Skip to content

[master] Michijs Dependabot changes - #417

Open
michijs[bot] wants to merge 1 commit into
masterfrom
michijs-dependabot
Open

[master] Michijs Dependabot changes#417
michijs[bot] wants to merge 1 commit into
masterfrom
michijs-dependabot

Conversation

@michijs

@michijs michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

@michijs

michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Bump yargs from 18.0.0 to 18.1.0

Changelog:
Sourced from releases.
        ### v18.1.0## [18.1.0](https://redirect.github.com/yargs/yargs/compare/v18.0.0...v18.1.0) (2026-07-26)

Features

  • ignore bun when getting bin name (b77831c)

Bug Fixes

  • lang: 'count' for de locale (#2476) (971e351)

  • local prototype pollution vulnerability in apply-extends (437f3a4)

  • locale: add Georgian translation (#2474) (086aeaa)

          ### v18.0.0## [18.0.0](https://redirect.github.com/yargs/yargs/compare/v17.7.2...v18.0.0) (2025-05-26)
    

⚠ BREAKING CHANGES

  • command names are not derived from modules passed to command.
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed.
  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
  • yargs is now ESM first

Features

Bug Fixes

  • addDirectory do not support absolute command dir (#2465) (3a40a78)
  • allows ESM modules commands to be extensible using visit option (#2468) (200e1aa)
  • browser: fix shims so that yargs continues working in browser context (#2457) (4ae5f57)
  • build: address problems with typescript compilation (#2445) (8d72fb3)
  • coerce should play well with parser configuration (#2308) (8343c66)
  • deps: update dependency yargs-parser to v22 (#2470) (639130d)
  • exit after async handler done (#2313) (e326cde)
  • handle spaces in bash completion (#2452) (83b7788)
  • parser-configuration should work well with generated completion script (#2332) (888db19)
  • propagate Dictionary including undefined in value type (#2393) (2b2f7f5)
  • zsh: completion no longer requires double tab when using autoloaded (0dd8fe4)

Code Refactoring

  • command names are not derived from modules passed to command. (d90af45)
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed. (d90af45)

Build System

  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23. (d90af45)
Commit history:
  • 34d833 feat: support creating completions for fish shell (#2568)

    Co-authored-by: Erik Giorgis <10909886+threddast@​users.noreply.redirect.github.com>

  • 3a4960 Remove copy-pasted email address (#2566)
  • 8878a8 chore(main): release 18.1.0 (#2475)

    Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.redirect.github.com>

  • db916b chore: add workflow_dispatch for release-please (#2564)
  • 4153e0 chore: improve build robustness (#2554)

    • pin GitHub actions
    • add package-lock.json
    • add CI test with updated direct dependencies
    • lint changes from updates
    • in CI stop overriding npm version
    • in CI use "npm ci" instead of "npm install"
    • 186d2e docs: clarify nargs option-like values (#2551)
    • c61563 docs: fix various typos in source code (#2525)
    • 7c76d0 docs: fix broken links in api.md (#2549)

    Co-authored-by: Patrick Wehbe <patrick.wehbe.applications@​gmail.com>

  • 37e2e5 chore: fix .wrap() docs (#2493)
  • 547e30 chore: update the easy dependencies (#2552)
  • e08668 chore(deps): update dependency cross-env to v10 (#2480)

    Co-authored-by: renovate[bot] <29139614+renovate[bot]@​users.noreply.redirect.github.com>

  • 88f548 chore: fix typos (#2492)
  • 9c92a2 chore: add 16.2.2 and 17.7.3 to changelog
  • 5188a9 chore: replace EOL node 23 in CI version matrix with node 24 (#2507)
  • 5e5895 chore: reapply formatting to fix lint checks (#2511)
  • 437f3a fix: prototype pollution vulnerability in apply-extends (#2498)
  • 971e35 fix(lang): 'count' for de locale (#2476)

    Changing de localization for 'count' to 'Anzahl' because 'Zähler' is closer to 'counter'

  • 086aea fix(locale): add Georgian translation (#2474)

    Co-authored-by: Benjamin E. Coe <bencoe@​gmail.com>

  • b77831 feat: ignore bun when getting bin name
  • 0bc725 chore(main): release 18.0.0 (#2325)

    Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@​users.noreply.redirect.github.com>

  • 639130 fix(deps): update dependency yargs-parser to v22 (#2470)

    Co-authored-by: renovate[bot] <29139614+renovate[bot]@​users.noreply.redirect.github.com>

  • 200e1a fix: allows ESM modules commands to be extensible using visit option (#2468)
  • 888db1 fix: parser-configuration should work well with generated completion script (#2332)
  • 3a40a7 fix: addDirectory do not support absolute command dir (#2465)
  • 90e9ec docs: remove to old slack channel (#2466)
  • 0dd8fe fix(zsh): completion no longer requires double tab when using autoloaded
  • 27eec1 feat: commandDir now works with ESM files (#2461)
  • f9c72a docs: update examples to run from examples folder (#2463)
  • e02c91 feat(zsh): Add default completion as fallback (#2331)

    Fallback to default completion if no match was found (see
    https://zsh.sourceforge.io/Doc/Release/Completion-System.html#Completion-Functions
    for details on _default).

    Co-authored-by: John Gee <john@​ruru.gen.nz>
    Co-authored-by: Benjamin E. Coe <bencoe@​google.com>

  • 8831df docs: remove dead link in README (#2458)

@michijs

michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Bump @​types/node from 26.1.1 to 26.1.2

Commit history:
  • a5f39d 🤖 Merge PR #75341 [forge-apis] Add missing setDebug export by @​asjad3

    Co-authored-by: Asjad Abbas <215788583+asjad3@​users.noreply.redirect.github.com>

  • dbba9e 🤖 Merge PR #75145 feat(sharetribe-flex-sdk): update type definitions to v1.24 by @​jayenashar
  • e0845b 🤖 Merge PR #75146 feat(sharetribe-flex-integration-sdk): update type definitions to v1.13 by @​jayenashar
  • 96da35 🤖 Merge PR #75230 feat(semver): add truncate function by @​clemyan
  • 0f2341 🤖 Merge PR #75300 Add types for wicg-ua-client-hints by @​jeremy-code
  • 4c11be 🤖 Merge PR #75242 Add types for radio-browser by @​CodeBeater
  • f0faac 🤖 Merge PR #75247 [codemirror] Fix invalid letter case of loadmode addon file name by @​xemlock
  • f9d98b 🤖 Merge PR #75213 [luxon] Fix DateTime#isDateTime type-guard to narrow types correctly by @​CBx0-dev
  • 20cf6d 🤖 dprint fmt
  • a9f3d1 🤖 Merge PR #75272 pg: Add missing 'verify' option to PoolConfig by @​Samuelsibuea
  • 4bcbb3 🤖 Merge PR #75271 better-sqlite3: Bump to 9.6.9999 by @​Samuelsibuea
  • d16811 🤖 Merge PR #75204 feat(leaflet): Widen DivIconOptions.html type to Element by @​hkleungai
  • 8cefc2 🤖 Merge PR #75199 Lodash: Add support for missing module level lodash exports. by @​macornwell
  • a33d3d 🤖 Merge PR #75167 fix(depd): Augmented process.listeners should return functions by @​RobinTail
  • 94619a 🤖 Merge PR #75325 mpv-script: add mp.format_time by @​sharpchen
  • 6079f5 🤖 Merge PR #75210 mpv-script: add mp.input.* by @​sharpchen
  • d6df58 🤖 Merge PR #75313 Add type definitions for mime-match by @​remcohaszing
  • 7ac563 🤖 Merge PR #75315 Add type definitions for get-form-data by @​remcohaszing
  • 929735 [office-js, office-js-preview] Revise the TrackedObjects.remove description (#75337)
  • a64f76 🤖 Merge PR #75321 [chrome] fix chrome.alarms.AlarmCreateInfo() by @​erwanjugand
  • 72af9a 🤖 Merge PR #75318 [chrome] fix chrome.system.display.setMirrorMode() by @​erwanjugand
  • 51936b 🤖 Merge PR #75317 [chrome] fix chrome.identity.getAuthToken() by @​erwanjugand
  • 95f8bf 🤖 Merge PR #75335 [chrome] update since Chrome 151 by @​erwanjugand
  • 759858 🤖 Merge PR #75304 [pg] Make PoolClient extend Client by @​bobnil

    Co-authored-by: Robert I Nilsson <robert.i.nilsson@​callclue.com>

  • ebe04c Remove contributors with deleted accounts (#75312)

    Co-authored-by: typescript-automation[bot] <290192711+typescript-automation[bot]@​users.noreply.redirect.github.com>
    Co-authored-by: Ryan Cavanaugh <RyanCavanaugh@​users.noreply.redirect.github.com>

  • 229ee6 🤖 Merge PR #75243 [koa-favicon] Fix maxage option to maxAge by @​unrevised6419

    Co-authored-by: Claude Opus 4.8 (1M context) <noreply@​anthropic.com>

  • d939d7 🤖 Merge PR #75301 Remove types for @​commerce7/admin-ui by @​Weldawadyathink

    Co-authored-by: Jake Bailey <5341706+jakebailey@​users.noreply.redirect.github.com>

  • df2b71 [office-js] [office-js-preview] (Access) Ensure that deprecation warn… (#75336)
  • 8589d9 🤖 Merge PR #75286 [clearoutio__clearout] Remove, bundled with @​clearoutio/clearout by @​max-programming
  • 5bd77b 🤖 Merge PR #75235 CoverageJSON Update: Rework how CoverageCollection,Coverage generics work. Add bounds property to axes by @​murithigeo

@michijs

michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Bump playwright-core from 1.61.1 to 1.62.1

Changelog:
Sourced from releases.
        ### v1.62.1### Bug Fixes
  • #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)

  • #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)

  • #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG

  • #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62

  • #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

          ### v1.62.0## 🧱 New component testing model
    

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

Evaluation

Command line & MCP

Reporters

  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

  • ⚠️ Debian 11 is not supported anymore.

Browser Versions

  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151

  • Microsoft Edge 151

          ### v1.61.1### Bug Fixes
    
  • #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher

  • #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)

  • #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000

  • #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15

  • #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

Commit history:
  • 15b1ae perf(mcp): skip aria snapshot capture when the response discards it (#41923)
  • aca9de feat(chromium): roll to r1237 (#42072)
  • 368941 feat(codegen): do not use contenteditable text in generated fill selectors (#42059)
  • 30d5b2 feat(webkit): roll to r2341 (#42061)
  • 048471 fix(test-runner): recover beforeAll-skipped tests for --last-failed (#42056)

    Co-authored-by: piotrkozlowski <piotr.kozlowski@​housecallpro.com>

  • e20123 feat(trace-viewer): show test annotations in the trace viewer (#42060)
  • 7c5b61 docs: fix broken links to device descriptors file (#42036)
  • e79f5e docs: fix playwright-cli skill link in triage skill (#42045)
  • 38cf18 docs(browsers): update device parameters link (#42048)
  • fcc765 test(bidi): unskip accept-language header websocket test (#42055)
  • f2ff01 fix(cli): exit with non-zero code when the tool result is an error (#42042)
  • 8538a4 fix(cli): accept multiple files in upload command (#42057)
  • 15ce5e feat(chromium): roll to r1236 (#42038)

    Co-authored-by: microsoft-playwright-automation[bot] <203992400+microsoft-playwright-automation[bot]@​users.noreply.redirect.github.com>

  • 399c65 chore(bidi): add support for the local-network-access permission (#42054)
  • d54cb3 test(page): cover file URL to about:blank navigation (#42053)

    Co-authored-by: Copilot App <223556219+Copilot@​users.noreply.redirect.github.com>

  • f4aa88 feat(test): add reducedMotion, forcedColors, contrast as standalone test options (#42051)

    Co-authored-by: Copilot App <223556219+Copilot@​users.noreply.redirect.github.com>
    Copilot-Session: cdc363d4-9231-4434-9746-606630175ad2

  • 1e6a5e test(mcp): fix flaky dashboard -s activation test on firefox (#42049)

    Co-authored-by: Copilot <223556219+Copilot@​users.noreply.redirect.github.com>

  • e4e04a docs: release notes for v1.62 Python, Java, and .NET (#42043)

    Add the Version 1.62 section to release-notes-python.md, release-notes-java.md, and release-notes-csharp.md, covering the cross-language 1.62 features:

    • WebP screenshots via [method: Page.screenshot] / [method: Locator.screenshot]
    • new scroll action option
    • [method: Locator.waitForFunction]
    • [method: APIResponse.timing]

    Should be cherry-picked to release-1.62 alongside the language rolls.

  • 0e057b docs(release-notes): mention the isolated headless clipboard in 1.62 (#42040)

    headless browsers keep the clipboard to themselves instead of sharing the clipboard of the operating system, which WebKit on macOS started doing in build 2334

    announce it in the 1.62 release notes so that anyone who relied on the clipboard of the machine being involved knows what changed

  • d7775e feat(selectors): add pierceFrames context option (#42033)
  • 887b42 fix(mcp): clear dialog modal state when dialog is closed out of band (#42032)
  • beaf22 chore: remove firefox-beta and chromium-tip-of-tree channels (#42030)
  • d0c1b7 feat(selectors): support entering frames while piercing (#42031)
  • e3db3e fix(aria): keep icon-only clickable elements in ai snapshots (#42034)
  • 0b2088 docs(assertions): fix pytest-playwright version for soft assertions (#42026)
  • b8e76e fix(recorder): don't record duplicate goto for repeated navigation signal (#42027)

    Co-authored-by: Copilot <223556219+Copilot@​users.noreply.redirect.github.com>

  • 4bb09e chore: remove ubuntu 20.04 browser builds (#42017)
  • 974edd feat(dialog): add dialogclosed event (#42014)
  • 05709a fix(selectors): respect scope when piercing frames (#42018)
  • 63ff5d fix(runner): do not force-kill worker while its teardown is in progress (#42010)

@michijs

michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Bump colorthief from 3.4.0 to 3.5.0

Changelog:
Sourced from releases.
        ### v3.5.0## Region extraction 🖼️

Sample colors from part of an image instead of the whole thing — the most-requested evergreen feature, open since 2021 (#176, with earlier attempts in #44 and #90). Thanks @​runshotgun for the original ask.

New region option

Coordinates are fractions of the image size (0–1) from the top-left, so a region is resolution-independent — the same values work on a thumbnail and the full-size original.

// Colors from the bottom third — e.g. for a gradient overlapping the image
const palette = await getPalette(img, {
    region: { x: 0, y: 0.66, width: 1, height: 0.34 },
});

// Center crop
const color = await getColor(img, {
    region: { x: 0.25, y: 0.25, width: 0.5, height: 0.5 },
});

Works everywhere an option object does: getColor, getPalette, getSwatches, getPaletteProgressive, the *Sync functions, observe(), and the CLI — in both browser and Node.

colorthief image.jpg --region 0,0.66,1,0.34

What changed

  • Cropping happens on the decoded pixel buffer right after loading, before sampling — so every entry point gets region support, including custom loaders and quantizers supplied via configure().
  • Regions are validated up front, so a malformed rect throws before the image is decoded rather than after.
  • A region running past the right or bottom edge is clamped to the image; out-of-range or zero-sized values throw.
  • Proportions are relative to the region, not the whole image.

⚠️ The worker option is now a no-op

worker: true is still accepted but ignored, and logs a one-time deprecation warning. The isWorkerSupported, extractInWorker, and terminateWorker exports from colorthief/internals are now no-op shims. Nothing breaks in v3 — all of it is removed in v4.

It cost more than it saved. Only quantization ran off-thread. Decoding, pixel sampling, and the structured clone of the pixel array all stayed on the main thread — and serializing Array<[r, g, b]> (one small array per sampled pixel) ran several times longer than the quantization it avoided:

Image Quantize (what the worker saved) Structured clone
0.3 MP, quality 10 0.7 ms 2.9 ms
2 MP, quality 10 2.5 ms 19.9 ms
12 MP, quality 10 12.9 ms 199 ms

The gap widens as images get larger — the opposite of how the feature was meant to scale.

It was also returning different colors. The worker carried a hand-inlined copy of MMCQ that quantized in RGB while the main path defaults to OKLCH, and it skipped the few-color short-circuit and filter relaxation. Two calls differing only by worker: true disagreed. Routing the flag through the normal pipeline makes them agree.

Getting extraction off the main thread

Run Color Thief inside your own worker and hand it an ImageBitmap. Bitmaps are transferable, so pixels move without being copied and the whole pipeline — decode, sampling, quantization — runs off-thread:

// main.js
const bitmap = await createImageBitmap(await (await fetch(url)).blob());
const worker = new Worker('./palette-worker.js', { type: 'module' });
worker.postMessage({ bitmap }, [bitmap]); // transferred, not cloned
worker.onmessage = (e) => render(e.data.palette);
// palette-worker.js
import { getPalette } from 'colorthief';

self.onmessage = async ({ data }) => {
    const palette = await getPalette(data.bitmap, { colorCount: 5 });
    // Color objects don't survive structured clone — send plain data
    self.postMessage({ palette: palette.map((c) => c.hex()) });
};

Smaller bundles

Deleting the inlined quantizer shrank every build:

Bundle Before After
dist/index.js 55.6 kB 46.2 kB −17%
dist/internals.js 45.0 kB 39.4 kB −13%
dist/umd/color-thief.global.js 30.0 kB 22.3 kB −25%

Notes

  • Backward compatible — no breaking changes. The only behavior change is that worker: true now returns the same palette as the default path instead of a different one.
  • The deprecation warning fires once per page load, not once per call.

Full changelog: https://redirect.github.com/lokesh/color-thief/compare/v3.4.1...v3.5.0

        ### v3.4.1Patch release fixing a bundler warning reported in #283.

Fixed

WasmQuantizer fell back to importing ../../dist/wasm/color_thief_wasm.js when constructed with no arguments, but that file has never been included in the published package. Bundlers resolving colorthief/internals — for example to use oklchToRgb — reported it as an unresolvable module. Applications built and ran correctly (the dead code was tree-shaken away), but every build printed a warning.

The wasm-bindgen glue module is now supplied by the caller:

import { WasmQuantizer } from 'colorthief/internals';
const q = new WasmQuantizer(await import('./pkg/color_thief_wasm.js'));
await q.init();

init() with no module now throws a message pointing at the wasm-pack build step. Neither of the old code paths could succeed from an npm install, so nothing that previously worked has changed.

Thanks to @​magic-akari for the report and diagnosis.

Full Changelog: https://redirect.github.com/lokesh/color-thief/compare/v3.4.0...v3.4.1

        ### v3.4.0## Wide-gamut (Display P3) support 🎨

Color Thief can now read and report wide-gamut colors, fixing incorrect results on P3-tagged images where out-of-sRGB colors were collapsed down to sRGB (thanks @​LeaVerou — #266).

New gamut option

Opt in per call (or via configure): 'srgb' (default), 'display-p3', or 'auto'.

const palette = await getPalette(img, { gamut: 'display-p3' });
palette[0].css();   // 'color(display-p3 …)'
palette[0].gamut;   // 'display-p3'

// 'auto' upgrades to P3 only when the image actually uses out-of-sRGB colors
const auto = await getPalette(img, { gamut: 'auto' });

What changed

  • Browser loaders read the image through a P3 canvas (getContext('2d', { colorSpace: 'display-p3' })) with feature detection and automatic sRGB fallback.
  • Gamut-aware OKLCH quantization preserves the extra saturation instead of clamping it away.
  • Color objects now carry .gamut. .css() emits color(display-p3 …) and .oklch() reports the true wider chroma, while .rgb()/.array()/.hex() stay sRGB (gamut-mapped) so existing consumers keep working. Use .rgb('display-p3') for raw P3 components.
  • Threaded through the async, sync, worker, and progressive paths.

Notes

  • Backward compatible — default behavior is unchanged sRGB.
  • Node output is sRGB for now; P3 there is tracked as a follow-up.

Full changelog: https://redirect.github.com/lokesh/color-thief/compare/v3.3.2...v3.4.0

Commit history:
  • a19bce Guard against referenced-but-unpublished files in the tarball ([master] Linting changes #286)
    • Apply non-breaking npm audit fix

    Bumps brace-expansion 2.1.1 -> 2.1.4, clearing two high-severity DoS
    advisories (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg), and picks up a
    mocha patch bump along the way. Lockfile only; no dependency ranges
    change.

    Three advisories are deliberately left in place:

    • esbuild is reachable only through tsup's ^0.27.0 range, while the
      fix landed in 0.28.1. Forcing it would mean an overrides entry
      pinning a 0.x minor ahead of what tsup was tested against, and the
      advisory covers arbitrary file read via esbuild's dev server on
      Windows — a server tsup never starts.
    • diff and serialize-javascript come in through mocha, and the only
      offered fix is a downgrade to mocha 11.3.0.
    • sharp needs 0.35.0, which requires Node >=20.9.0. That drops Node 18,
      so it is queued for v4 — see ROADMAP.md.
    • Add package contents check to CI

    Guards the class of bug behind Bump playwright-core from 1.49.1 to 1.50.1 #283, where dist/ shipped an import of
    dist/wasm/color_thief_wasm.js — a file the published tarball never
    contained. Builds still succeeded, since the dead code was tree-shaken,
    but every bundler resolving colorthief/internals printed an
    unresolvable-import warning and nothing in CI noticed. The fix went out
    in 3.4.1; this stops it recurring.

    scripts/check-package.mjs makes three assertions against the file list
    npm pack would actually produce:

    1. Every path package.json points at (exports, main, module, types, bin)
      is in the tarball.
    2. Every relative specifier emitted into dist/ resolves to a file in the
      tarball.
    3. The browser bundles carry no reference to sharp, so the Node loader
      cannot leak into a browser build.

    A plain regex over dist/ is unusable for (2): it reports four false
    positives on the current tree, because WasmQuantizer's "build this
    yourself" error message quotes an import(...) call inside a string, and
    the generated .d.ts doc comments show an illustrative import path.
    Neither is a reference a bundler would try to resolve. So the scanner
    blanks comments and replaces string literals with opaque placeholders
    before matching, and resolves the .js specifiers that declaration files
    use to the .d.ts siblings actually on disk.

    Verified it fails on all four import forms — bare side-effect import,
    dynamic import (the exact Bump playwright-core from 1.49.1 to 1.50.1 #283 shape), require, and re-export — plus a
    sharp leak and a package.json entry pointing at an unpublished file,
    while staying quiet on specifiers inside strings and comments.

    Wired into CI alongside npm run typecheck, which the package has had
    as a script but has never run in CI, and into prepublishOnly so a bad
    tarball cannot go out even when publishing by hand.

    • Queue sharp and Node floor bump for v4

    peerDependencies accepts sharp >=0.33.0, but every sharp below 0.35.0
    inherits four libvips CVEs (GHSA-f88m-g3jw-g9cj), so anyone auditing a
    project that installs the Node path can satisfy our range with a
    vulnerable sharp.

    The fix cannot ship in a 3.x minor: sharp 0.35 requires Node >=20.9.0,
    so raising the sharp floor also drops Node 18. Records the full change
    set for v4 — the peer range, an engines field the package has never
    declared, the CI matrix and .nvmrc move off Node 18 (EOL April 2025),
    and the matching devDependency bump.

    Until then 3.x keeps the wider range: sharp is an optional peer, browser
    users never install it, and Node users can choose 0.35+ themselves.

  • ba3d01 Add CHANGELOG.md

    Release notes previously lived only on GitHub, so anyone installing from
    npm had no in-package record of what changed between versions — which
    matters most for 3.5.0, where an option people may be passing (worker)
    silently became a no-op.

    Covers 3.5.0 back to 2.3.2, seeded from the existing GitHub release
    notes; earlier releases point at the GitHub releases page rather than
    inventing history for them. Notes that 3.3.2 and 2.5.0 were tagged on
    GitHub but never published to npm, and which release actually carried
    their changes.

    Adds CHANGELOG.md to the files array — npm does not include changelogs
    automatically, and files was scoped to dist/ and src/, so it would not
    otherwise ship. Cross-document links use absolute URLs since ROADMAP.md
    is not part of the tarball.

    Also links the changelog and roadmap from the README, and adds a
    changelog step to the release checklist so it stays current.

  • ff26aa 3.5.0
  • a377a6 Add region extraction, deprecate the Web Worker path

    Region extraction ([master] Linting changes #176)

    Sample a sub-rectangle instead of the whole image via region: { x, y, width, height } in normalized 0-1 coordinates, so the region is
    independent of pixel dimensions. The crop is applied to the decoded
    pixel buffer right after loading, before sampling — so async, sync,
    progressive, observe(), and the CLI all get it without changes, and so
    do custom loaders and quantizers supplied via configure(). Regions are
    validated up front, so a bad rect throws before the image is decoded.

    Also adds --region x,y,width,height to the CLI.

    Deprecate the Web Worker path

    worker: true is now accepted but ignored, and warns once. The three
    worker exports in colorthief/internals (isWorkerSupported,
    extractInWorker, terminateWorker) become no-op shims. All of it is
    removed in v4. Nothing breaks in v3.

    Offloading cost more than it saved. Only quantization ran off-thread;
    decode, pixel sampling, and the structured clone of the pixel array all
    stayed on the main thread — and serializing Array<[r, g, b]>, one
    small array per sampled pixel, ran several times longer than the
    quantization it avoided. At 2 MP / quality 10 that was ~20ms of cloning
    to skip ~2.5ms of quantizing, and the gap widens as images get larger.

    It was also drifting. The worker carried a hand-inlined copy of MMCQ
    that quantized in RGB while the main path defaults to OKLCH, and it
    skipped the few-color short-circuit and filter relaxation, so
    worker: true returned different colors than the default. Routing the
    flag through the normal pipeline makes both paths agree.

    Callers who want extraction off the main thread should run Color Thief
    inside their own worker with an ImageBitmap or OffscreenCanvas source:
    the whole pipeline moves off-thread and the bitmap transfers without
    copying. README has the recipe.

    Deleting the inlined quantizer also shrank the bundles: index.js
    55.6kB -> 46.2kB, internals.js 45.0kB -> 39.4kB, and the UMD global
    30.0kB -> 22.3kB.

    Tests: 183 node, 52 cypress, all passing.

  • 9be685 3.4.1
  • 4552e2 fix: remove dangling WASM import that warned in bundlers (Bump esbuild from 0.24.2 to 0.25.0 #285)

    WasmQuantizer fell back to import('../../dist/wasm/color_thief_wasm.js')
    when constructed with no arguments, but that file has never been included in
    the published package. Bundlers resolving colorthief/internals reported it
    as a missing module (Bump playwright-core from 1.49.1 to 1.50.1 #283). The other branch — fetching a .wasm URL and
    calling WebAssembly.instantiate directly — was also non-functional, since
    the wasm-bindgen quantize(&[u8]) -> Vec<u8> signature needs the generated
    JS glue for marshalling.

    The glue module is now supplied by the caller:

    const q = new WasmQuantizer(await import('./pkg/color_thief_wasm.js'));
    

    init() with no module throws a message pointing at the wasm-pack build
    step instead of failing on a path that was never shipped. Nothing that
    previously worked changes — neither code path could succeed from npm.

    Adds regression coverage: WasmQuantizer init/error behavior, and an
    assertion that no built bundle references the unshipped dist/wasm path.

    Closes Bump playwright-core from 1.49.1 to 1.50.1 #283

  • 847363 3.4.0
  • 39e6c0 Add wide-gamut (Display P3) support (Bump typescript from 5.7.2 to 5.7.3 #282)

    Fixes Bump @types/node from 22.8.1 to 22.8.7 #266: extraction of P3-tagged / wide-gamut images previously
    collapsed out-of-sRGB colors (e.g. P3 red read as sRGB red), losing the
    extra saturation.

    Adds an opt-in gamut option ('srgb' default, 'display-p3', 'auto'):

    • Browser loaders read through a P3 canvas (getContext colorSpace) with
      feature detection + sRGB fallback; shared canvas logic factored into
      loaders/canvas-utils.ts (removing browser/sync duplication).
    • Quantization runs in gamut-aware OKLCH; color-space.ts gains P3 matrices
      (composed via XYZ, sRGB path kept byte-identical), isOutOfSrgbGamut,
      p3ToSrgb/srgbToP3, and gamut-aware luminance.
    • Color objects carry .gamut: css() emits color(display-p3 ...) and
      oklch() reports the true wider chroma, while rgb()/array()/hex() stay
      sRGB (gamut-mapped) so existing consumers don't break. rgb('display-p3')
      exposes raw P3 components.
    • 'auto' upgrades to P3 only when a sampled pixel falls outside sRGB.
    • Threaded through pipeline, worker, sync, and progressive paths.
    • resolveOutputGamut: explicit 'srgb' request now always wins.

    Node output stays sRGB for now (loader accepts the option); documented as
    a follow-up.

    Tests: +31 node tests (gamut math, pipeline integration via synthetic P3
    buffers, Color accessors, prior gaps) and a new Cypress spec with a real
    P3-tagged PNG covering img/canvas/ImageData/worker paths.

  • 75b35a 3.3.2
  • 94d0e6 docs: move transparency detection to intentionally-left-out
  • 505fa2 refactor: improve performance and accuracy for images with few colors (Bump @types/node from 22.10.2 to 22.10.6 #281)

    Verified locally: read the full diff, traced control flow, built clean, and all 82 node tests pass (ESM + CJS).

    The short-circuit for few-color images now runs before the RGB→OKLCH→RGB conversion, so images with fewer distinct colors than requested return their exact original RGB instead of a round-trip approximation (e.g. pure red comes back as 255,0,0, not 254,0,1). The early break also bounds the unique-color scan so complex images pay ~nothing. Nice accuracy + perf win.

    Two non-blocking notes for future reference:

    • The short-circuit now applies to any quantizer (WASM, custom via configure()), not just MMCQ — an improvement, but MmcqQuantizer called directly via colorthief/internals no longer self-short-circuits.
    • The worker path (extractInWorker) is separate and already bypassed both OKLCH and the short-circuit; unchanged here, but that main-thread/worker inconsistency remains worth a future issue.

    Thanks @​ksubileau!

  • 51a47a docs: add feature roadmap items from monthly health report

    Add transparency detection ([master] Linting changes #213), region/area extraction ([master] Linting changes #176),
    wide-gamut/display-P3 fix (Bump @types/node from 22.8.1 to 22.8.7 #266), and accessible scheme generation
    as forward-looking items alongside the WASM productization entry.

  • 36079c docs: replace PLAN.md and V3.md with ROADMAP.md

    Everything in the v2 plan and v3 rewrite docs has shipped as of 3.3.1.
    Consolidate the one remaining forward-looking item (productizing the
    WASM quantizer) into ROADMAP.md and drop the superseded docs.

  • 01dc0f 3.3.1
  • 32841a docs: update CLI references to colorthief-cli and add ./cli export

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • e1ceaa fix: apply npm pkg fix corrections for publish

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • 6f1c22 3.3.0
  • 8ed36e Merge pull request Bump @types/node from 22.10.2 to 22.10.5 #280 from lokesh/cli

    feat: add CLI tool for extracting colors from images

  • 13dbd7 feat: add CLI tool for extracting colors from images

    Adds colorthief CLI with color, palette, and swatches subcommands.
    Supports --json, --css, and ANSI output formats, stdin piping, multi-file
    input, and a friendly error message when sharp is not installed.

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • 94dcd3 docs: update default color space in README and TypeScript interfaces to 'oklch'
  • 27fa20 3.2.0
  • 012f96 fix: add browser-specific builds to eliminate sharp warnings in bundlers

    Browser bundlers (webpack/Angular, Vite, etc.) were warning about the
    unresolvable 'sharp' dependency even though it's only used in Node.js.
    Adds conditional exports with a "browser" condition that points to builds
    with no sharp or Node loader references.

    Closes Bump esbuild from 0.24.0 to 0.24.2 #279

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • f39d44 3.1.0
  • 8be08f docs: fix branch name in releasing instructions

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • 58f480 set default colorspace for paalette to oklch
  • a79371 Merge pull request Bump playwright-core from 1.49.0 to 1.49.1 #277 from lokesh/v3

    v3: TypeScript rewrite with unified API

  • e8e4d0 refactor: remove legacy color extraction code and update package metadata

    • Deleted outdated TypeScript definitions and JavaScript implementations for color extraction.

    • Updated package.json description for clarity on functionality.

    • Removed unnecessary dependency on quantize from package-lock.json.

    • Added release instructions to README for better project management.

    • d37c74 feat: implement live extraction with observe() for video, canvas, and img elements

    • Add observe() function to reactively watch video, canvas, or img elements and emit palette updates.

    • Enhance README with usage examples and documentation for live extraction feature.

    • Update index.html to demonstrate the new observe() functionality with a video element.

    • Export observe() and related types from the library for TypeScript support.

    • 709d2d feat: add .css() method, proportion, video/OffscreenCanvas support, fix worker, rewrite README

    • Add css(format?) method to Color for CSS color strings (rgb, hsl, oklch)

    • Add proportion (0–1) to Color, computed from population after quantization

    • Add HTMLVideoElement and OffscreenCanvas to BrowserSource in both async and sync loaders

    • Rewrite Web Worker with self-contained inlined MMCQ quantizer

    • Rewrite README for v3 with quick start, features, and API tables

    • Update index.html demo page with new Color properties

    • Add tests for css(), proportion, and updated isColorObject helper

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

  • c5aa7c feat: inline quantize dependency, simplify build, update tests and docs

    • Rewrite MMCQ quantizer as inline TypeScript with population tracking,
      replacing the @​lokesh.dhakar/quantize npm dependency (zero runtime deps)
    • Collapse browser/node builds into single output dir (dist/) with
      splitting disabled — eliminates all chunk files
    • Simplify package.json exports (no more browser/node conditions)
    • Add CJS require() test coverage
    • Add "Loading the Library" section to index.html examples page
    • Update all test pages and Cypress specs for v3 API
    • Remove quantize type declaration shim from declarations.d.ts

    Co-Authored-By: Claude Opus 4.6 <noreply@​anthropic.com>

@michijs

michijs Bot commented Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Bump @​types/chrome from ^0.2.2 to ^0.2.5

Commit history:
  • a5f39d 🤖 Merge PR #75341 [forge-apis] Add missing setDebug export by @​asjad3

    Co-authored-by: Asjad Abbas <215788583+asjad3@​users.noreply.redirect.github.com>

  • dbba9e 🤖 Merge PR #75145 feat(sharetribe-flex-sdk): update type definitions to v1.24 by @​jayenashar
  • e0845b 🤖 Merge PR #75146 feat(sharetribe-flex-integration-sdk): update type definitions to v1.13 by @​jayenashar
  • 96da35 🤖 Merge PR #75230 feat(semver): add truncate function by @​clemyan
  • 0f2341 🤖 Merge PR #75300 Add types for wicg-ua-client-hints by @​jeremy-code
  • 4c11be 🤖 Merge PR #75242 Add types for radio-browser by @​CodeBeater
  • f0faac 🤖 Merge PR #75247 [codemirror] Fix invalid letter case of loadmode addon file name by @​xemlock
  • f9d98b 🤖 Merge PR #75213 [luxon] Fix DateTime#isDateTime type-guard to narrow types correctly by @​CBx0-dev
  • 20cf6d 🤖 dprint fmt
  • a9f3d1 🤖 Merge PR #75272 pg: Add missing 'verify' option to PoolConfig by @​Samuelsibuea
  • 4bcbb3 🤖 Merge PR #75271 better-sqlite3: Bump to 9.6.9999 by @​Samuelsibuea
  • d16811 🤖 Merge PR #75204 feat(leaflet): Widen DivIconOptions.html type to Element by @​hkleungai
  • 8cefc2 🤖 Merge PR #75199 Lodash: Add support for missing module level lodash exports. by @​macornwell
  • a33d3d 🤖 Merge PR #75167 fix(depd): Augmented process.listeners should return functions by @​RobinTail
  • 94619a 🤖 Merge PR #75325 mpv-script: add mp.format_time by @​sharpchen
  • 6079f5 🤖 Merge PR #75210 mpv-script: add mp.input.* by @​sharpchen
  • d6df58 🤖 Merge PR #75313 Add type definitions for mime-match by @​remcohaszing
  • 7ac563 🤖 Merge PR #75315 Add type definitions for get-form-data by @​remcohaszing
  • 929735 [office-js, office-js-preview] Revise the TrackedObjects.remove description (#75337)
  • a64f76 🤖 Merge PR #75321 [chrome] fix chrome.alarms.AlarmCreateInfo() by @​erwanjugand
  • 72af9a 🤖 Merge PR #75318 [chrome] fix chrome.system.display.setMirrorMode() by @​erwanjugand
  • 51936b 🤖 Merge PR #75317 [chrome] fix chrome.identity.getAuthToken() by @​erwanjugand
  • 95f8bf 🤖 Merge PR #75335 [chrome] update since Chrome 151 by @​erwanjugand
  • 759858 🤖 Merge PR #75304 [pg] Make PoolClient extend Client by @​bobnil

    Co-authored-by: Robert I Nilsson <robert.i.nilsson@​callclue.com>

  • ebe04c Remove contributors with deleted accounts (#75312)

    Co-authored-by: typescript-automation[bot] <290192711+typescript-automation[bot]@​users.noreply.redirect.github.com>
    Co-authored-by: Ryan Cavanaugh <RyanCavanaugh@​users.noreply.redirect.github.com>

  • 229ee6 🤖 Merge PR #75243 [koa-favicon] Fix maxage option to maxAge by @​unrevised6419

    Co-authored-by: Claude Opus 4.8 (1M context) <noreply@​anthropic.com>

  • d939d7 🤖 Merge PR #75301 Remove types for @​commerce7/admin-ui by @​Weldawadyathink

    Co-authored-by: Jake Bailey <5341706+jakebailey@​users.noreply.redirect.github.com>

  • df2b71 [office-js] [office-js-preview] (Access) Ensure that deprecation warn… (#75336)
  • 8589d9 🤖 Merge PR #75286 [clearoutio__clearout] Remove, bundled with @​clearoutio/clearout by @​max-programming
  • 5bd77b 🤖 Merge PR #75235 CoverageJSON Update: Rework how CoverageCollection,Coverage generics work. Add bounds property to axes by @​murithigeo

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants