062ae278a23] - http2: charge inbound DATA retained by streams to maxSessionMemory (Matteo Collina) nodejs-private/node-private#10007df134e2ce] - http2: retain buffers until socket writes finish (Matteo Collina) nodejs-private/node-private#10170ff0cf6749] - http2: release headers when a stream is removed (Matteo Collina) nodejs-private/node-private#1026a84a01ddb8] - http2: avoid overflowing ALTSVC buffers (Matteo Collina) nodejs-private/node-private#10353fc67dc056] - http2: detect streams abandoned by nghttp2 (Matteo Collina) #66641df4011dafe] - http2: guard against null write request on cancelled stream (Matteo Collina) #67252fa61009dc1] - https: isolate Agent TLS policy keys (Matteo Collina) nodejs-private/node-private#103640d3d8ddca] - permission: do not leak denied descendants in recursive fs.watch (RafaelGSS) nodejs-private/node-private#9676c85b8e371] - tls: fix remotely reachable TLS server crash (Tim Perry) nodejs-private/node-private#1018a8d6286949] - tls: disable resumption for mTLS with no session id context (Tim Perry) nodejs-private/node-private#1030e750e1fa02] - tls: don't allow renegotiation or HRR to change SNI (Tim Perry) nodejs-private/node-private#103097b1357f08] - tls: don't allow TLS resumption to change SNI (Tim Perry) nodejs-private/node-private#103066e72ec604] - tls: apply the CA of SNI contexts without a certificate (Matteo Collina) nodejs-private/node-private#1020940cae5c33] - tls,http: prevent nested parser execution from empty writes (Matteo Collina) nodejs-private/node-private#10218232390dd8] - tools: use vendored trust store inshell.nix(Antoine du Hamel) #673186c223db6e2] - zlib: handle params callback after destroy (Matteo Collina) nodejs-private/node-private#1037v26.13.0: 2026-10-28, Version 26.13.0 'Lithium' (LTS), @richardlauCompare Source
Notable Changes
This release marks the transition of Node.js 26.x into Long Term Support (LTS)
with the codename 'Lithium'. It will continue to receive updates through to
the end of April 2029.
Other than updating metadata, such as the
process.releaseobject, to reflectthat the release is LTS, no further changes from Node.js 26.12.1 are included.
If you are updating from an earlier Long Term Support release (e.g. Node.js 24
or 22 or earlier) please note that since Node.js 25 the official binaries for
Linux are linked against libatomic, which may need to be installed separately
depending on your Linux distribution.
v26.12.1: 2026-10-21, Version 26.12.1 (Current), @aduh95 prepared by @RafaelGSSCompare Source
This is a security release.
Notable Changes
BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) – High0ed4268(Evgenii Kliuchnikov) – High93cd21e(Joyee Cheung)Commits
818e4ca061] - crypto: update root certificates to NSS 3.131.1 (Antoine du Hamel) #66877fd3c87ed43] - crypto: harden X.509 conversion and formatting (Filip Skokan) nodejs-private/node-private#966acffa610db] - crypto: reset random caches across snapshots (Filip Skokan) nodejs-private/node-private#9877895a5cd2d] - deps: update undici to 8.12.2 (Node.js GitHub Bot) #6672112daa54d2e] - deps: V8: backport93cd21e(Joyee Cheung) nodejs-private/node-private#9996a8b3db7e2] - deps: update c-ares to 1.34.9 (Node.js GitHub Bot) #66868a6040b50d9] - deps: brotli: cherry-pick0ed4268(Evgenii Kliuchnikov) nodejs-private/node-private#10026b78ea171d] - dns: validate resolve inputs for null bytes (James M Snell) nodejs-private/node-private#9840683ee5f7d] - http: ensure agent data guard works without I/O (James M Snell) nodejs-private/node-private#983e5cae10148] - Revert "module: synchronously load most ES modules" (Antoine du Hamel) #66786cc244131aa] - permission: check permission model in realpathSync (RafaelGSS) nodejs-private/node-private#9730392385841] - src: exposeBROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH(Antoine du Hamel) nodejs-private/node-private#1002c273a408c9] - src: fix the fs permission tree node on wildcard nodes (James M Snell) nodejs-private/node-private#986a2caddd20e] - tls: reject chains containing blocked public keys (Ulises Gascon) #66871ad788ccd07] - tls: reject non-canonical IP addresses (Matteo Collina) nodejs-private/node-private#982cd4b05469c] - tls: fix ip normalization regression (James M Snell) nodejs-private/node-private#9855fa440e0d7] - tools: retry Gatekeeper check and stapling after notarization (Ryan Aslett) #66855745ad77156] - zlib: avoid caching invalid ZIP local headers (Matteo Collina) nodejs-private/node-private#981v26.12.0: 2026-10-14, Version 26.12.0 (Current), @richardlauCompare Source
Notable Changes
1ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #665337f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335Commits
30e76bb16a] - benchmark: fix input passed to subtle.digest in webcrypto-digest (Rafael Gonzaga) #66608adef72223a] - benchmark: fix buffer option in buffer read/write benchmarks (Rafael Gonzaga) #666042f498f08fe] - benchmark: add util.parseArgs benchmark (Rafael Gonzaga) #665994ce8412e18] - benchmark: fix url-searchparams-sort to sort a fresh list (RafaelGSS) #66535493bd6c66e] - benchmark,tools: fix napi benchmarks on GHA (Nigro Simone) #66423e4515552d6] - build: run QUIC CI for V8 changes (Yuya Inoue) #66602a888e51062] - build: support Python 3.15 (Mike McCready) #657502afab9a63b] - build: do not include shared gtest innodelink path (Antoine du Hamel) #66626f88c2f8ec6] - build,test: enable temporal support on no-ICU and system-ICU builds (Antoine du Hamel) #666975fd03e6fdf] - child_process: propagate config-file permission flags to children (Rafael Gonzaga) #66559f771134b07] - crypto: isolate provider EC PKCS8 encoding (Filip Skokan) #664134e00a293db] - crypto: remove key export and metadata locks (Filip Skokan) #66413bcd8018775] - crypto: remove verify setup key locking (Filip Skokan) #66413883250fee2] - crypto: remove KEM key locking (Filip Skokan) #664139d98805071] - crypto: remove RSA-OAEP key locking (Filip Skokan) #66413d6293e7bb1] - crypto: skip secret key mutex allocation (Filip Skokan) #664138d8af8003e] - crypto: keep the root cert store per Environment (Shelley Vohr) #66411c6f0614785] - crypto: remove select Web Crypto warnings (Filip Skokan) #66312e5360b5a08] - deps: update googletest to988ea2c(Node.js GitHub Bot) #666527eb230a2c1] - deps: update acorn to 8.19.0 (Node.js GitHub Bot) #66655af946ba8f3] - deps: update sqlite to 3.54.0 (Node.js GitHub Bot) #66663007872a85d] - deps: V8: cherry-pick8d14d49(Antoine du Hamel) #66627f44aec4966] - deps: update simdjson to 5.0.3 (Daniel Lemire) #666201a33e914e8] - deps: V8: cherry-pick7d5eb1d(inoway46) #665663294d51e5a] - diagnostics_channel: fix default callback context (Matteo Collina) #664815c602a5824] - doc: list futimes among fd APIs disabled by the permission model (Rafael Gonzaga) #66649eaeb4736c8] - doc: add Test Runner to list of built-in diagnostic channels (Vas Sudanagunta) #665630e1c99afae] - doc: document stream/iter behaviors and Node.js extensions (James M Snell) #66483846236367d] - doc: document URL and Uint8Array references in process.permission (Rafael Gonzaga) #66557fc3b067be7] - doc: clarify http Agent keepSocketAlive behavior (Efe Karasakal) #6625273a4e90ce2] - doc: document keepAliveTimeoutBuffer server option (Efe Karasakal) #66286bb816582af] - doc: fix request.reusedSocket timeout example (Efe Karasakal) #6628682223ab4d9] - doc: clarify revert PR label policy (Antoine du Hamel) #66529c6f59d4e8e] - doc: clarify node binary misuse after compromise (Rafael Gonzaga) #665308904178498] - doc: document linux-x64-musl build toolchain (Issac) #665231e8247a74e] - doc: run license-builder (github-actions[bot]) #66517b2773d5e4c] - doc: add missing return types in cluster.md (Daniel Pinto) #664531ebd6d3677] - (SEMVER-MINOR) doc,lib,src: throw on missing WebAssembly or RX support (Paolo Insogna) #66533c1073f31de] - ffi: fix exportArrayBuffer type check (Trivikram Kamat) #6645569148ee0ff] - fs: lock FileHandle on first read in pull() and pullSync() (James M Snell) #66483700c60a1cd] - fs: serialize FileHandle writer() async writes (James M Snell) #6648332833def1c] - http: reduce raw header name allocations (Roberto Bianchi) #664887f1937d2b9] - (SEMVER-MINOR) http: add websocketMask() and websocketUnmask() (James M Snell) #66335115731dda7] - http2: speed up response getHeaders (Roberto Bianchi) #66592447c36cb45] - lib: fix AbortSignal.any() nested composite leak (Darius) #666171722ced4b4] - lib: add --allow-fs-vfs to permission available flags (Rafael Gonzaga) #66554062ece77fc] - lib: fix benchmark record acknowledgement race (Filip Skokan) #6643005d0b14438] - lib: set exit code on failed node:bench run() (RafaelGSS) #665342cab299471] - lib: default node:bench warmup to 10 invocations (RafaelGSS) #6653683f507845d] - meta: bump nodejs/node-pr-labeler todfe5eb3(Soul Lee) #666066fbffd5ee5] - meta: bump codecov/codecov-action from 7.1.0 to 7.1.1 (dependabot[bot]) #66448bd567f8bd6] - module: fix require of imports with package map (Lazizbek Ergashev) #66565c442f471a5] - module: synchronously load most ES modules (Geoffrey Booth) #6253051f66f0134] - permission: keep explicit fs grants when dropping a covering directory (Rafael Gonzaga) #665561aa10d80e2] - process: mark process.finalization as release candidate (Matteo Collina) #66436dd4715a6ba] - querystring: fix value decoding after encoded keys (Ved Chaudhari) #665539648a6ba8e] - quic: reject closed stream writer writes with a TypeError (James M Snell) #66483d6f566baf8] - quic: give each BindingData its own allocator state (Shelley Vohr) #66411c3204c15bd] - quic: validate session close error codes (Christian Aurich Zanettini Martins) #663025b87354f5a] - quic: destroy stream on invalid promise body (Christian Aurich Zanettini Martins) #662609ef698c781] - sqlite: validate aggregate() name and options (Guilherme Araújo) #66463bbf41f8cfb] - sqlite: persist enableDefensive() across reopen (Trivikram Kamat) #6640454867cd25e] - sqlite: throw on oversized strings instead of aborting (Trivikram Kamat) #665214314cde48b] - src: release uv_fs_t in permission WildcardIfDir (Rafael Gonzaga) #665550e58916f08] - src: stop including simdjson.h from env.h (Daniel Lemire) #6662006f56a55bb] - src: use native CopyArrayBufferBytes for webstream buffer copy (René) #664002e3dd5bb63] - src: fix config file handling (Marco Ippolito) #66431cd86506bc2] - src: mark config file as stable (Marco Ippolito) #6643115ff9884e4] - stream: skip idle webstreams start and watchers (Matteo Collina) #664243f75c89fb8] - stream: add pipeToSync() failOnIncompleteClose option (James M Snell) #664836cecf140e7] - stream: do not fail the writer when pipeToSync() cannot close (James M Snell) #6648316833534b6] - stream: fix fromSync() async input error messages (James M Snell) #66483af41622ad8] - stream: reject closed fromWritable() writes with a TypeError (James M Snell) #664834b83c6c38e] - stream: accept explicit stream/iter budgets below 16384 (James M Snell) #66483f302fbd04a] - stream: reduce per-chunk overhead in stream/iter consumers (James M Snell) #664837ba60dcdbe] - stream: keep the original error when writer.fail() throws (James M Snell) #66483dcac51a7db] - stream: align pull() abort handling with the spec (James M Snell) #66483995dee6b6b] - stream: honor stream/iter protocols on function objects (James M Snell) #664836eaf91353a] - stream: do not hold back nested async data in from() (James M Snell) #6648369d44aedb4] - stream: bound pre-batched async values in from() (James M Snell) #664836b1e7c4cf1] - stream: guard shareSync() against re-entrant source reads (James M Snell) #664838a47365425] - stream: split oversized share batches under drop-oldest (James M Snell) #6648330cbc4e643] - stream: reject drop-newest backpressure in shareSync() (James M Snell) [#66483](https://redirectConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.