[dependabot]

Bumps the production-dependencies group with 4 updates in the / directory: @larksuiteoapi/node-sdk, @xterm/addon-fit, @xterm/xterm and electron-updater.

Updates @larksuiteoapi/node-sdk from 1.72.0 to 1.76.0

Commits

• See full diff in compare view

Updates @xterm/addon-fit from 0.10.0 to 0.11.0

Commits

• ce1d788 Bumped bower version to 0.11
• 01e48b7 Revamped the attach addon
• a1717fd Update docs index
• c9f5f23 Started documenting methods
• 21dde3c Updated version, in docs
• 73bf6d1 Started documenting events
• See full diff in compare view

Updates @xterm/xterm from 5.5.0 to 6.0.0

Release notes

Sourced from @​xterm/xterm's releases.

6.0.0

Features

• #5453 Add synchronized output support (DEC mode 2026)
• #5436 add range to IHTMLSerializeOptions
• #5334 Support shadow dom in webgl renderer
• #5285 Support detailed ligatures and variants
• #5251 progress-addon
• #5234 Add reflowCursorLine option
• #5224 putty-style ED2 sequence handling as terminal option
• #5107 Add top/bottom border overview ruler options
  • ⚠️ This is a breaking change, ITerminalOptions.overviewRulerWidth is now a property of ITerminalOptions.overviewRuler
• #5096 Integrate base/ platform from VS Code and adopt scroll bar
  • ⚠️ This is a potential breaking change, the viewport/scroll bar works very differently now
• #5092 Add support for ESM via esbuild
• #5034 Expose onWriteParsed on API
• #4220 Add support to ANSI OSC52

Fixes

• #5445 Prefer performance.now() over Date.now()
• #5437 Prevent entire page from scrolling when scrolling in alt buffer with mouse event off
• #5423 Clear selection on vertical resize
• #5411 Fix teleport when exiting out of alt buffer. v2
• #5391 Bring back partial wheel tracking
• #5390 Fix scrollbar teleport after exiting alt buffer
• #5386 fix: ensure that currentRow can not go out of the range
• #5385 Fix terminal find when wrapped
• #5355 Add note about reverse tabnapping
• #5346 Remove alt -> ctrl+arrow hack in favor of embedder-specific solutions
  • ⚠️ This is a breaking change, you will need to add keybindings in your code if you want alt to map to ctrl still
• #5337 Fix finding terms across wrapped lines
• #5335 webgl: Ignore alpha channel when allowTransparency is false
• #5328 Refresh viewport after clear or ED
• #5305 Fix issue where listeners remain after WebglRenderer throws
• #5291 Make ProgressAddon.onChange non undefined
• #5282 Fixed CapsLock triggering input twice in MacOS.
• #5279 Fixes: #5270 regex case-sensitive should behave like monaco
• #5278 Handle glyph widths up to the maximum device texture size
• #5277 Disable ligatures when cursor is in range
• #5276 Fix selection rendering on ligatures in both renderers
• #5265 Revert to cursor options after DECSCUSR 0
• #5263 Make textarea readonly when disableStdin is set
• #5262 Blend cursorAccent with background too
• #5260 Blend cursor with background to support alpha in webgl
• #5253 bug: properly render the terminal when open() is called again
• #5249 Fix click event bug caused by DomRenderer replaceChildren behavior
• #5209 Ensure last ligature cell is updated
• #5208 Set liga font feature when ligatures is enabled
• #5182 fix #5181

... (truncated)

Commits

• f447274 Merge pull request #5463 from Tyriar/tyriar/v6
• f68d1e5 Skip sync output tests for now
• 30691e8 v6.0.0, bump addon versions, publish unicode graphemes
• 5fa6325 Merge pull request #5462 from Tyriar/tyriar/deprecated
• 3571d1f Remove windowsMode in favor of windowsPty
• ebc0d83 Remove deprecated/unused fastScrollModifier
• d1c50c1 Merge pull request #5461 from Tyriar/tyriar/glob
• 92b43bd Remove only
• a9d3ca1 Merge pull request #5449 from iSuslov/exports/esm-headless-node
• cb4d1ef Merge pull request #5453 from chrislloyd/feat/synchronized-output
• Additional commits viewable in compare view

Updates electron-updater from 6.8.9 to 6.8.11

Release notes

Sourced from electron-updater's releases.

electron-updater@6.8.11

Patch Changes

• Fix: reject missing and path-valued cached update file names [#10300](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10300) e5e3b41 @​claude

electron-updater@6.8.10

Patch Changes

• Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

  • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
  • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
  • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

• Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Changelog

Sourced from electron-updater's changelog.

6.8.11

Patch Changes

• Fix: reject missing and path-valued cached update file names [#10300](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10300) e5e3b41 @​claude

6.8.10

Patch Changes

• Fix: make multi-range differential downloads work on real servers. Three independent defects made downloadUpdate fall back to a full download with Response ends without calling any handlers: [#10219](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10219) 7dd7f8a @​claude

  • DataSplitter only recognised CRLF. Some CDNs answer multipart/byteranges with bare LF line endings, so no part was ever split and the whole response accumulated in memory. Header lists now end at whichever of \r\n\r\n / \n\n comes first, and the <EOL>--boundary separator size follows the line ending the server actually uses.
  • A header-list terminator split across two chunks was never found: only the new chunk was searched, the buffered bytes never were, so the parser locked onto the next part's header instead. Only the last few bytes of an unfinished header list are now carried over and searched together with the next chunk, instead of accumulating the whole list.
  • The 10s watchdog armed when a batch response ends was never disarmed after that batch succeeded. With more than 1000 operations (several range requests) it failed the whole download whenever a later batch took longer than the grace period.

• Fix: keep the cached blockmap consistent with the cached installer. A download round that did not produce a new blockmap (e.g. the differential download was skipped because the cached installer was evicted) now removes the cached current.blockmap instead of leaving a stale one next to the freshly cached file, which poisoned the next differential download and surfaced as a generic sha512 checksum mismatch before falling back to a full download (#10097). Leftover pending blockmaps from previous update rounds are also cleared before a fresh download. sha512-mismatch logging now distinguishes a differential download that failed against stale/corrupt cached inputs (including whether the old blockmap came from the local cache or the server) from a genuine checksum failure of a fully downloaded file. [#10163](https://github.com/electron-userland/electron-builder/tree/HEAD/packages/electron-updater/issues/10163) 1dfe1a9 @​claude

Commits

• e2a8604 chore(deploy): Release v26.18.0 (electron-updater@6.8.11) (v26) (#10250)
• e5e3b41 fix(updater): validate cached update filenames (v26 backport of #10115) (#10300)
• 5cdf017 chore(deploy): Release v26.17.0 (electron-updater@6.8.10) (v26) (#10191)
• 7dd7f8a fix(updater): make multi-range differential downloads work on real servers (v...
• 1dfe1a9 fix(electron-updater): keep cached blockmap consistent with cached installer ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions