[dependabot]

Bumps the minor-and-patch group with 10 updates:

Package	From	To
minimatch	11.0.4	11.0.5
node-llama-cpp	3.22.2	3.22.3
officeparser	8.5.0	8.6.0
@playwright/test	1.64.1	1.65.0
@tailwindcss/postcss	4.3.4	4.3.5
electron	45.2.2	45.2.3
framer-motion	14.9.0	14.10.1
lucide-react	1.67.0	1.70.0
tailwindcss	4.3.4	4.3.5
webpack-bundle-analyzer	5.4.1	5.4.2

Updates minimatch from 11.0.4 to 11.0.5

Commits

• ea0a4a6 11.0.5
• e83fdf3 match large numeric brace ranges without expanding them
• 85d681c fixup! ci: update github actions to latest major versions
• a675e79 ci: update github actions to latest major versions
• 70f442d dedupe level 2 patterns without a pairwise compare
• b2d7c28 ci: increase timeout on test
• 2d5578b throw when **/.. pattern expansion goes above the limit
• 9c6ebb1 fix: reject incomplete glob split expansions
• 73f0e1b fix: bound total cells added by the glob split pass
• See full diff in compare view

Updates node-llama-cpp from 3.22.2 to 3.22.3

Release notes

Sourced from node-llama-cpp's releases.

v3.22.3

3.22.3 (2026-11-05)

Bug Fixes

• LlamaJsonSchemaGrammar.parse: count Unicode code points for minLength and maxLength checks (#675) (8030e0d)
• correct riscv64 package metadata (#677) (8354dff)

---

Shipped with llama.cpp release v0.9.0

To use the latest llama.cpp release available, run npx -n node-llama-cpp source download --release latest. (learn more)

Commits

• fe3e594 build: skip electron download in the CI (#688)
• aa6b5c4 chore: update modules (#687)
• 8354dff fix: correct riscv64 package metadata (#677)
• 8030e0d fix(LlamaJsonSchemaGrammar.parse): count Unicode code points for `minLength...
• See full diff in compare view

Updates officeparser from 8.5.0 to 8.6.0

Release notes

Sourced from officeparser's releases.

v8.6.0: 🧩 Template Checks, Form Fields & pdf.js Side by Side

I am pleased to announce the release of officeParser v8.6.0! Templates can list their tags and check data before a render, form fields in Word and OpenDocument files are read instead of dropped, sections that restart their page numbers keep them, and PDF parsing works beside an application's own pdf.js of another version.

Thanks to @​setthase, whose report drove the pdf.js fix in this release.

---

🌟 Key Highlights

1. Listing tags and checking data

OfficeTemplate.tags() lists a template's fields and block tags, with their parts, paths, filters and loops, with no data needed. OfficeTemplate.check() reads your data against the template without rendering and returns every problem a render with onMissing: 'error' would reject for, all at once, each with its part and loop pass:

const problems = await OfficeTemplate.check('invoice.docx', { data });
// [{ code: 'TEMPLATE_FIELD_MISSING', field: 'line.qty', loops: [{ list: 'lines', index: 1 }], ... }]

2. pdf.js of another version in the same process (#128)

parseOffice rejected every PDF ("The API version ... does not match the Worker version") when an application's own pdfjs-dist of another version had loaded first. officeParser now runs pdf.js's worker on a module of its own, in either load order. pdfjs-dist stays pinned to the version officeParser is tested with; the README explains why.

3. Form fields in DOCX, ODT and ODP

Word's legacy check boxes read as ☒ or ☐ and its drop-downs as the selected entry. OpenDocument check boxes, radio buttons, text fields, list and combo boxes read as they show. All were dropped before. The native PDF engine draws ☐ ☑ ☒ as boxes when no font has them, instead of ?.

4. Page numbers that restart

A Word, RTF or ODT section that restarts its page numbers (a body at 1 after front matter) is read into PageSetup.pageNumberStart and numbered so in DOCX, ODT, RTF, LaTeX and the native PDF engine.

5. Sheet tabs without JavaScript

A workbook's HTML switches sheets by CSS where its script does not run: scripts off, a sandboxed frame, or a fragment inserted into a page.

---

🔧 Also Fixed

• A pdf.js document your own code opens no longer moves PDF parses out of the separate process.
• pdf.js documents your own code opens no longer print warnings after an in-process parse.
• A preloaded pdf.js worker parses in the browser under allowRemoteAssets: false.
• PDF_NO_TEXT_EXTRACTED says how much text was read and names fonts with no character map.
• HTML workbooks show one sheet at a time in frames that block storage.

---

📝 On the blog: Two Versions of pdf.js in One Process and Form Fields That Were Never Text.

---

🛠 Getting Started

npm install officeparser@8.6.0
</tr></table> 

... (truncated)

Changelog

Sourced from officeparser's changelog.

[8.6.0] - 2026-11-05

Added

• OfficeTemplate.tags() lists a template's tags. Each field, and each tag opening a block or a branch, with the part holding it, the paths it reads, a field's filters, a loop's item and the loops it is inside (TemplateTagInfo). No data is needed.
• OfficeTemplate.check() checks data against a template without rendering. It returns every problem a render with onMissing: 'error' would reject for, all at once: a missing field (TEMPLATE_FIELD_MISSING) or a value that does not fit its tag (TEMPLATE_DATA_INVALID), each with its part and the loops and passes it was read in (TemplateProblem, TemplateLoopPlace). It follows the data as a render does: the branch each condition picks and every pass of every loop. A batch gives one list per entry; past 1,000 problems for an entry or 10,000 for a batch it stops, with a TEMPLATE_CHECK_LIMITED warning.
• HTML: a workbook's sheet tabs switch sheets without JavaScript. CSS :target shows the sheet a tab links to where the script does not run (scripts off, a sandboxed frame, a fragment inserted into a page); the script still switches sheets wherever it runs. A host that leaves the script out and switches sheets itself sets data-sheet-script on .spreadsheet-container.

Fixed

• PDF parses work beside an application's own pdfjs-dist of another version. In Node, parseOffice rejected every PDF with "The API version ... does not match the Worker version" when the application's pdf.js had loaded first, and the application's pdf.js got officeParser's worker when officeParser's had. Wherever pdf.js's worker file is found, officeParser now runs pdf.js's worker on a module of its own, in the separate process or in this one, in either order. pdfjs-dist stays pinned to one version: the README says why. (#128)
• A pdf.js document your own code opens no longer moves PDF parses into this process. Its worker module, loaded in the process, was taken for a worker you preloaded, so later parses ran pdf.js here without the separate process's memory limit. A worker preloaded as globalThis.pdfjsWorker is used only where pdf.js's worker file cannot be found.
• pdf.js documents your own code opens no longer print pdf.js's warnings after a parse with separateProcess: false. Where pdf.js's worker file is found, their worker keeps its own warning level.
• In a browser, a preloaded pdf.js worker parses under allowRemoteAssets: false. It was refused with REMOTE_ASSET_BLOCKED, though nothing was fetched.
• PDF_NO_TEXT_EXTRACTED says how much text was read. A PDF with a little text was called very likely scanned; the message now gives the characters and pages read, and where the text is in fonts with no character map it names them (details.fonts).
• Word, RTF and ODT sections that restart their page numbers are read. PageSetup.pageNumberStart is set from w:pgNumType w:start, \pgnrestart/\pgnstartsN and style:page-number, so a body restarting at 1 after its front matter is numbered 1, 2, 3 in DOCX, ODT, RTF and LaTeX output and the native PDF engine.
• DOCX: Word's legacy form fields are read. A check box reads as ☒ or ☐ and a drop-down as its selected entry; both were dropped.
• ODT and ODP: form controls are read as they show. Check boxes and radio buttons as ☒ or ☐ with their labels, text fields and areas as their values, list and combo boxes as their selected items, and LibreOffice's check box and drop-down fields too; all were dropped. A control shown in many places is read once: whole the first time, and as one run, its line breaks as spaces, at each later place, within decompressionLimits.maxRepeatedContent.
• The native PDF engine draws ☐ ☑ ☒ when no font has them. They are drawn as boxes in the text's size and colour, and copy and search as their characters; they were ? and reported as text that could not be encoded.
• HTML: a workbook in a frame that blocks storage shows one sheet at a time. Switching sheets failed and left two showing; tabs and column resizing now work there, without remembering widths.

Commits

• b47195d blog: revisions from the 8.6.0 audit: PDF_FONT_UNMAPPED, a sample's row and c...
• 15cfdcc blog: two posts for 8.6.0, two versions of pdf.js in one process and form fie...
• 798de66 chore(release): 8.6.0 changelog, version, docs, site, baselines and browser b...
• d555525 docs(readme): the native PDF engine needs pdf-lib installed, as the PDF secti...
• daa59be fix(site): links in the specs and repository pages are readable in dark mode
• 67598d8 docs(site): the site's README copy follows the README
• f0157b3 docs(pdf): a bundle that inlines pdf.js shares the library's worker with any ...
• 9912654 docs(readme): say why pdfjs-dist is pinned exactly, and that an application's...
• 080c289 fix(pdf): in-process PDF parses run pdf.js's worker of their own, beside a ho...
• 638f3b2 fix(odt): a form control named again is one run, costing what a span costs, i...
• Additional commits viewable in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates @tailwindcss/postcss from 4.3.4 to 4.3.5

Release notes

Sourced from @​tailwindcss/postcss's releases.

v4.3.5

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Changelog

Sourced from @​tailwindcss/postcss's changelog.

[4.3.5] - 2026-11-06

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Commits

• 9b2c925 4.3.5 (#20672)
• See full diff in compare view

Updates electron from 45.2.2 to 45.2.3

Release notes

Sourced from electron's releases.

electron v45.2.3

Release Notes for v45.2.3

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Dawn, FFmpeg, minigbm, PDFium, Skia and V8. #55592

Documentation

• Documentation changes: #55600

Commits

• d0a18d0 chore: cherry-pick 120 changes from angle, chromium, dawn, ffmpeg, minigbm, p...
• a63e65b docs: drop Experimental label from deprecated BrowserView APIs (#55600)
• See full diff in compare view

Updates framer-motion from 14.9.0 to 14.10.1

Changelog

Sourced from framer-motion's changelog.

[14.10.1] 2026-11-05

Fixed

• animate: Fix not recognising timeline of only nested sequences as timeline.
• Various performance-related improvements.

[14.10.0] 2026-11-05

Added

• press: count, hold and repeat, for double/triple press, long press and multipress gestures.
• drag: Expose getProps on the dragConstraints function context.
• drag: x/y props for headless gesture tracking.
• Reorder: Home and End buttons move selected item to beginning and end of list, respectively.
• motion: New tap prop for configuring press gesture.

Fixed

• animate: Minor fixes.

[14.9.1] 2026-11-04

Added

• Ensure accelerated transform animations finish correctly.
• AnimatePresence: Fix exit never starting when a child mounts already exiting.
• AnimatePresence: Fix exit stuck after an open layoutId card switches to another item.
• Ensure accelerated animations are cleaned up in WebKit.

Commits

• 78f3ff5 v14.10.1
• 5243b32 Updating changelog
• a404e1a Merge pull request #4070 from motiondivision/claude/project-thread-e45kg1
• cfdf2ef Merge branch 'main' into claude/project-thread-e45kg1
• 94097e4 Merge pull request #4067 from motiondivision/lean/5-binding
• d95cc90 Merge pull request #4066 from motiondivision/lean/4-spans
• 5797936 Fix timing flake in "built when played after a pause" test
• 7a0a081 Merge remote-tracking branch 'origin/main' into claude/project-thread-kgyuj9
• 16320ad Merge pull request #4065 from motiondivision/lean/2-value
• 1c9194b Raise framer-motion size budgets to current sizes
• Additional commits viewable in compare view

Updates lucide-react from 1.67.0 to 1.70.0

Release notes

Sourced from lucide-react's releases.

Version 1.70.0

What's Changed

• fix(site): fix vercel.json redirects that land on 404 by @​ericfennis in lucide-icons/lucide#5157
• feat(icons): added square-dashed-search icon by @​domarku in lucide-icons/lucide#5119
• fix(lucide-react-native): emit runtime files for alias icon subpaths by @​tlq5l in lucide-icons/lucide#5055
• feat(icons): added moped icon by @​jamiemlaw in lucide-icons/lucide#3373
• feat(icons): added user-exclamation-point, user-round-exclamation-point icons by @​ericfennis in lucide-icons/lucide#5144
• feat(icons): added grid-3x3-off icon by @​gridalchemy in lucide-icons/lucide#5071

New Contributors

• @​domarku made their first contribution in lucide-icons/lucide#5119
• @​tlq5l made their first contribution in lucide-icons/lucide#5055
• @​gridalchemy made their first contribution in lucide-icons/lucide#5071

Full Changelog: lucide-icons/lucide@1.69.0...1.70.0

Version 1.69.0

What's Changed

• feat(icons): added package-pen icon by @​ericfennis in lucide-icons/lucide#5154
• feat(icons): added package-question-mark icon by @​ericfennis in lucide-icons/lucide#5155
• feat(icons): added opacity icon by @​ilyavred in lucide-icons/lucide#4222
• feat(icons): added circle-fading-check icon by @​n2duc in lucide-icons/lucide#4089

New Contributors

• @​ilyavred made their first contribution in lucide-icons/lucide#4222
• @​n2duc made their first contribution in lucide-icons/lucide#4089

Full Changelog: lucide-icons/lucide@1.68.0...1.69.0

Version 1.68.0

What's Changed

• fix(site): keep sponsor tiers within content width by @​ffgenius in lucide-icons/lucide#5149
• feat(icons): added mango icon by @​Prsenapati09 in lucide-icons/lucide#4902
• chore(icons): Renamed *-warning and *-alert to *-exclamation-point by @​ericfennis in lucide-icons/lucide#5143

New Contributors

• @​ffgenius made their first contribution in lucide-icons/lucide#5149
• @​Prsenapati09 made their first contribution in lucide-icons/lucide#4902

Full Changelog: lucide-icons/lucide@1.67.0...1.68.0

Commits

• See full diff in compare view

Updates tailwindcss from 4.3.4 to 4.3.5

Release notes

Sourced from tailwindcss's releases.

v4.3.5

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Changelog

Sourced from tailwindcss's changelog.

[4.3.5] - 2026-11-06

Fixed

• Canonicalization: improve performance in projects with many functional variant values (e.g. a matchVariant plugin with thousands of values) (#20663)
• Don't crash or create a fallback with the wrong color for a color-mix(…) without a color interpolation method (e.g. color-mix(var(--color-red-500)) or color-mix(currentcolor 50%, transparent)) (#20658, #20666)
• Ensure @tailwindcss/oxide-wasm32-wasi loads instead of hanging forever (e.g. with NAPI_RS_FORCE_WASI=error or in WebContainers) (#20667)
• Remove as: '*.css' from the @tailwindcss/turbopack setup in its README, because it breaks CSS modules (#20660)
• Ignore <!-- and --> between top-level rules in CSS instead of throwing or swallowing the next rule (e.g. a { color: red } --> b { color: blue }) (#20665)
• Ensure @tailwindcss/oxide-wasm32-wasi detects changed and new source files after the first scan (e.g. in WebContainers) (#20487)
• Prevent type errors with skipLibCheck: false caused by imports of unshipped modules in the @tailwindcss/node type declarations (#20632)

Commits

• 9b2c925 4.3.5 (#20672)
• e0f76e9 Skip the color-mix(…) polyfill without a color interpolation method (#20666)
• 8c74689 Ignore \<!-- and --> between top-level rules in the CSS parser (#20665)
• 669fcc1 Don't crash on a color-mix(…) with a single color and no interpolation meth...
• 7edc50e Canonicalization: don't sort all parsed variants when compiling a single cand...
• See full diff in compare view

Updates webpack-bundle-analyzer from 5.4.1 to 5.4.2

Release notes

Sourced from webpack-bundle-analyzer's releases.

v5.4.2

Patch Changes

• Keep the drive letter of absolute Windows module paths and the server of UNC module paths, so modules that only differ by their drive or server are no longer merged into one node in the report. (by @​PerryLink in #747)

Changelog

Sourced from webpack-bundle-analyzer's changelog.

5.4.2

Patch Changes

• Keep the drive letter of absolute Windows module paths and the server of UNC module paths, so modules that only differ by their drive or server are no longer merged into one node in the report. (by @​PerryLink in #747)

Commits

• 622f27d chore(release): new release (#748)
• 093392b fix: keep the drive letter of absolute Windows module paths (#747)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions