[dependabot]

Bumps the production-dependencies group with 3 updates in the / directory: chart.js, compromise and preact.

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

• npm
• Migration guide
• Docs
• API
• Samples

• #12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to @​etimberg

v4.6.0

Essential Links

• npm
• Migration guide
• Docs
• API
• Samples

• #12354 chore: version bump to 4.6.0 to prepare for release
• #12328 test: stabilize overlapping polar-area label fixture

Enhancements

• #12238 Corrected spacing in pie/doughnut/polarArea (Fixes #10059)
• #12130 Enable scale title stroke (12092)

Bugs Fixed

• #12283 filler plugin fill extends past line when offset: true + index scale min/max
• #12155 Fix early exit from clearStacks
• #12142 Use integer canvas dimensions

Types

• #12321 fix(types): allow scriptable and indexed grid tick widths

Documentation

• #12258 Add a note that axis labels can span lines
• #12134 docs: Add note about flexbox/grid layout responsivity issue
• #12139 Fix amount of category scales count in docs

Development

• #12306 Bump actions/setup-node from 6 to 7
• #12303 Bump actions/checkout from 6 to 7

... (truncated)

Commits

• 76d8cf8 fix: trusted publishing fix + version 4.6.1 bump (#12355)
• 4e5443d chore: version bump to 4.6.0 to prepare for release (#12354)
• 7169e65 fix(types): allow scriptable and indexed grid tick widths (#12321)
• 714b48c test: stabilize overlapping polar-area labels across browsers (#12328)
• 6a86e23 Bump actions/setup-node from 6 to 7 (#12306)
• afb3d64 Bump actions/checkout from 6 to 7 (#12303)
• 0db976c Bump pnpm/action-setup from 4.2.0 to 6.1.0 (#12307)
• d2ddcf9 Specify build script for compressed size (#12310)
• b972574 filler plugin fill extends past line when offset: true + index scale min/max ...
• 0ad783f Use node 24 for CI (#12309)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chart.js since your current version.

Updates compromise from 14.18.0 to 14.19.0

Release notes

Sourced from compromise's releases.

14.19.0

• [change] - verbose mode/inspection
  • [new] - filter verbose mode output by word
  • [new] - verbose('hooks')
  • [new] - "debug:word", and "debug:filesize" scripts
• [new] - Numbers improvements
  • [new] - money().add() and other arithmetic methods
  • [new] - dates().add() and other arithmetic methods (in date-plugin)
  • [new] - add roundtrip decimal → fraction → percentage → decimal methods
• [change] - queued-up i18n library improvements
  • [change] - end-to-end support for tag aliases (for i18n)
  • [change] - more unicode punctuation normalization
• [new] - left-right tagging stage:
  • [fix] - tagging fixes for switches dictionary
  • [perf] - speed improvements
• [new] - spec syntax features:
  • [new] - behaviour options to fromSpec() method
  • [new] - add term-length test to .testSpec()
• [fix] - github issues - thanks dualfroz!
  • #1155 'will' ambiguity
  • #1214 hyphenated word matching
  • #1170 trailing date dashes
  • #1142 original whitespace preservation
  • #1126 'wanna' before nouns
  • #1117 possessive date parsing
  • #1114 'fortnight' date detection
  • #1113 toNumbers() return selection
  • #896 non-English parentheses tokenization
  • #888 hashtag lexicon matching
  • #858 preposition recognition
  • #855 toSingular() preserves case
  • #814 'silent' syllable splitting
  • #806 toInfinitive() preserves negation
  • #777 contraction matching whitespace
  • #753 toPositive() auxiliary removal
  • #621 possessive pronoun tagging
  • #578 title-case adjective tagging
  • #156 quantity word parsing
  • #96 contraction expansion symmetry
• [change] - plugin updates:
  • [payload:fix] - #1188 support payloads after removal
  • [dates:change] - support fractional date arithmeetic
  • [speech:change] - split syllables on text, not normalised
• [change] - allow 2nd param passthrough for .compute(name, opts?)
• [change] - mainline the grad-school dependency
• [change] - remove 'reason' from post-tagger net
• [change] - add terser unsafe_arrows compression
• [update] - dependencies

Changelog

Sourced from compromise's changelog.

14.19.0 [Oct 2026]

• [change] - verbose mode/inspection
  • [new] - filter verbose mode output by word
  • [new] - verbose('hooks')
  • [new] - "debug:word", and "debug:filesize" scripts
• [new] - Numbers improvements
  • [new] - money().add() and other arithmetic methods
  • [new] - dates().add() and other arithmetic methods (in date-plugin)
  • [new] - add roundtrip decimal → fraction → percentage → decimal methods
• [change] - queued-up i18n library improvements
  • [change] - end-to-end support for tag aliases (for i18n)
  • [change] - more unicode punctuation normalization
• [new] - left-right tagging stage:
  • [fix] - tagging fixes for switches dictionary
  • [perf] - speed improvements
• [new] - spec syntax features:
  • [new] - behaviour options to fromSpec() method
  • [new] - add term-length test to .testSpec()
• [fix] - github issues - thanks dualfroz!
  • #1155 'will' ambiguity
  • #1214 hyphenated word matching
  • #1170 trailing date dashes
  • #1142 original whitespace preservation
  • #1126 'wanna' before nouns
  • #1117 possessive date parsing
  • #1114 'fortnight' date detection
  • #1113 toNumbers() return selection
  • #896 non-English parentheses tokenization
  • #888 hashtag lexicon matching
  • #858 preposition recognition
  • #855 toSingular() preserves case
  • #814 'silent' syllable splitting
  • #806 toInfinitive() preserves negation
  • #777 contraction matching whitespace
  • #753 toPositive() auxiliary removal
  • #621 possessive pronoun tagging
  • #578 title-case adjective tagging
  • #156 quantity word parsing
  • #96 contraction expansion symmetry
• [change] - plugin updates:
  • [payload:fix] - #1188 support payloads after removal
  • [dates:change] - support fractional date arithmeetic
  • [speech:change] - split syllables on text, not normalised
• [change] - allow 2nd param passthrough for .compute(name, opts?)
• [change] - mainline the grad-school dependency
• [change] - remove 'reason' from post-tagger net
• [change] - add terser unsafe_arrows compression
• [update] - dependencies

Commits

• eae644d Merge pull request #1252 from spencermountain/dev
• 996af90 remove bench
• dc7a9a6 14.19.0rc
• 4c82cef consolidate selection helpers
• ca899f8 smaller clues
• a81b3a3 351kb
• b736c94 more attempts to shrink filesize
• 6681cf3 inline gred-school library
• 45ed161 fix types
• 7939dcc fix filesize minimums
• Additional commits viewable in compare view

Updates preact from 11.0.1 to 11.2.0

Release notes

Sourced from preact's releases.

11.2.0

Features

• Support scoped custom element registries when rendering into shadow roots (#5342, thanks @​JoviDeCroock)

Fixes

• Ignore non-function values for on* props instead of registering invalid event handlers (#5345, thanks @​JoviDeCroock)
• Pass a thrown null or undefined to error boundaries without replacing it with a TypeError (#5347, thanks @​jonkwheeler)
• Preserve event handlers on unmounted nodes so events already bubbling can finish (#5349, thanks @​JoviDeCroock)

Performance

• Reduce bundle size across core, hooks, and compat (#5343, thanks @​JoviDeCroock)

11.1.1

Fixes

• Fix rendering, updating, and hydrating \<template> elements in SVG and MathML namespaces (#5339, thanks @​JoviDeCroock)

Types

• Add declarative shadow DOM attributes to \<template>, including their camelCase forms (#5338, thanks @​b84330808)

11.1.0

Features

• Add preact/compat/compiler-runtime for apps compiled with React Compiler (#5323, thanks @​JoviDeCroock)

Fixes

• Harden VNode recognition with a shared symbol marker (#5335, thanks @​JoviDeCroock)
• Isolate layout-effect errors to the throwing component so unrelated effects and lifecycle callbacks still run (#5321, thanks @​JoviDeCroock)
• Stop appending px to unitless SVG paint and aspect-ratio values in compat (#5233, thanks @​dylanpulver)

Types

• Allow the list attribute on all valid input types (#5331, thanks @​playlikeboy)

Compatibility

The new VNode marker requires @preact/signals 2.11.4 or later and preact-render-to-string 6.8.2 or later when using those packages.

11.0.2

Fixes

• Keep queued components updating and finish act() cleanup after an uncaught render error (#5265, thanks @​JoviDeCroock)
• Correct the browser ESM entry point for preact/compat/server (#5304, thanks @​rschristian)
• Retain deferred hydration ranges through suspension, resumption, and unmounting (#5315, thanks @​JoviDeCroock)
• Leave non-plain style objects untouched in compat, preserving string-valued signal styles (#5318, thanks @​JoviDeCroock)

... (truncated)

Commits

• c95929d Merge pull request #5350 from preactjs/release/11.2.0
• 74f5730 11.2.0
• bc4e5bc Merge pull request #5349 from preactjs/preserve-unmounted-event-handlers
• 9131571 Merge branch 'main' into preserve-unmounted-event-handlers
• 4bfd080 Merge pull request #5347 from jonkwheeler/fix/throw-null-then
• 64ecd84 Preserve event handlers on unmounted nodes
• 98ea442 Pass a thrown null or undefined to error boundaries
• 076fe9c Merge pull request #5345 from preactjs/fix/ignore-non-function-event-props
• 7657cec Ignore non-function values for on* props
• 81dbe69 Merge pull request #5343 from preactjs/busy-brown-0oklh9
• Additional commits viewable in compare view

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/chart.js	4.6.1	🟢 5.9	Details Check Score Reason Maintained 🟢 10 15 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/compromise	14.19.0	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 5 Found 1/2 approved changesets -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/preact	11.2.0	🟢 5.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json