chore(deps): consolidate reviewed updates and repair peer and license gates

.github/scripts/dependency-cohort.test.mjs

@@ -4,28 +4,75 @@ import { test } from 'node:test'
 const read = (path) => readFileSync(new URL(`../../${path}`, import.meta.url), 'utf8')
 function angularCohort(manifest) {
   const dependencies = { ...manifest.dependencies, ...manifest.devDependencies }
+  const toolingNames = new Set(['@angular/build', '@angular/cli'])
   for (const name of [
     'common',
     'compiler',
     'core',
     'platform-browser',
+    'compiler-cli',
     'build',
-    'cli',
-    'compiler-cli'
-  ])
+    'cli'
+  ]) {
     assert.ok(dependencies[`@angular/${name}`], `Missing Angular cohort member: ${name}`)
-  const versions = Object.entries(dependencies)
-    .filter(([name]) => name.startsWith('@angular/'))
+  }
+  const entries = Object.entries(dependencies).filter(([name]) => name.startsWith('@angular/'))
+  for (const [name, version] of entries) {
+    assert.match(version, /^\d+\.\d+\.\d+$/, `${name} must pin a stable exact version`)
+  }
+  const framework = entries
+    .filter(([name]) => !toolingNames.has(name))
     .map(([, version]) => version)
-  assert.equal(new Set(versions).size, 1, 'Angular framework and tooling must use one exact cohort')
-  assert.match(versions[0], /^\d+\.\d+\.\d+$/, 'Angular fixture must pin stable exact versions')
+  const tooling = [...toolingNames].map((name) => dependencies[name])
+  // Framework packages have exact compiler/core peers; CLI/build publish patches separately.
+  assert.equal(
+    new Set(framework).size,
+    1,
+    'Angular framework and compiler must use one exact cohort'
+  )
+  assert.equal(new Set(tooling).size, 1, 'Angular build and CLI must use one exact tooling cohort')
+  // Keep this fixture on a reviewed release line. npm install/ls verifies actual peer ranges.
+  assert.equal(
+    framework[0].split('.').slice(0, 2).join('.'),
+    tooling[0].split('.').slice(0, 2).join('.'),
+    'Angular framework/tooling release lines must match'
+  )
 }
 const fixture = JSON.parse(read('apps/component-demo/test/angular-pptx/package.json'))
-test('cold Angular consumer pins a complete aligned cohort', () => angularCohort(fixture))
-test('a single-package Angular bump fails before installation', () => {
+test('cold Angular consumer pins coherent framework and tooling groups', () =>
+  angularCohort(fixture))
+test('independently released tooling patches are accepted', () => {
+  const changed = structuredClone(fixture)
+  for (const section of ['dependencies', 'devDependencies'])
+    for (const key of Object.keys(changed[section] || {})) {
+      if (key.startsWith('@angular/'))
+        changed[section][key] = ['@angular/build', '@angular/cli'].includes(key)
+          ? '22.1.7'
+          : '22.1.6'
+    }
+  angularCohort(changed)
+})
+test('split framework peers still fail before installation', () => {
   const changed = structuredClone(fixture)
   changed.dependencies['@angular/core'] = '0.0.0'
-  assert.throws(() => angularCohort(changed), /one exact cohort/)
+  assert.throws(() => angularCohort(changed), /framework and compiler/)
+})
+test('split tooling releases and mixed release lines fail', () => {
+  const changed = structuredClone(fixture)
+  changed.devDependencies['@angular/cli'] = '0.0.0'
+  assert.throws(() => angularCohort(changed), /tooling cohort/)
+  changed.devDependencies['@angular/build'] = '0.0.0'
+  assert.throws(() => angularCohort(changed), /release lines/)
+})
+test('missing members, ranges and prerelease versions are rejected', () => {
+  for (const invalid of ['^22.1.7', 'latest', '22.1.7-rc.1']) {
+    const changed = structuredClone(fixture)
+    changed.devDependencies['@angular/cli'] = invalid
+    assert.throws(() => angularCohort(changed), /stable exact version/)
+  }
+  const changed = structuredClone(fixture)
+  delete changed.devDependencies['@angular/compiler-cli']
+  assert.throws(() => angularCohort(changed), /Missing Angular/)
 })
 test('thumbnail manifest agrees with workspace Vitest security override', () => {
   const thumbnail = JSON.parse(read('packages/thumbnail/package.json'))

.github/workflows/public-ci.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.0.9
           run_install: false
@@ -87,6 +87,9 @@ jobs:
       - name: Install Chromium and WebKit
         run: pnpm exec playwright install --with-deps chromium webkit
 
+      - name: Verify the shipped Avro browser bundle and Node shim isolation
+        run: pnpm --filter @file-viewer/renderer-data verify:avro-browser
+
       - name: Verify official IFC4 and IFC4.3 rendering, picking and Worker cleanup
         run: |
           node packages/renderers/3d/scripts/download-ifc-fixtures.mjs /tmp/ifc-samples
@@ -130,7 +133,7 @@ jobs:
 
       - name: Upload packed-consumer failure evidence
         if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: packed-issue-consumer-evidence
           path: output/packed-issue-consumer/*/angular-regression-evidence

.github/workflows/security.yml

@@ -38,7 +38,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           version: 11.0.9
           run_install: false

apps/component-demo/package.json

@@ -33,8 +33,8 @@
   "devDependencies": {
     "@types/jquery": "^4.0.1",
     "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "requirejs": "2.3.7",
+    "@types/react-dom": "^19.2.7",
+    "requirejs": "2.3.8",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"
   }

apps/component-demo/scripts/verify-angular-pptx-consumer.mjs

@@ -25,7 +25,8 @@ const project = process.env.PACKED_ANGULAR_CONSUMER_DIR
 const output = resolve(project, 'angular-regression-evidence')
 await mkdir(output, { recursive: true })
 const require = createRequire(import.meta.url)
-const JSZip = createRequire(resolve(project, 'package.json'))('jszip')
+const consumerRequire = createRequire(resolve(project, 'package.json'))
+const JSZip = consumerRequire('jszip')
 const archive = await JSZip.loadAsync(await readFile(resolve(project, 'public/sample.pptx')))
 const presentation = await archive.file('ppt/presentation.xml').async('string')
 const expectedSlides = (presentation.match(/<p:sldId\b/g) || []).length
@@ -49,7 +50,11 @@ const browser = await (playwright.chromium || playwright.default.chromium).launc
 })
 const report = {
   project,
-  angular: '22.0.7',
+  angular: consumerRequire('@angular/core/package.json').version,
+  tooling: {
+    build: consumerRequire('@angular/build/package.json').version,
+    cli: consumerRequire('@angular/cli/package.json').version
+  },
   baseHref: '/ui/',
   expectedSlides,
   cases: [],

apps/component-demo/test/angular-pptx/package.json

@@ -18,8 +18,8 @@
     "tslib": "2.8.1"
   },
   "devDependencies": {
-    "@angular/build": "22.1.6",
-    "@angular/cli": "22.1.6",
+    "@angular/build": "22.1.7",
+    "@angular/cli": "22.1.7",
     "@angular/compiler-cli": "22.1.6",
     "typescript": "6.0.3"
   }

apps/docs-site/package.json

@@ -15,21 +15,21 @@
     "@tabler/icons-react": "3.46.0",
     "cnfast": "^0.2.0",
     "flexsearch": "0.8.212",
-    "fumadocs-core": "16.15.4",
+    "fumadocs-core": "16.15.8",
     "fumadocs-mdx": "15.4.0",
     "fumadocs-ui": "npm:@fumadocs/base-ui@16.14.4",
-    "next": "16.3.3",
+    "next": "16.3.4",
     "react": "^19.2.8",
     "react-dom": "^19.2.8"
   },
   "devDependencies": {
     "@tailwindcss/postcss": "^4.3.3",
     "@types/flexsearch": "^0.7.42",
     "@types/mdx": "^2.0.14",
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.4",
-    "postcss": "^8.5.26",
+    "@types/react-dom": "^19.2.7",
+    "postcss": "^8.5.28",
     "serve": "^14.2.6",
     "tailwindcss": "^4.3.3",
     "typescript": "^6.0.3"

apps/official-site/package.json

@@ -9,7 +9,7 @@
     "preview": "vite preview --host 127.0.0.1"
   },
   "dependencies": {
-    "@lucide/vue": "^1.37.0",
+    "@lucide/vue": "^1.43.0",
     "highlight.js": "^11.11.1",
     "vue": "^3.5.42"
   },

apps/viewer-demo/package.json

@@ -17,13 +17,13 @@
     "@file-viewer/renderer-signature": "workspace:3.0.3",
     "@file-viewer/web": "workspace:3.0.3",
     "@file-viewer/vue3": "workspace:3.0.3",
-    "@lucide/vue": "^1.37.0",
+    "@lucide/vue": "^1.43.0",
     "diff": "^9.0.0",
     "qs": "^6.16.0",
     "vue": "^3.5.42"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "@types/qs": "^6.15.1",
     "@vitejs/plugin-vue": "^6.0.7",
     "@vitejs/plugin-vue-jsx": "^5.1.5",

docs/maintenance/dependency-review-20260912.md

@@ -0,0 +1,88 @@
+# Dependency review and release handoff — 2026-09-12
+
+This follow-up reviews the six dependency PRs opened after the merged #278.
+The earlier IFC/issue review remains in `pr-issue-review-20260912.md`. No npm
+publication, package version bump, release tag or issue closure is performed.
+
+## Decisions
+
+| Proposal | Disposition in this integration |
+| --- | --- |
+| #279 | Adopt the pinned pnpm/action-setup 6.1.0 and upload-artifact 7.0.1 revisions. Keep pnpm 11.0.9, Node 24, archive format and all audit thresholds unchanged. Both Actions have executed in the qualification, including a real artifact upload and subsequent download. |
+| #280 | Adopt Angular CLI/build 22.1.7 with framework/compiler 22.1.6. Repair the overly strict test that incorrectly required framework and tooling patch numbers to match. |
+| #282 | Adopt the reviewed grouped dependency updates, regenerate the frozen workspace lock, and synchronize both affected license ledgers. Validate the resulting combination, not just the individual bot PR. |
+| #283 and #284 | Adopt assert 2.1.0 and Buffer 6.0.3 together. Although declared as build dependencies, these are bundled into the shipped Avro browser decoder, so a browser regression is required. |
+| #285 | Not adopted: declarations move to Vitest 5 while the workspace still resolves the reviewed 4.1.11 override. A major migration must update declarations, override, configuration and the complete test matrix together. Keep Vitest 4.1.11 for this release; no new advisory exception is added. |
+
+The five adopted proposals are consolidated rather than merging divergent lockfiles.
+Their original PRs can be closed as superseded only after the integration passes
+its exact-head checks and merges. No original bot commit is represented as merged.
+
+## Correct Angular dependency constraints
+
+Angular framework/compiler packages use exact peer relationships. CLI/build publish
+patches independently: the reviewed `@angular/build@22.1.7` accepts framework and
+compiler `^22.0.0`, while `@angular/core@22.1.6` requires compiler `22.1.6`.
+
+The corrected guard retains stable exact versions, a single framework/compiler
+cohort, a single CLI/build cohort, and the same reviewed major/minor release line.
+It allows different patch numbers between those two groups. Negative tests still
+reject split framework peers, split tooling, mixed release lines, missing members,
+ranges and prereleases. A fresh npm install and `npm ls` (without force or legacy
+peer overrides) validate the real peer constraints; `ng build` validates compilation.
+
+## Actual browser coverage
+
+`packages/renderers/data/scripts/verify-avro-browser.mjs` exercises the actual built
+`dist/vendor/avsc.cjs`, using the same `createBlobDecoder(new Blob(...))` path as the
+renderer. Each null/deflate container has 37 records, including Chinese/Japanese,
+emoji, binary bytes, numeric values, arrays and nullable strings. Empty containers
+are covered and invalid magic is rejected. No external HTTP requests or page errors
+are allowed; Buffer/process/require must not leak into the consumer's global scope.
+
+The existing complete IFC browser gate is rerun with the updated dependency tree,
+including official IFC4/IFC4.3, picking, advanced settings across the Worker boundary,
+invalid configuration, late hooks, throwing cleanup, reentrant unmount and zero live
+Workers after disposal. The Avro check is now a permanent Public CI step.
+
+## License and audit findings
+
+#282 failed its security job on a stale DICOM license ledger, not a newly suppressed
+advisory. The canonical generator changes `baseline-browser-mapping` from 2.11.19
+to 2.11.22 in the ledger/notices. The signature ledger must also follow JSZip 3.10.2
+and its installed pako 1.0.11 dependency, preserving the actual MIT/Zlib metadata and
+license texts. Both generators and their strict check modes have run; their policy
+and the dependency-review allowlist are unchanged.
+
+The audit still reports two existing, explicitly bounded ignored advisories (one
+low and one moderate). The existing unused-adm-zip verifier passes. This is not a
+claim of zero advisories, and this integration does not broaden any exception.
+
+Focused clean-checkout qualification and actual Actions artifact round-trip:
+https://github.com/flyfish-dev/file-viewer/actions/runs/34685836777
+
+The complete Public CI, Security and PR Governance must succeed on the final
+integration head before merge; the qualification above does not replace them.
+
+## Issue status and publication
+
+All seven tracked issues were fetched individually with their current comments.
+#227, #248 and #269 remain open without new source files or complete reproductions;
+no speculative fix or acceptance claim is made. #266/#268 have the earlier sample
+fixes, #267 has the optional IFC implementation, and #277 remains a separate optional
+read-only binary-inspector proposal. No issue reply was posted by this review.
+
+`docxjs#10` and File Viewer #272/#273/#276/#278 are merged. The registry still exposed
+`@file-viewer/docx@0.3.31` at this review, so source integration is distinct from
+publishing a package with the upstream diagonal-border fix. After the maintainer
+publishes the reviewed upstream version:
+
+```sh
+pnpm release:prepare-docx <exact-published-version>
+pnpm release:verify
+git diff --check
+```
+
+Review and commit the synchronized dependency, lockfile and Worker metadata before
+publishing File Viewer. Do not bypass the installed-engine behavioral gate or claim
+that a future upstream package is already available.

examples/react-vite/package.json

@@ -17,7 +17,7 @@
   "devDependencies": {
     "@file-viewer/vite-plugin": "^3.0.3",
     "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/react-dom": "^19.2.7",
     "@vitejs/plugin-react": "^6.1.1",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"

package.json

@@ -93,9 +93,9 @@
     "test:ifc-entry": "pnpm --filter @file-viewer/renderer-3d verify:ifc"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "prettier": "3.9.6",
-    "playwright": "^1.61.1",
+    "playwright": "^1.63.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.8",
     "jsdom": "^27.4.0",

packages/capabilities/streaming-media/package.json

@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "@file-viewer/renderer-media": "workspace:3.0.3",
-    "hls.js": "^1.6.16"
+    "hls.js": "^1.7.2"
   },
   "devDependencies": {
     "typescript": "^6.0.3"

packages/compat/web/package.json

@@ -75,7 +75,7 @@
     "@file-viewer/web": "workspace:3.0.3"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"
   },

packages/components/vue3/package.json

@@ -64,13 +64,13 @@
     "vue": ">=3.3 <4"
   },
   "devDependencies": {
-    "@lucide/vue": "^1.37.0",
-    "@types/node": "^26.4.0",
+    "@lucide/vue": "^1.43.0",
+    "@types/node": "^26.5.0",
     "@vitejs/plugin-vue": "^6.0.7",
     "@vitejs/plugin-vue-jsx": "^5.1.5",
     "@vue/language-core": "^3.3.4",
     "@vue/tsconfig": "^0.9.1",
-    "sass": "^1.100.0",
+    "sass": "^1.104.0",
     "typescript": "^6.0.3",
     "vite": "8.2.2",
     "vite-plugin-dts": "5.1.0",

packages/components/web-full/package.json

@@ -94,7 +94,7 @@
   },
   "devDependencies": {
     "@file-viewer/capability-pdf-identity-repair": "workspace:3.0.3",
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "esbuild": "^0.28.2",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"

packages/components/web/package.json

@@ -70,7 +70,7 @@
     "@file-viewer/core": "workspace:3.0.3"
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "esbuild": "^0.28.2",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"

packages/presets/vite-plugin/package.json

@@ -70,7 +70,7 @@
     }
   },
   "devDependencies": {
-    "@types/node": "^26.4.0",
+    "@types/node": "^26.5.0",
     "typescript": "^6.0.3",
     "vite": "^8.2.2"
   },