[dependabot]

Bumps the production-dependencies group with 5 updates:

Package	From	To
next	15.5.25	15.5.26
zxing-wasm	3.1.1	3.1.4
sharp	0.35.4	0.35.5
ipaddr.js	2.2.0	2.5.0
@zxing/library	0.21.3	0.23.0

Updates next from 15.5.25 to 15.5.26

Release notes

Sourced from next's releases.

v15.5.26

This release contains additional security hardening for next/og. For more information, check out https://nextjs.org/blog/nextjs-security-update-september-22-2026

Commits

• 6936da5 v15.5.26
• b49b6ca [maintenance-lts] Harden next/og SVG serialization
• f391939 [15.5.x][test] Disable deploy tests triggering bot challenge (#98132)
• See full diff in compare view

Updates zxing-wasm from 3.1.1 to 3.1.4

Release notes

Sourced from zxing-wasm's releases.

v3.1.4

Patch Changes

• 5c836b6: Update ZXing-C++ with the latest decoding fixes, expose rotation as the canonical read-result property while preserving orientation as deprecated, and refresh the development toolchain.

v3.1.3

Patch Changes

• 3ed2ffa: Bump zxing-wasm to a17fd9dc and ship upstream bug fixes and performance improvements.

v3.1.2

Patch Changes

• 7cf9128: Bump zxing-wasm to 179be6ac and ship upstream bug fixes.

Changelog

Sourced from zxing-wasm's changelog.

3.1.4

Patch Changes

• 5c836b6: Update ZXing-C++ with the latest decoding fixes, expose rotation as the canonical read-result property while preserving orientation as deprecated, and refresh the development toolchain.

3.1.3

Patch Changes

• 3ed2ffa: Bump zxing-wasm to a17fd9dc and ship upstream bug fixes and performance improvements.

3.1.2

Patch Changes

• 7cf9128: Bump zxing-wasm to 179be6ac and ship upstream bug fixes.

Commits

• ba54ad0 chore(release): v3.1.4 (#412)
• 5c836b6 chore: update zxing-cpp and dependencies (#411)
• 2b8de1e fix(release): support changesets cli v3
• 074131f Version Packages (#402)
• a60385e chore(deps): update bencherdev/bencher digest to 6a0a885 (#391)
• 5b7a69e chore(deps): update actions/setup-node action to v7 (#398)
• e44b5b9 chore(deps): update actions/checkout action to v7.0.1 (#400)
• 3ed2ffa chore(deps): bump zxing-cpp and dependencies (#401)
• 850afe2 chore(release): v3.1.2 (#394)
• 0dc6a93 fix(ci): stop tracking ccache
• Additional commits viewable in compare view

Updates sharp from 0.35.4 to 0.35.5

Release notes

Sourced from sharp's releases.

v0.35.5

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract and rotate operations. #4606

• Tests: Ensure composite tests pass on big endian platforms. #4609

v0.35.5-rc.1

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.4-rc.1

• Add upper bounds check on length of linear and GIF delay arrays.

• Improve error handing when WebAssembly fallback also fails. #4593 @​lazerg

• TypeScript: Allow multi-frame options for JXL output. #4602 @​ramin-010

• TypeScript: Remove non-existent named export. #4604

• Increase accepted dimensions when extending an image. #4605

• Improve gain map support for extract operation. #4606

... (truncated)

Commits

• 51a990f Release v0.35.5
• 96de105 Upgrade to sharp-libvips v1.3.4
• 3a61390 CI: Configure Dependabot with all package.json locations
• 4940c50 Improve gain map support for rotate/flip/flop ops
• 20654aa Prerelease v0.35.5-rc.1
• ef4f934 CI: Upgrade to Ubuntu 26.04
• 358df95 Upgrade to libvips v8.18.7
• 49f4903 Improve gain map support for rotate-then-extract #4606
• 0e2e55e Silence a couple of compiler/static analysis warnings
• cef3b8c Improve gain map support for extract operation #4606
• Additional commits viewable in compare view

Updates ipaddr.js from 2.2.0 to 2.5.0

Changelog

Sourced from ipaddr.js's changelog.

2.5.0 - 2026-08-04

• remove ipaddr.min.js, end users must provide own minification/bundling
• fix: compress the leftmost zero run in toString (RFC 5952, 4.2.3)
• fix: strict IPv6 validation — reject :: with zero compression and hextets >4 hex digits
• fix: reject non-numeric prefix length in subnetMaskFromPrefixLength
• fix: compress trailing zero run in toString when a zoneIndex is present
• fix: throw a descriptive error for malformed input in IPv6.parse

2.4.0 - 2026-05-03

• remove Bower support
• add RFC9637, RFC9602, RFC8215, RFC3879 reserved address ranges

2.3.0 - 2025-11-27

• add isValidCIDRFourPartDecimal helper for IPv4 CIDR in four-part decimal form
• upgrade eslint dev dependency to v9
• remove duplicated LICENSE entry from published files list

Commits

• See full diff in compare view

Updates @zxing/library from 0.21.3 to 0.23.0

Release notes

Sourced from @​zxing/library's releases.

v0.23.0

Changelog

Error Robustness

• MultiFormatReader: Non-ReaderException errors (TypeError, RangeError, etc.) are now logged instead of silently swallowed during decode attempts. Previously, programming errors were invisible and produced misleading "no barcode found" results. (src/core/MultiFormatReader.ts)
• MultiFormatReader: Skip redundant setHints() calls when the same hints object is passed to decode() repeatedly, avoiding unnecessary reader reconstruction. (src/core/MultiFormatReader.ts)
• BrowserCodeReader: Unexpected errors in the continuous scan loop are now logged via console.error. Previously the loop would stop silently with no indication of what went wrong. (src/browser/BrowserCodeReader.ts)

Scanning Quality

• OneDReader: Increased default row sampling from 15 to 25 lines, covering ~78% of image height (up from ~47%). This improves detection of 1D barcodes positioned away from the image center without requiring TRY_HARDER mode. (src/core/oned/OneDReader.ts)
• BrowserCodeReader: Added GlobalHistogramBinarizer fallback when HybridBinarizer fails with NotFoundException. Local thresholding can fail on very small barcodes or uniform-background images where a single global threshold works better. The fallback only triggers on failure, so the normal fast path is unaffected. (src/browser/BrowserCodeReader.ts)

Performance

• HTMLCanvasElementLuminanceSource: Merged two duplicate 25-line grayscale conversion loops (normal vs. inverted) into a single loop using an XOR mask. Reduces code and eliminates a branch. (src/browser/HTMLCanvasElementLuminanceSource.ts)
• HTMLCanvasElementLuminanceSource: Use subarray() instead of slice() in getRow() to avoid an intermediate buffer copy on every row read. (src/browser/HTMLCanvasElementLuminanceSource.ts)
• HTMLCanvasElementLuminanceSource + BrowserCodeReader: Added optional grayscale buffer reuse across frames during continuous scanning, avoiding a ~900KB Uint8ClampedArray allocation per frame on 1280x720 video. (src/browser/HTMLCanvasElementLuminanceSource.ts, src/browser/BrowserCodeReader.ts)
• BitMatrix: Replaced Math.floor(x / 32) with bitwise (x >> 5) in all hot-path methods (get, set, unset, flip, setRegion, constructor). These are the innermost operations in binarization and grid sampling. (src/core/common/BitMatrix.ts)
• BitMatrix: Replaced manual zeroing loop in clear() with native Int32Array.fill(0). (src/core/common/BitMatrix.ts)
• DefaultGridSampler: Replaced Math.floor() with bitwise | 0 in the inner grid sampling loop, called per-pixel for every 2D barcode module. (src/core/common/DefaultGridSampler.ts)
• GlobalHistogramBinarizer: Replaced manual bucket zeroing loop with Int32Array.fill(0). (src/core/common/GlobalHistogramBinarizer.ts)
• FinderPatternFinder: Replaced manual 5-element array zeroing with Int32Array.fill(0) in 3 locations. (src/core/qrcode/detector/FinderPatternFinder.ts)

New Format: MaxiCode

• MaxiCodeReader: Full MaxiCode 2D barcode decoding support (modes 2–5), ported from the Java ZXing reference implementation. MaxiCode is a fixed-size hexagonal barcode used primarily by UPS for package sorting. (src/core/maxicode/MaxiCodeReader.ts)
• MaxiCode Decoder: Reed-Solomon error correction with interleaved EVEN/ODD codeword processing, supporting structured carrier messages (modes 2–3 with postal code, country, and service class) and standard/enhanced error correction messages (modes 4–5). (src/core/maxicode/decoder/Decoder.ts, src/core/maxicode/decoder/BitMatrixParser.ts, src/core/maxicode/decoder/DecodedBitStreamParser.ts)
• MultiFormatReader: MaxiCode is now included in both format-specific and default reader lists. (src/core/MultiFormatReader.ts)
• ReedSolomonDecoder: Added decodeWithECCount() method that returns the number of corrected errors, used by the MaxiCode decoder to report error correction statistics. (src/core/common/reedsolomon/ReedSolomonDecoder.ts)
• ResultMetadataType: Added ERRORS_CORRECTED enum value for reporting error correction counts in decode results. (src/core/ResultMetadataType.ts)

v0.22.0

Changelog: feature/modernize26 vs master

New Feature: MicroQR Code Support

• Added full MicroQR Code reader implementation (src/core/microqr/)
  • Detector, decoder, bit matrix parser, data masking, format information, version handling
• Registered MicroQRCodeReader in MultiFormatReader and BarcodeFormat
• Exported all MicroQR types from src/index.ts
• Added test suite with black-box tests and 3 sample images (src/test/resources/blackbox/microqr-1/)

Bug Fixes

• RSS14Reader (src/core/oned/rss/RSS14Reader.ts): Fixed finder pattern center calculation — off-by-one corrected (startEnd[0] + startEnd[1] - 1); non-throwing errors (other than NotFoundException) no longer silently swallowed; new String() replaced with String(); strict equality (===) fixes
• StringEncoding (src/core/util/StringEncoding.ts): Removed shouldDecodeOnFallback workaround for ISO-8859-1 — Node ≥ 18 native TextDecoder handles all Latin-1 bytes correctly, fixing URIError: URI malformed on characters like ó
• RSS14Reader finder pattern: findFinderPattern()[1] now correctly points to the outside pixel of the finder pattern

... (truncated)

Commits

• 1722d07 Merge pull request #647 from zxing-js/feature/modernize26-2
• 88f78ec Updated readme
• fc13009 Bumped version
• 3bc86d8 MaxiCode Support
• f9a638b Improve error robustness, scanning quality, and performance
• 139603a using new npm publish workflow
• 1a10282 Fixed publish workflow
• ca304af Merge pull request #645 from zxing-js/feature/modernize26
• c28ae9c Merge pull request #646 from zxing-js/feature/microqr
• 06b340d Fixed errors and keep compatibility
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​zxing/library since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
qr-decoder	Ready	Preview	Oct 1, 2026 5:48pm UTC