[dependabot]

Bumps the runtime-dependencies group with 42 updates in the / directory:

Package	From	To
@base-ui/react	1.8.0	1.9.0
@file-viewer/react	3.1.1	3.1.2
@file-viewer/renderer-pptx	3.1.1	3.1.2
@file-viewer/renderer-spreadsheet	3.1.1	3.1.2
@file-viewer/renderer-word	3.1.1	3.1.2
@modelcontextprotocol/sdk	1.31.0	1.32.1
@openai/agents	0.18.0	0.20.0
@radix-ui/react-label	2.1.15	2.1.17
@radix-ui/react-slot	1.3.3	1.5.0
@radix-ui/react-tabs	1.1.21	1.2.1
@radix-ui/react-tooltip	1.2.16	1.4.1
@supabase/supabase-js	2.116.0	2.117.3
jose	6.2.5	6.2.12
@tanstack/react-virtual	3.14.13	3.14.18
@tiptap/core	3.31.3	3.32.0
@tiptap/extension-code-block-lowlight	3.31.3	3.32.0
@tiptap/extension-hard-break	3.31.3	3.32.0
@tiptap/extension-highlight	3.31.3	3.32.0
@tiptap/extension-image	3.31.3	3.32.0
@tiptap/extension-link	3.31.3	3.32.0
@tiptap/extension-mention	3.31.3	3.32.0
@tiptap/extension-placeholder	3.31.3	3.32.0
@tiptap/extension-table	3.31.3	3.32.0
@tiptap/extension-table-cell	3.31.3	3.32.0
@tiptap/extension-table-header	3.31.3	3.32.0
@tiptap/extension-table-row	3.31.3	3.32.0
@tiptap/extension-task-item	3.31.3	3.32.0
@tiptap/extension-task-list	3.31.3	3.32.0
@tiptap/extension-underline	3.31.3	3.32.0
@tiptap/pm	3.31.3	3.32.0
@tiptap/react	3.31.3	3.32.0
@tiptap/starter-kit	3.31.3	3.32.0
@tiptap/suggestion	3.31.3	3.32.0
fast-xml-parser	5.11.1	5.11.2
json-rpc-2.0	1.8.0	1.8.1
mammoth	1.12.3	1.13.0
radix-ui	1.6.7	1.8.1
smol-toml	1.8.0	1.9.1
tar-stream	3.2.1	3.2.2
ts-pattern	5.9.0	5.9.1
ws	8.21.3	8.22.0
zod	4.6.5	4.6.7

Updates @base-ui/react from 1.8.0 to 1.9.0

Release notes

Sourced from @​base-ui/react's releases.

v1.9.0

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG
• Share item indicator implementation (#5728) by @​flaviendelangle
• Improve mount performance of large lists (#5819) by @​atomiks
• Combine item store subscriptions (#5863) by @​atomiks

Dialog

... (truncated)

Changelog

Sourced from @​base-ui/react's changelog.

v1.9.0

Oct 9, 2026

General changes

• Export CssVariables and DataAttributes types (#5243) by @​superhooman
• Fix stale focused field state (#5345) by @​atomiks
• Fix animation waits retaining detached elements (#5719) by @​flaviendelangle
• Keep item registration in sync when items change under Strict Mode (#5862) by @​atomiks
• Avoid re-rendering inactive triggers on open and close (#5865) by @​atomiks

Accordion

• Fix <Accordion.Trigger>'s data-value and data-index attributes (#5705) by @​cpruijsen
• Apply the native disabled attribute to <Accordion.Trigger> when using native buttons (#5607) by @​atomiks
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Alert Dialog

• Don't associate a programmatically opened popup with a trigger that did not open it (#5641) by @​michaldudak

Autocomplete

• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak

Checkbox

• Prefer aria-label over associated labels (#5787) by @​atomiks

Collapsible

• Apply the native disabled attribute to <Collapsible.Trigger> when using native buttons (#5607) by @​atomiks
• Finish closing when the render function removes the panel (#5890) by @​michaldudak
• Restore animations when a removed panel reopens (#5891) by @​michaldudak
• Expand hiddenUntilFound panels synchronously on beforematch (#5514) by @​aarongarciah

Combobox

• Fix stale chip focus after returning to the input (#5879) by @​mdm317
• Fix autoHighlight for asynchronous results (#5818) by @​atomiks
• Decouple automatic unmounting from actionsRef. Call eventDetails.preventUnmountOnClose() in onOpenChange to opt out of automatic unmounting (#5734) by @​michaldudak
• Fix label focus in Shadow DOM (#5871) by @​lyzno1
• Pass the originating event to onItemHighlighted. Pointer events may be MouseEvent or PointerEvent; typing reports the reason none (#5838) by @​atomiks
• Reset typeahead state when closing without moving focus (#5816) by @​mdm317
• Accept readonly arrays for multiple values (#5710) by @​MonstraG

... (truncated)

Commits

• ad7ecda [release] v1.9.0 (#5906)
• 3296de3 [drawer] Avoid retaining unmounted drawers in DrawerProvider (#5921)
• 69c33b4 [drawer] Fix deferred touch swipes leaving the popup (#5922)
• 51b70db [menu] Strip internal filter components from public types (#5923)
• 8d8b98c [menu] Ignore filter input edits while the menu animates out (#5911)
• aeba3eb [combobox][menu][select] Revert highlightItem imperative action (#5910)
• ec6bf32 [field][select][combobox][slider] Fall back to the owner document when lookin...
• 1f112a5 [popups] Avoid re-rendering inactive triggers on open and close (#5865)
• bc53db6 [fieldset] Await render in Legend disabled-state test (#5909)
• 147092e [test] Strengthen tests, add test lint rules and share copied suites (#5892)
• Additional commits viewable in compare view

Updates @file-viewer/react from 3.1.1 to 3.1.2

Release notes

Sourced from @​file-viewer/react's releases.

File Viewer 3.1.2

Highlights

• Adds BPMN preview and opt-in XSD/XSLT profiles for application-specific XML, with self-hosted browser assets and Demo samples.
• Fixes side-by-side Patch layout and spacing, initial EPUB flicker, ZIP preview edge cases, and corrupt-looking MSG recipient metadata.
• Improves Vue 3 error reporting while retaining tested Vue 2.6 and Vue 2.7 integrations.
• Fixes offline CLI bootstrap so it installs only the CLI's own package closure after verifying every supplied tarball.

Compatibility

The browser-local, offline-first deployment model is unchanged. XML profiles are opt-in; existing integrations require no migration.

Verification

The release uses immutable tarballs and static assets from frozen private source 98434eb4ca3c7720eec0d8644dce9e196866a070. Full rehearsal, public CI, and registry verification are required before this release is considered complete.

Changelog

Sourced from @​file-viewer/react's changelog.

File Viewer v3.1.2 - 2026-09-20

• 修复 #300：EPUB 阅读器使用稳定视口判断横竖屏，避免工具栏尺寸变化引发反复重排与闪烁。已用报告者附件和浏览器回归验证。
• 修复 #304：Patch 左右对照与匹配行的布局保持紧凑；增加复现样例与回归检查，不再把有效补丁误判为格式错误。
• 新增显式启用的 BPMN 流程图预览（#297）和 XML XSD 校验、XSLT 转换视图（#305）。普通 XML 文本预览和既有 Full 包依赖保持不变；Demo 提供可体验样例。
• 同步 ZIP 安全修复、IDML 运行资源与依赖更新；保留 Vue 2.6/2.7 与既有 Full 契约。

本次发布包含 89 个 npm 目标：88 个主线包为 3.1.2，历史兼容别名 msdoc-viewer 为 0.2.9。DOCX 引擎保持 0.3.32，表格引擎保持 0.21.6。#227、#248、#269 尚缺报告者原始文件，不能以构造样例宣称原问题已修复。

File Viewer v3.0.3 - 2026-09-09

Word、表格与移动端

• 二进制 DOC 保留插入/删除修订、段落与软换行标记；DOCX 支持全部修订、最终稿和原稿切换，无需重选文件。修复 DOC 固定行距单位、字体槽位和默认字体读取，销售合同的行距及四张表按原件验证，不为无修订文件添加删除线。
• 表格列宽拖拽后正确跟随缩放并按 sheet 恢复；不可见区域搜索覆盖真实 XLS、跨 sheet、远列和合并单元格。CFB 解析只跳过未使用的损坏 MiniFAT 链，必需数据仍严格校验。
• 修复 iPhone Safari PDF 翻页焦点和搜索键盘收起后的残留滚动；取消 PDF 初始化后不再抛出未处理的 Worker 终止异常，后续文档仍可正常加载。

集成与输出

• MapLibre 升级到 6.4.1，修复地图署名 HTML 连续危险属性的清洗绕过；内置离线 Worker，地图销毁重建后仍可加载。同步修复已发布的 js-yaml、sharp、Vitest 安全版本，并以所需 polyfill 替代仅用于查路径的 Browserify 工具链。
• 标准预览使用固定的 JSZip 3.10.2，修复不同 JavaScript 上下文之间传递二进制内容的类型识别，避免浮动依赖导致构建与冷安装结果不一致。
• core 与各渲染器统一固定 DOMPurify 3.4.15，纳入 XML 消毒安全加固并避免冷安装重复引入多个版本，体积预算保持不变。
• Demo 顶部按钮的悬停位移不再改变文档留白，避免 CAD 模式切换和导出图像出现一像素高度漂移。
• 修复 Vue CLI/Webpack 浏览器入口、Angular PPTX Worker 和嵌套 Vite 项目的资产根路径；显式资源配置保持优先，已输出 Worker 的构建不再探测不存在的清单。新增独立 RequireJS AMD 入口，保留宿主模块隔离与本地懒加载资源。
• HTML 增加静态预览和原始源码切换，预览不执行脚本或外部请求。OFD 修复规范资源路径、命名空间和异常后的 Promise 结束；CAD 修复 DXF LINE、DWF/DWFx 对比度，并提供遵守权限、钩子和水印的 PNG/JPEG 当前视图下载。
• PDF 补丁与许可来源随包校验；CHM、Adobe 和 Illustrator 的安全修复同步到规范 Worker。组件独立源码导出包含真实构建输入；发布工具按依赖层批量推进，续跑只跳过完整性一致的包。

版本与边界

87 个主线包使用 3.0.3，msdoc-viewer 使用 0.2.6。上游依赖为 DOCX 0.3.31、styled-exceljs 0.21.6、CAD 0.8.2 和 DWF 0.6.7。Vue 2.6/2.7 支持与既有 Full 能力保持不变，pako 3 继续暂缓。此 patch 版本也包含 HTML 源码切换、AMD 接入和 CAD 图片下载等新增能力。

#227 私有 XLS、#236 删除修订截图对应的文件和历史 #57 OFD 仍缺少原件；构造样本和已验证的无修订合同不替代这些原件的验收。

File Viewer v3.0.2 — 2026-09-06

这是 3.0.1 的修正版。3.0.1 已被本版取代；由于 npm 已有下游依赖，不能覆盖或完整撤回已发布的 3.0.1，发布后会将可变更的 3.0.1 包标记为 deprecated。

Issue fixes and regression coverage

• 修复 #247：Spreadsheet 搜索不再局限于当前虚拟渲染窗口；搜索工作簿中的真实单元格后会切换 sheet、加载对应窗口并跳转到匹配项。apps/viewer-demo/public/example/excel.xls 已通过浏览器回归。
• 修复 #250：升级 @file-viewer/docx 到 0.3.29，修正页面相对定位的浮动 shape；报告者提供的 test.docx 已在本地浏览器渲染验证。
• 完成 #213/#245：CAD 单色策略贯穿 DWF 到 CAD renderer、HTML 和 Print 输出，不修改原始文件数据；真实 DWF 回归通过。
• 重新验证 #242 的 Vite/PDF CJK 字体边界、#232 的 postal-mime@3.0.0 EML 正确性和 Vue 2.6 CLI 3 Office 样例；Vue 2 样例仍在发布门禁内。

Safe dependency updates

• 采用 Dependabot 安全子集：pako@2.2.0、proj4@2.22.0、vite-plugin-dts@5.1.0、cnfast@0.2.0 和 prettier@3.9.6。
• 不采用 pako 3：DICOM Inflate 的 err/msg 语义仍由 packages/renderers/dicom/src/inspect.ts 依赖；Next 16.3.4 因引入 LGPL sharp-libvips 未通过许可证门禁。

Release composition

... (truncated)

Commits

• b335efa feat(release): deliver File Viewer 3.1.2 previews and fixes
• 9ed57e3 fix(design): align IDML assets with introspect 0.63.0
• b6d8c88 chore(deps): bump the npm-minor-and-patch group
• 2335490 docs(readme): restore complete Chinese guide and key badges
• 1d1b64d docs(readme): restore centered public landing hero
• 694c04e chore(deps): bump the angular-version-cohort group
• cc80bc5 docs(readme): focus public landing copy and simplify CAD license
• 1ca4766 fix(security): update transitive ZIP and Svelte parser dependencies
• 75c9ec1 chore(public): project current safe source onto the 3.1.1 baseline
• 5789edd chore: remove unreferenced PR evidence from the repository root
• Additional commits viewable in compare view

Updates @file-viewer/renderer-pptx from 3.1.1 to 3.1.2

Release notes

Sourced from @​file-viewer/renderer-pptx's releases.

File Viewer 3.1.2

Highlights

• Adds BPMN preview and opt-in XSD/XSLT profiles for application-specific XML, with self-hosted browser assets and Demo samples.
• Fixes side-by-side Patch layout and spacing, initial EPUB flicker, ZIP preview edge cases, and corrupt-looking MSG recipient metadata.
• Improves Vue 3 error reporting while retaining tested Vue 2.6 and Vue 2.7 integrations.
• Fixes offline CLI bootstrap so it installs only the CLI's own package closure after verifying every supplied tarball.

Compatibility

The browser-local, offline-first deployment model is unchanged. XML profiles are opt-in; existing integrations require no migration.

Verification

The release uses immutable tarballs and static assets from frozen private source 98434eb4ca3c7720eec0d8644dce9e196866a070. Full rehearsal, public CI, and registry verification are required before this release is considered complete.

Changelog

Sourced from @​file-viewer/renderer-pptx's changelog.

File Viewer v3.1.2 - 2026-09-20

• 修复 #300：EPUB 阅读器使用稳定视口判断横竖屏，避免工具栏尺寸变化引发反复重排与闪烁。已用报告者附件和浏览器回归验证。
• 修复 #304：Patch 左右对照与匹配行的布局保持紧凑；增加复现样例与回归检查，不再把有效补丁误判为格式错误。
• 新增显式启用的 BPMN 流程图预览（#297）和 XML XSD 校验、XSLT 转换视图（#305）。普通 XML 文本预览和既有 Full 包依赖保持不变；Demo 提供可体验样例。
• 同步 ZIP 安全修复、IDML 运行资源与依赖更新；保留 Vue 2.6/2.7 与既有 Full 契约。

本次发布包含 89 个 npm 目标：88 个主线包为 3.1.2，历史兼容别名 msdoc-viewer 为 0.2.9。DOCX 引擎保持 0.3.32，表格引擎保持 0.21.6。#227、#248、#269 尚缺报告者原始文件，不能以构造样例宣称原问题已修复。

File Viewer v3.0.3 - 2026-09-09

Word、表格与移动端

• 二进制 DOC 保留插入/删除修订、段落与软换行标记；DOCX 支持全部修订、最终稿和原稿切换，无需重选文件。修复 DOC 固定行距单位、字体槽位和默认字体读取，销售合同的行距及四张表按原件验证，不为无修订文件添加删除线。
• 表格列宽拖拽后正确跟随缩放并按 sheet 恢复；不可见区域搜索覆盖真实 XLS、跨 sheet、远列和合并单元格。CFB 解析只跳过未使用的损坏 MiniFAT 链，必需数据仍严格校验。
• 修复 iPhone Safari PDF 翻页焦点和搜索键盘收起后的残留滚动；取消 PDF 初始化后不再抛出未处理的 Worker 终止异常，后续文档仍可正常加载。

集成与输出

• MapLibre 升级到 6.4.1，修复地图署名 HTML 连续危险属性的清洗绕过；内置离线 Worker，地图销毁重建后仍可加载。同步修复已发布的 js-yaml、sharp、Vitest 安全版本，并以所需 polyfill 替代仅用于查路径的 Browserify 工具链。
• 标准预览使用固定的 JSZip 3.10.2，修复不同 JavaScript 上下文之间传递二进制内容的类型识别，避免浮动依赖导致构建与冷安装结果不一致。
• core 与各渲染器统一固定 DOMPurify 3.4.15，纳入 XML 消毒安全加固并避免冷安装重复引入多个版本，体积预算保持不变。
• Demo 顶部按钮的悬停位移不再改变文档留白，避免 CAD 模式切换和导出图像出现一像素高度漂移。
• 修复 Vue CLI/Webpack 浏览器入口、Angular PPTX Worker 和嵌套 Vite 项目的资产根路径；显式资源配置保持优先，已输出 Worker 的构建不再探测不存在的清单。新增独立 RequireJS AMD 入口，保留宿主模块隔离与本地懒加载资源。
• HTML 增加静态预览和原始源码切换，预览不执行脚本或外部请求。OFD 修复规范资源路径、命名空间和异常后的 Promise 结束；CAD 修复 DXF LINE、DWF/DWFx 对比度，并提供遵守权限、钩子和水印的 PNG/JPEG 当前视图下载。
• PDF 补丁与许可来源随包校验；CHM、Adobe 和 Illustrator 的安全修复同步到规范 Worker。组件独立源码导出包含真实构建输入；发布工具按依赖层批量推进，续跑只跳过完整性一致的包。

版本与边界

87 个主线包使用 3.0.3，msdoc-viewer 使用 0.2.6。上游依赖为 DOCX 0.3.31、styled-exceljs 0.21.6、CAD 0.8.2 和 DWF 0.6.7。Vue 2.6/2.7 支持与既有 Full 能力保持不变，pako 3 继续暂缓。此 patch 版本也包含 HTML 源码切换、AMD 接入和 CAD 图片下载等新增能力。

#227 私有 XLS、#236 删除修订截图对应的文件和历史 #57 OFD 仍缺少原件；构造样本和已验证的无修订合同不替代这些原件的验收。

File Viewer v3.0.2 — 2026-09-06

这是 3.0.1 的修正版。3.0.1 已被本版取代；由于 npm 已有下游依赖，不能覆盖或完整撤回已发布的 3.0.1，发布后会将可变更的 3.0.1 包标记为 deprecated。

Issue fixes and regression coverage

• 修复 #247：Spreadsheet 搜索不再局限于当前虚拟渲染窗口；搜索工作簿中的真实单元格后会切换 sheet、加载对应窗口并跳转到匹配项。apps/viewer-demo/public/example/excel.xls 已通过浏览器回归。
• 修复 #250：升级 @file-viewer/docx 到 0.3.29，修正页面相对定位的浮动 shape；报告者提供的 test.docx 已在本地浏览器渲染验证。
• 完成 #213/#245：CAD 单色策略贯穿 DWF 到 CAD renderer、HTML 和 Print 输出，不修改原始文件数据；真实 DWF 回归通过。
• 重新验证 #242 的 Vite/PDF CJK 字体边界、#232 的 postal-mime@3.0.0 EML 正确性和 Vue 2.6 CLI 3 Office 样例；Vue 2 样例仍在发布门禁内。

Safe dependency updates

• 采用 Dependabot 安全子集：pako@2.2.0、proj4@2.22.0、vite-plugin-dts@5.1.0、cnfast@0.2.0 和 prettier@3.9.6。
• 不采用 pako 3：DICOM Inflate 的 err/msg 语义仍由 packages/renderers/dicom/src/inspect.ts 依赖；Next 16.3.4 因引入 LGPL sharp-libvips 未通过许可证门禁。

Release composition

... (truncated)

Commits

• b335efa feat(release): deliver File Viewer 3.1.2 previews and fixes
• 9ed57e3 fix(design): align IDML assets with introspect 0.63.0
• b6d8c88 chore(deps): bump the npm-minor-and-patch group
• 2335490 docs(readme): restore complete Chinese guide and key badges
• 1d1b64d docs(readme): restore centered public landing hero
• 694c04e chore(deps): bump the angular-version-cohort group
• cc80bc5 docs(readme): focus public landing copy and simplify CAD license
• 1ca4766 fix(security): update transitive ZIP and Svelte parser dependencies
• 75c9ec1 chore(public): project current safe source onto the 3.1.1 baseline
• 5789edd chore: remove unreferenced PR evidence from the repository root
• Additional commits viewable in compare view

Updates @file-viewer/renderer-spreadsheet from 3.1.1 to 3.1.2

Release notes

Sourced from @​file-viewer/renderer-spreadsheet's releases.

File Viewer 3.1.2

Highlights

• Adds BPMN preview and opt-in XSD/XSLT profiles for application-specific XML, with self-hosted browser assets and Demo samples.
• Fixes side-by-side Patch layout and spacing, initial EPUB flicker, ZIP preview edge cases, and corrupt-looking MSG recipient metadata.
• Improves Vue 3 error reporting while retaining tested Vue 2.6 and Vue 2.7 integrations.
• Fixes offline CLI bootstrap so it installs only the CLI's own package closure after verifying every supplied tarball.

Compatibility

The browser-local, offline-first deployment model is unchanged. XML profiles are opt-in; existing integrations require no migration.

Verification

The release uses immutable tarballs and static assets from frozen private source 98434eb4ca3c7720eec0d8644dce9e196866a070. Full rehearsal, public CI, and registry verification are required before this release is considered complete.

Changelog

Sourced from @​file-viewer/renderer-spreadsheet's changelog.

File Viewer v3.1.2 - 2026-09-20

• 修复 #300：EPUB 阅读器使用稳定视口判断横竖屏，避免工具栏尺寸变化引发反复重排与闪烁。已用报告者附件和浏览器回归验证。
• 修复 #304：Patch 左右对照与匹配行的布局保持紧凑；增加复现样例与回归检查，不再把有效补丁误判为格式错误。
• 新增显式启用的 BPMN 流程图预览（#297）和 XML XSD 校验、XSLT 转换视图（#305）。普通 XML 文本预览和既有 Full 包依赖保持不变；Demo 提供可体验样例。
• 同步 ZIP 安全修复、IDML 运行资源与依赖更新；保留 Vue 2.6/2.7 与既有 Full 契约。

本次发布包含 89 个 npm 目标：88 个主线包为 3.1.2，历史兼容别名 msdoc-viewer 为 0.2.9。DOCX 引擎保持 0.3.32，表格引擎保持 0.21.6。#227、#248、#269 尚缺报告者原始文件，不能以构造样例宣称原问题已修复。

File Viewer v3.0.3 - 2026-09-09

Word、表格与移动端

• 二进制 DOC 保留插入/删除修订、段落与软换行标记；DOCX 支持全部修订、最终稿和原稿切换，无需重选文件。修复 DOC 固定行距单位、字体槽位和默认字体读取，销售合同的行距及四张表按原件验证，不为无修订文件添加删除线。
• 表格列宽拖拽后正确跟随缩放并按 sheet 恢复；不可见区域搜索覆盖真实 XLS、跨 sheet、远列和合并单元格。CFB 解析只跳过未使用的损坏 MiniFAT 链，必需数据仍严格校验。
• 修复 iPhone Safari PDF 翻页焦点和搜索键盘收起后的残留滚动；取消 PDF 初始化后不再抛出未处理的 Worker 终止异常，后续文档仍可正常加载。

集成与输出

• MapLibre 升级到 6.4.1，修复地图署名 HTML 连续危险属性的清洗绕过；内置离线 Worker，地图销毁重建后仍可加载。同步修复已发布的 js-yaml、sharp、Vitest 安全版本，并以所需 polyfill 替代仅用于查路径的 Browserify 工具链。
• 标准预览使用固定的 JSZip 3.10.2，修复不同 JavaScript 上下文之间传递二进制内容的类型识别，避免浮动依赖导致构建与冷安装结果不一致。
• core 与各渲染器统一固定 DOMPurify 3.4.15，纳入 XML 消毒安全加固并避免冷安装重复引入多个版本，体积预算保持不变。
• Demo 顶部按钮的悬停位移不再改变文档留白，避免 CAD 模式切换和导出图像出现一像素高度漂移。
• 修复 Vue CLI/Webpack 浏览器入口、Angular PPTX Worker 和嵌套 Vite 项目的资产根路径；显式资源配置保持优先，已输出 Worker 的构建不再探测不存在的清单。新增独立 RequireJS AMD 入口，保留宿主模块隔离与本地懒加载资源。
• HTML 增加静态预览和原始源码切换，预览不执行脚本或外部请求。OFD 修复规范资源路径、命名空间和异常后的 Promise 结束；CAD 修复 DXF LINE、DWF/DWFx 对比度，并提供遵守权限、钩子和水印的 PNG/JPEG 当前视图下载。
• PDF 补丁与许可来源随包校验；CHM、Adobe 和 Illustrator 的安全修复同步到规范 Worker。组件独立源码导出包含真实构建输入；发布工具按依赖层批量推进，续跑只跳过完整性一致的包。

版本与边界

87 个主线包使用 3.0.3，msdoc-viewer 使用 0.2.6。上游依赖为 DOCX 0.3.31、styled-exceljs 0.21.6、CAD 0.8.2 和 DWF 0.6.7。Vue 2.6/2.7 支持与既有 Full 能力保持不变，pako 3 继续暂缓。此 patch 版本也包含 HTML 源码切换、AMD 接入和 CAD 图片下载等新增能力。

#227 私有 XLS、#236 删除修订截图对应的文件和历史 #57 OFD 仍缺少原件；构造样本和已验证的无修订合同不替代这些原件的验收。

File Viewer v3.0.2 — 2026-09-06

这是 3.0.1 的修正版。3.0.1 已被本版取代；由于 npm 已有下游依赖，不能覆盖或完整撤回已发布的 3.0.1，发布后会将可变更的 3.0.1 包标记为 deprecated。

Issue fixes and regression coverage

• 修复 #247：Spreadsheet 搜索不再局限于当前虚拟渲染窗口；搜索工作簿中的真实单元格后会切换 sheet、加载对应窗口并跳转到匹配项。apps/viewer-demo/public/example/excel.xls 已通过浏览器回归。
• 修复 #250：升级 @file-viewer/docx 到 0.3.29，修正页面相对定位的浮动 shape；报告者提供的 test.docx 已在本地浏览器渲染验证。
• 完成 #213/#245：CAD 单色策略贯穿 DWF 到 CAD renderer、HTML 和 Print 输出，不修改原始文件数据；真实 DWF 回归通过。
• 重新验证 #242 的 Vite/PDF CJK 字体边界、#232 的 postal-mime@3.0.0 EML 正确性和 Vue 2.6 CLI 3 Office 样例；Vue 2 样例仍在发布门禁内。

Safe dependency updates

• 采用 Dependabot 安全子集：pako@2.2.0、proj4@2.22.0、vite-plugin-dts@5.1.0、cnfast@0.2.0 和 prettier@3.9.6。
• 不采用 pako 3：DICOM Inflate 的 err/msg 语义仍由 packages/renderers/dicom/src/inspect.ts 依赖；Next 16.3.4 因引入 LGPL sharp-libvips 未通过许可证门禁。

Release composition

... (truncated)

Commits

• b335efa feat(release): deliver File Viewer 3.1.2 previews and fixes
• 9ed57e3 fix(design): align IDML assets with introspect 0.63.0
• b6d8c88 chore(deps): bump the npm-minor-and-patch group
• 2335490 docs(readme): restore complete Chinese guide and key badges
• 1d1b64d docs(readme): restore centered public landing hero
• 694c04e chore(deps): bump the angular-version-cohort group
• cc80bc5 docs(readme): focus public landing copy and simplify CAD license
• 1ca4766 fix(security): update transitive ZIP and Svelte parser dependencies
• 75c9ec1 chore(public): project current safe source onto the 3.1.1 baseline
• 5789edd chore: remove unreferenced PR evidence from the repository root
• Additional commits viewable in compare view

Updates @file-viewer/renderer-word from 3.1.1 to 3.1.2

Release notes

Sourced from @​file-viewer/renderer-word's releases.

File Viewer 3.1.2

Highlights

• Adds BPMN preview and opt-in XSD/XSLT profiles for application-specific XML, with self-hosted browser assets and Demo samples.
• Fixes side-by-side Patch layout and spacing, initial EPUB flicker, ZIP preview edge cases, and corrupt-looking MSG recipient metadata.
• Improves Vue 3 error reporting while retaining tested Vue 2.6 and Vue 2.7 integrations.
• Fixes offline CLI bootstrap so it installs only the CLI's own package closure after verifying every supplied tarball.

Compatibility

The browser-local, offline-first deployment model is unchanged. XML profiles are opt-in; existing integrations require no migration.

Verification

The release uses immutable tarballs and static assets from frozen private source 98434eb4ca3c7720eec0d8644dce9e196866a070. Full rehearsal, public CI, and registry verification are required before this release is considered complete.

Changelog

Sourced from @​file-viewer/renderer-word's changelog.

File Viewer v3.1.2 - 2026-09-20

• 修复 #300：EPUB 阅读器使用稳定视口判断横竖屏，避免工具栏尺寸变化引发反复重排与闪烁。已用报告者附件和浏览器回归验证。
• 修复 #304：Patch 左右对照与匹配行的布局保持紧凑；增加复现样例与回归检查，不再把有效补丁误判为格式错误。
• 新增显式启用的 BPMN 流程图预览（#297）和 XML XSD 校验、XSLT 转换视图（#305）。普通 XML 文本预览和既有 Full 包依赖保持不变；Demo 提供可体验样例。
• 同步 ZIP 安全修复、IDML 运行资源与依赖更新；保留 Vue 2.6/2.7 与既有 Full 契约。

本次发布包含 89 个 npm 目标：88 个主线包为 3.1.2，历史兼容别名 msdoc-viewer 为 0.2.9。DOCX 引擎保持 0.3.32，表格引擎保持 0.21.6。#227、#248、#269 尚缺报告者原始文件，不能以构造样例宣称原问题已修复。

File Viewer v3.0.3 - 2026-09-09

Word、表格与移动端

• 二进制 DOC 保留插入/删除修订、段落与软换行标记；DOCX 支持全部修订、最终稿和原稿切换，无需重选文件。修复 DOC 固定行距单位、字体槽位和默认字体读取，销售合同的行距及四张表按原件验证，不为无修订文件添加删除线。
• 表格列宽拖拽后正确跟随缩放并按 sheet 恢复；不可见区域搜索覆盖真实 XLS、跨 sheet、远列和合并单元格。CFB 解析只跳过未使用的损坏 MiniFAT 链，必需数据仍严格校验。
• 修复 iPhone Safari PDF 翻页焦点和搜索键盘收起后的残留滚动；取消 PDF 初始化后不再抛出未处理的 Worker 终止异常，后续文档仍可正常加载。

集成与输出

• MapLibre 升级到 6.4.1，修复地图署名 HTML 连续危险属性的清洗绕过；内置离线 Worker，地图销毁重建后仍可加载。同步修复已发布的 js-yaml、sharp、Vitest 安全版本，并以所需 polyfill 替代仅用于查路径的 Browserify 工具链。
• 标准预览使用固定的 JSZip 3.10.2，修复不同 JavaScript 上下文之间传递二进制内容的类型识别，避免浮动依赖导致构建与冷安装结果不一致。
• core 与各渲染器统一固定 DOMPurify 3.4.15，纳入 XML 消毒安全加固并避免冷安装重复引入多个版本，体积预算保持不变。
• Demo 顶部按钮的悬停位移不再改变文档留白，避免 CAD 模式切换和导出图像出现一像素高度漂移。
• 修复 Vue CLI/Webpack 浏览器入口、Angular PPTX Worker 和嵌套 Vite 项目的资产根路径；显式资源配置保持优先，已输出 Worker 的构建不再探测不存在的清单。新增独立 RequireJS AMD 入口，保留宿主模块隔离与本地懒加载资源。
• HTML 增加静态预览和原始源码切换，预览不执行脚本或外部请求。OFD 修复规范资源路径、命名空间和异常后的 Promise 结束；CAD 修复 DXF LINE、DWF/DWFx 对比度，并提供遵守权限、钩子和水印的 PNG/JPEG 当前视图下载。
• PDF 补丁与许可来源随包校验；CHM、Adobe 和 Illustrator 的安全修复同步到规范 Worker。组件独立源码导出包含真实构建输入；发布工具按依赖层批量推进，续跑只跳过完整性一致的包。

版本与边界

87 个主线包使用 3.0.3，msdoc-viewer 使用 0.2.6。上游依赖为 DOCX 0.3.31、styled-exceljs 0.21.6、CAD 0.8.2 和 DWF 0.6.7。Vue 2.6/2.7 支持与既有 Full 能力保持不变，pako 3 继续暂缓。此 patch 版本也包含 HTML 源码切换、AMD 接入和 CAD 图片下载等新增能力。

#227 私有 XLS、#236 删除修订截图对应的文件和历史 #57 OFD 仍缺少原件；构造样本和已验证的无修订合同不替代这些原件的验收。

File Viewer v3.0.2 — 2026-09-06

这是 3.0.1 的修正版。3.0.1 已被本版取代；由于 npm 已有下游依赖，不能覆盖或完整撤回已发布的 3.0.1，发布后会将可变更的 3.0.1 包标记为 deprecated。

Issue fixes and regression coverage

• 修复 #247：Spreadsheet 搜索不再局限于当前虚拟渲染窗口；搜索工作簿中的真实单元格后会切换 sheet、加载对应窗口并跳转到匹配项。apps/viewer-demo/public/example/excel.xls 已通过浏览器回归。
• 修复 #250：升级 @file-viewer/docx 到 0.3.29，修正页面相对定位的浮动 shape；报告者提供的 test.docx 已在本地浏览器渲染验证。
• 完成 #213/#245：CAD 单色策略贯穿 DWF 到 CAD renderer、HTML 和 Print 输出，不修改原始文件数据；真实 DWF 回归通过。
• 重新验证 #242 的 Vite/PDF CJK 字体边界、#232 的 postal-mime@3.0.0 EML 正确性和 Vue 2.6 CLI 3 Office 样例；Vue 2 样例仍在发布门禁内。

Safe dependency updates

• 采用 Dependabot 安全子集：pako@2.2.0、proj4@2.22.0、vite-plugin-dts@5.1.0、cnfast@0.2.0 和 prettier@3.9.6。
• 不采用 pako 3：DICOM Inflate 的 err/msg 语义仍由 packages/renderers/dicom/src/inspect.ts 依赖；Next 16.3.4 因引入 LGPL sharp-libvips 未通过许可证门禁。

Release composition

... (truncated)

Commits

• b335efa feat(release): deliver File Viewer 3.1.2 previews and fixes
• 9ed57e3 fix(design): align IDML assets with introspect 0.63.0
• b6d8c88 chore(deps): bump the npm-minor-and-patch group
• 2335490 docs(readme): restore complete Chinese guide and key badges
• 1d1b64d docs(readme): restore centered public landing hero
• 694c04e chore(deps): bump the angular-version-cohort group
• cc80bc5 docs(readme): focus public landing copy and simplify CAD license
• 1ca4766 fix(security): update transitive ZIP and Svelte parser dependencies
• 75c9ec1 chore(public): project current safe source onto the 3.1.1 baseline
• 5789edd chore: remove unreferenced PR evidence from the repository root
• Additional commits viewable in compare view

Updates @modelcontextprotocol/sdk from 1.31.0 to 1.32.1

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.32.1

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in modelcontextprotocol/typescript-sdk#2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in modelcontextprotocol/typescript-sdk#2942
• chore: bump version to 1.32.1 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

1.32.0

Upgrade notes

• Redirects: the HTTP client transports now follow a redirect only when it stays on the same origin (same scheme, host and port; http to https on the same host is allowed). A deployment whose endpoint redirects to another host or port either configures the final URL or sets redirectPolicy: 'follow' on StreamableHTTPClientTransport or SSEClientTransport. In browsers, a redirected request fails unless that option is set.
• New options, both off unless you set them: maxToolInputElements on McpServer limits the number of array elements and object members in a tool call's arguments. expectedResource on requireBearerAuth accepts only tokens issued for this server (the token's audience).

What's Changed

• [v1.x] fix(client): follow redirects only within the endpoint's origin by @​claude[bot] in modelcontextprotocol/typescript-sdk#2902
• docs: point SECURITY.md at GitHub Security Advisories (v1.x) by @​claude[bot] in modelcontextprotocol/typescript-sdk#2910
• [v1.x] examples: close idle sessions and cap the session map by @​maxisbey in modelcontextprotocol/typescript-sdk#2914
• [v1.x] fix(tasks): keep tasks of the in-memory task store within the session that created them by @​claude[bot] in modelcontextprotocol/typescript-sdk#2925
• [v1.x] feat(server): add maxToolInputElements option to limit the number of elements in tool-call arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2927
• [v1.x] fix(server): accept tools/call and prompts/get requests that omit arguments by @​raashish1601 in modelcontextprotocol/typescript-sdk#2045
• [v1.x] feat(auth): add expectedResource to requireBearerAuth by @​claude[bot] in modelcontextprotocol/typescript-sdk#2930
• [v1.x] test(e2e): cover tools/call and prompts/get without arguments by @​claude[bot] in modelcontextprotocol/typescript-sdk#2931
• chore: bump version to 1.32.0 by @​claude[bot] in modelcontextprotocol/typescript-sdk#2935

New Contributors

• @​raashish1601 made their first contribution in modelcontextprotocol/typescript-sdk#2045

Full Changelog: modelcontextprotocol/typescript-sdk@1.31.0...1.32.0

Commits

• ff07b00 chore: bump version to 1.32.1 (#2954)
• 8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
• a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
• 32549b0 chore: bump version to 1.32.0 (#2935)
• 588d51d [v1.x] test(e2e): cover tools/call and prompts/get without arguments (#2931)
• 5a0724d [v1.x] feat(auth): add expectedResource to requireBearerAuth (#2930)
• 0ca0b62 [v1.x] fix(server): accept tools/call and prompts/get requests that omit argu...
• fd26801 [v1.x] feat(server): add maxToolInputElements option to limit the number of e...
• 727075b [v1.x] fix(tasks): keep tasks of the in-memory task store within the session ...
• 0ff6377 [v1.x] examples: close idle sessions and cap the session map (#2914)
• Additional commits viewable in compare view

Updates @openai/agents from 0.18.0 to 0.20.0

Release notes

Sourced from @​openai/agents's releases.

@​openai/agents-core@​0.20.0

Minor Changes

• 836cb50: fix: default automatic MCP tool discovery to 64 pages; set maxListPages explicitly for larger listings
• 8ee5055: fix: Require trusted Python 3 for UnixLocal file operations and reject disabled protection. Honor runAs for file tools and replace edited files without modifying other hardlinks. Updates now require writable parent directories and preserve ordinary permissions and ownership.
• 8567e09: fix: count model calls after approval resumes toward maxTurns; callers needing a follow-up model response at the limit must increase maxTurns.

Patch Changes

• 40f7de2: fix: redact unchecked terminal tool output in cancelled session checkpoints while preserving completion history; defer validation for caller-owned RunState resumes
• 05241c7: fix: preserve hosted MCP discovery provenance across tool identity collisions and session reuse; older namespace-only history requires rediscovery.
• 4137680: fix: recognize namespace-shaped tool search discovery for deferred hosted MCP calls (#2044).
• b89905c: fix: Preserve computer tool initializers and serialize each run's resolved computer across overlapping runs.
• d8fa6c3: fix: Warn when computer calls have pending safety checks without an onSafetyCheck handler, and clarify the callback's opt-in behavior.
• 9e32e88: fix: Bound streamable HTTP session termination by the client session timeout and cancel stalled cleanup requests.
• 2f3591b: fix: preserve sticky permission bits through manifest normalization and local and remote materialization, and reapply manifest sticky intent to restored Unix-local and Docker snapshot directories

@​openai/agents-extensions@​0.20.0

Minor Changes

• edfa410: fix: Use current Vercel authentication configuration for restored sessions and disable legacy authentication fallback when current authentication is configured; retain per-create authentication choices for live sessions. Keep restoration credentials runtime-only and honor per-run resume overrides.

Patch Changes

• 2f3591b: fix: preserve sticky permission bits through manifest normalization and local and remote materialization, and reapply manifest sticky intent to restored Unix-local and Docker snapshot directories
• Updated dependencies [40f7de2]
• Updated dependencies [836cb50]
• Updated dependencies [05241c7]
• Upda...

  Description has been truncated

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.