deps(fe): Update fe by renovate[bot] · Pull Request #183 · n0099/open-tbm

renovate · 2026-04-09T11:12:18Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/compat (source)	`^2.0.5` → `^2.1.0`
@eslint/eslintrc	`^3.3.5` → `^3.3.6`
@fontsource/noto-sans-sc (source)	`^5.2.9` → `^5.3.0`
@fortawesome/free-brands-svg-icons (source)	`^7.2.0` → `^7.3.1`
@fortawesome/free-regular-svg-icons (source)	`^7.2.0` → `^7.3.1`
@fortawesome/free-solid-svg-icons (source)	`^7.2.0` → `^7.3.1`
@nuxt/eslint (source)	`^1.15.2` → `^1.16.0`
@nuxtjs/seo (source)	`^5.1.2` → `^5.3.6`
@pinia/nuxt (source)	`^0.11.3` → `^1.0.1`
@takumi-rs/core (source)	`^0.73.1` → `^2.5.2`
@tanstack/eslint-plugin-query (source)	`^5.96.2` → `^5.101.4`
@tanstack/vue-query (source)	`^5.96.2` → `^5.101.4`
@tanstack/vue-query-devtools (source)	`^6.1.13` → `^6.1.38`
@types/bootstrap (source)	`^5.2.10` → `^5.2.11`
@types/luxon (source)	`^3.7.1` → `^3.7.2`
@types/node (source)	`^24.12.2` → `^24.13.3`
@typescript-eslint/eslint-plugin (source)	`^8.58.1` → `^8.65.0`
@typescript-eslint/parser (source)	`^8.58.1` → `^8.65.0`
@vue/eslint-config-typescript	`^14.7.0` → `^14.9.0`
@vueuse/nuxt (source)	`^14.2.1` → `^14.3.0`
dayjs (source)	`^1.11.20` → `^1.11.21`
eslint (source)	`^10.2.0` → `^10.8.0`
eslint-import-resolver-typescript	`^4.4.4` → `^4.4.5`
eslint-plugin-compat	`^7.0.1` → `^7.0.2`
eslint-plugin-vue (source)	`^10.8.0` → `^10.10.0`
nuxt (source)	`^4.4.7` → `^4.5.1`
pev2	`^1.21.0` → `^1.23.0`
pinia (source)	`^3.0.4` → `^4.0.2`
postcss-preset-env (source)	`^11.2.0` → `^11.3.2`
stylelint (source)	`^17.6.0` → `^17.14.1`
type-coverage	`^2.29.7` → `^2.30.1`
typescript (source)	`^6.0.2` → `^7.0.2`
viewerjs (source)	`^1.11.7` → `^1.11.8`
vite-bundle-analyzer	`^1.3.7` → `^1.3.9`
vue (source)	`^3.5.32` → `^3.5.40`
vue-router (source)	`^5.0.4` → `^5.2.0`
vue-tsc (source)	`^3.2.6` → `^3.3.8`
yarn (source)	`4.13.0` → `4.17.1`

Release Notes

eslint/rewrite (@eslint/compat)

`v2.1.0`

Compare Source

Features

Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

eslint/eslintrc (@eslint/eslintrc)

`v3.3.6`

Compare Source

Bug Fixes

update js-yaml to 4.3.0 to address security vulnerability (#235) (0c5de74)

fontsource/font-files (@fontsource/noto-sans-sc)

`v5.3.0`

Compare Source

FortAwesome/Font-Awesome (@fortawesome/free-brands-svg-icons)

`v7.3.1`

Compare Source

Change log available at https://fontawesome.com/docs/changelog/

`v7.3.0`

Compare Source

nuxt/eslint (@nuxt/eslint)

`v1.16.0`

Compare Source

🚀 Features

Update deps - by @antfu (008ad)

View changes on GitHub

harlan-zw/nuxt-seo (@nuxtjs/seo)

`v5.3.6`

Compare Source

🐞 Bug Fixes

shared: Make createNitroRouteRuleMatcher take runtimeConfig explicitly - by @harlan-zw in #594 (6daa7)

View changes on GitHub

`v5.3.4`

Compare Source

🚀 Features

shared:
- Ship server subpath, unify route-rule matcher and logger helpers - by @harlan-zw in #591 (49477)
- Filter serialization for runtimeConfig-safe patterns - by @harlan-zw in #592 (f9661)

View changes on GitHub

`v5.3.3`

Compare Source

No significant changes

View changes on GitHub

`v5.3.2`

Compare Source

No significant changes

View changes on GitHub

`v5.3.1`

Compare Source

🐞 Bug Fixes

devtools: Quiter build output - by @harlan-zw (b87ef)

View changes on GitHub

`v5.3.0`

Compare Source

🚀 Features

devtools: Provision UI toolchain on demand via nuxtseo-devtools - by @harlan-zw (ab5e0)

🐞 Bug Fixes

devtools:
- Reactive module update-check (version matching) - by @harlan-zw in #577 (07f9c)
- Guard possibly-undefined subprocess from startSubprocess - by @harlan-zw (34545)

🏎 Performance

devtools: Install devtools layer on demand - by @harlan-zw in #578 (0e54d)

View changes on GitHub

`v5.2.6`

Compare Source

🐞 Bug Fixes

devtools: Build client on demand without npx and surface progress - by @harlan-zw in #576 (de615)

View changes on GitHub

`v5.2.5`

Compare Source

🐞 Bug Fixes

devtools: Show all installed modules in the picker - by @harlan-zw in #575 (20127)

View changes on GitHub

`v5.2.4`

Compare Source

🐞 Bug Fixes

devtools-layer: Constrain rpc generics to object - by @harlan-zw (82b2a)

View changes on GitHub

`v5.2.3`

Compare Source

🐞 Bug Fixes

devtools:
- Wait for shiki - by @harlan-zw in #572 (4b1cd)
- Resolve 1 parent down - by @harlan-zw (88140)

View changes on GitHub

`v5.2.2`

Compare Source

🐞 Bug Fixes

devtools: Version-resilient host adapter for client connections - by @harlan-zw in #568 (d5abc)

View changes on GitHub

`v5.2.1`

Compare Source

No significant changes

View changes on GitHub

`v5.2.0`

Compare Source

🚀 Features

devtools: Unified devtools client + design alignment - by @harlan-zw in #566 (7e7d3)

🐞 Bug Fixes

devtools: Keep setupDevToolsUI backward compatible + bundle carbon icons - by @harlan-zw in #567 (7464e)

View changes on GitHub

`v5.1.4`

Compare Source

🚀 Features

Add Stackblitz starter examples - by @harlan-zw in #549 (3c2f2)

🐞 Bug Fixes

Raise nuxt-og-image compatibility floor to >=6.4.4 - by @harlan-zw in #560 (c47ba)
content:
- Re-export define* fns from sub modules - by @harlan-zw (d8eb7)
shared:
- Support i18n compact routes - by @harlan-zw in #558 (330f6)
- Add resolveHostUnheadMajor helper - by @harlan-zw in #561 (af7f9)
- ResolveHostUnheadMajor searches nuxt install for pnpm - by @harlan-zw in #563 (31f41)
- Prefer nitro unhead for host detection - by @harlan-zw in #564 (83bf4)

View changes on GitHub

`v5.1.3`

Compare Source

🐞 Bug Fixes

devtools: Broken og image checklist - by @harlan-zw (160f5)

View changes on GitHub

vuejs/pinia (@pinia/nuxt)

`v1.0.1`

Compare Source

🐞 Bug Fixes

Re-add missing types exports field - by @rijkvanzanten in #3154 (fb217)
types: Avoid reserved .vue at the end of name - by @posva (b0249)

View changes on GitHub

`v1.0.0`

Compare Source

🚀 Features

Upgrade devtools-api to v8 - by @posva (25572)
Use nostics for better errors - by @posva (f3522)
Gracefully skip nullish values in storeToRefs - by @JSap0914 and @posva in #3134 (cac82)
Diagnostic on invalid properties when doing storeToRefs - by @posva (e7313)
Diagnostic wrong values in plugins - by @posva (29835)
Export piniaSymbol - by @cexoso in #2973 (d715b)

🐞 Bug Fixes

Use modern Object.hasOwn - by @posva (57ecc)
Respect skipHydrate marker on non-plain objects in shouldHydrate - by @lestersg5hollis0 and Runecraft in #3126 (2dcb3)
Prevent duplicate watcher when same callback subscribed twice - by @JSap0914 in #3144 (99dca)
ci: Pin pnpm to 11.7.0 to match action-setup bootstrap - by @posva (d7973)
devtools: Make settable getters (computed) editable - by @posva in #3151 (640b1)
hmr: Preserve runtime-added properties of setup store refs - by @chatman-media in #3132 (aec2a)

View changes on GitHub

kane50613/takumi (@takumi-rs/core)

`v2.5.0`

Add `setGlyphCacheMaxBytes`

The resolved-glyph and glyph-mask caches share an 8 MiB budget that no binding exposed. cacheMaxBytes looks like the knob for it but covers a different set of caches: decoded images, SVG rasters, and parsed stylesheets.

setGlyphCacheMaxBytes sets the glyph budget. It is a module-level function rather than a Renderer option because those caches live in the module and are shared by every renderer, and the budget is read the first time a cache is used, so the call has to come before the first render.

The default suits Latin text. A CJK outline runs a few kilobytes, so 8 MiB holds on the order of a thousand of them and a page of Chinese re-rasterizes glyphs it evicted a moment earlier.

takumi-js forwards it too. That one records the budget and hands it to the backend as it loads, so it stays synchronous and cannot race the resolution.

`v2.4.2`

Stop copying Uint8Array font and image inputs on the native binding

Buffer inputs were already passed to render tasks as ref-counted views, but Uint8Array inputs went through a full to_vec copy first. Both now cross into the async tasks zero-copy; only bare ArrayBuffer inputs still copy.

`v2.4.0`

Unify decoded resources behind one budgeted cache

Decoded images had a byte budget, but each SVG kept up to 32 rasterized pixmaps outside it, and every render re-parsed its stylesheets from scratch. ImageCache is now ResourceCache: SVG sources, their rasterized pixmaps, and parsed stylesheets all weigh against the same budget as decoded images. The default budget drops from 64 MiB to 16 MiB and becomes configurable — new Renderer({ cacheMaxBytes }) in the bindings, ResourceCache::new(max_bytes) in Rust, with 0 disabling caching. SVG rasters and parsed stylesheets now also survive across renders, so a server re-rendering the same template stops re-rasterizing and re-parsing per request. Rust callers: RenderOptions.stylesheet is now Arc<StyleSheet>; pass sheet.into().

Return an error for viewports too large to allocate

A viewport whose pixel buffer overflowed the backing allocation used to fall back to a 1x1 canvas, so the render produced a valid-looking but wrong tiny image with no error. The root canvas is now built through a fallible path that surfaces the allocation failure as an InvalidViewport error instead. Internal offscreen canvases keep their bounded sizes and are unaffected.

Blend animated WebP frames by default on the native binding

AnimatedWebpOptions::builder() left blend and dispose unset, so they fell back to false while the type's Default and the wasm backend use blend: true. Native animated WebP now alpha-blends frames over prior content like wasm does, so animations with partially transparent later frames render the same on both backends. The builder defaults are pinned to the Default values.

Convert native panics into catchable errors instead of aborting the process

The published napi artifacts are now built with unwind panics, so a Rust panic reached through malformed input surfaces as a JS error rather than killing the host process. Wasm keeps abort panics by design.

`v2.3.0`

Accept raw RGBA pixels as an image source

An image node's src takes { width, height, data, premultiplied? } and renders the pixels without decoding; the Bitmap JSX helper wraps it as an <img>.

`v2.2.0`

Extend the built-in Geist to weight 300

The embedded last-resort font covers wght 300..800 and trims unused stylistic sets, ending up slightly smaller than before.

Claim generic font families from the JS font API

Font descriptors accept generic (e.g. "monospace"), so stacks like Tailwind's font-mono resolve to registered fonts without naming the family.

`v2.0.2`

Accept a promise in the `fonts` option

fonts now takes Promise<FontLoader[]> as well as the plain list, so
googleFonts results pass straight through without await.

Extend the embedded font weight axis to 800

The embedded last-resort Geist subset now covers weights 400 to 800.

`v2.0.0`

Make the embedded font a true last resort

Both bindings now embed one font: a Latin Geist subset with a 400 to 700
weight axis (Geist Mono and Manrope are gone). It no longer claims the
sans-serif generic family and always sorts after registered fonts in
fallback selection, so generic families and unstyled text resolve to the fonts
you load. The new FontResource::last_resort marks a font's families to sort
after every normal registration.

Cap animation frame rate per format

Browsers clamp any animation frame of 10ms or less to 100ms, so a high frame
rate stalls instead of playing fast. write_animation now rejects a frame rate
above AnimationFormat::max_fps with the new AnimationFrameRateTooHigh error:
90 fps for WebP and APNG, 50 fps for GIF (centisecond delays). The napi and WASM
renderAnimation bindings surface the error.

Apply structured keyframes in `renderAnimation`

renderAnimation accepted a keyframes option but never registered it, so
structured keyframes animated with render yet stayed static in animations. It
now extends the stylesheet with them like the other entry points.

Fix buffer pool bucket capacity invariant

Release now buckets a buffer by the floor power of two its capacity guarantees,
and acquire_dirty reserves before set_len. A pooled buffer can no longer be
lengthened past its allocation.

Skip mask copies and per-pixel mask lookups in canvas fast paths

Borrow the combined constraint mask directly when it already matches the
canvas viewport instead of copying it per draw, and hoist mask lookups out of
the per-pixel blit loops. Output is unchanged.

Make subset-group font selection deterministic

Subsets registered under one logical family (via FontResource::subset_of) were kept
in registration order. Callers commonly register fonts concurrently, so that order — and
therefore which subset won for a codepoint covered by more than one (e.g. overlapping
weight subsets, where the loser is faux-bolded) — varied per process. Identical input
could render to different bytes run to run.

Subsets are now held in a BTreeSet, ordered by their family name, so expansion and
selection no longer depend on registration timing. Same input renders identically.

Shrink the published binaries

Size-optimize the layout and shaping crates that never run per pixel, cutting
the published WASM and native binary size.

Share the renderer facade between the napi and wasm bindings

The napi and wasm Renderer wrappers now build on a shared prepareRenderInput
helper in @takumi-rs/helpers/renderer, so their option types and render bodies
live in one place. Both backends check signal before and after resolving
fonts and images: on native, an already-aborted signal now throws before any
resource fetch.

Fix gradient stop snapping panic for oversized stop lists

Gradients with more color stops than the LUT can hold no longer panic. The
sample-index clamp and normalization passes stay within LUT bounds.

Reuse per-scene state across animation frames

Compute each scene's font snapshot once and share its image and stylesheet
handles across frames instead of re-snapshotting and deep-cloning the whole
option tree per frame. Frame output is unchanged.

Remove `encodeFrames`

Renderer.encodeFrames and its EncodeFramesOptions / AnimationFrameSource
types are gone. renderAnimation covers scene-based animation; pre-rendered
frame encoding had no callers.

Replace `fetchResources`/`extractResourceUrls` with `prepareImages`

@takumi-rs/helpers exports prepareImages({ node, sources?, fetchCache?, fetch?, timeout? }),
which collects a node tree's remote images and fetches the ones not already supplied. Pass a
fetchCache (a Map<string, Promise<ArrayBuffer>>, or any Map-like store) to coalesce
concurrent fetches of the same URL and reuse the bytes across renders; a failed fetch is
evicted so a later call retries.

The extractResourceUrls and fetchResources helpers are removed. The images render option
takes the same group form: { sources, fetchCache, fetch, timeout }.

Stream animation frames straight into the encoder

Add write_animation, which renders a timeline and feeds each frame to the
encoder as it arrives, holding one raw frame at a time instead of the whole
sequence. Both the napi and WASM renderAnimation bindings use it, so a high
frame rate or a long duration no longer exhausts memory. On native the WebP
encoder still runs frames in parallel, now over bounded chunks. The WASM WebP
encoder now merges runs of identical frames like the native one, so a static or
slow animation encodes and stores far less. The eager render_animation +
write_animated_* path stays for callers that want every frame at once.

Guard shadow and blur buffer sizing against overflow

Extreme blur radii could overflow the u32 shadow-buffer area and panic or
over-allocate. Sizing now uses saturating math and skips shadows above a 256
Mi-pixel budget.

Type keyframe declarations with `csstype` instead of DOM's `CSSStyleDeclaration`

KeyframesMap and KeyframeRule typed each keyframe's declarations as
Record<string, CSSStyleDeclaration>, requiring every CSS property on a single
offset and needing the DOM lib. Declarations are now typed with csstype's
Properties, an optional peer dependency, so a single offset only needs the
properties it sets and consumers without the DOM lib still typecheck.

Accept a bare URL string in `fonts`

fonts entries can now be a URL string, e.g. fonts: ["https://example.com/Inter.woff2"].
The bytes are fetched on demand and keyed by the URL; family name, weight, and style come
from the font file. The object form stays for overriding those. Adds fontFromUrl to
@takumi-rs/helpers.

Cap image decode dimensions and GIF frame volume

Decoders reject images beyond 8192x8192 (via image::Limits for PNG and JPEG,
dimension checks for WebP) and GIFs beyond a total-frame pixel budget, stopping
decode-bomb OOM.

`v1.8.7`

Compare Source

Patch Changes

81c3678: Removed the seperate .d.ts file and updated tsdown to v0.22.3
9604fd7: Split package export types per import/require condition so CJS consumers resolve .d.cts
Updated dependencies [9604fd7]
- @takumi-rs/helpers@1.8.7

Patch Changes

bfc6e55: Join rayon's worker threads on N-API teardown to fix a Windows crash (0xC0000005) when Node exits after rendering (#763)
- @takumi-rs/helpers@1.8.3