[dependabot]

Bumps the npm-minor-and-patch group with 7 updates in the /src/agent_env/explorer/ui directory:

Package	From	To
@dagrejs/dagre	3.1.1	3.1.3
@radix-ui/react-accordion	1.2.20	1.3.1
@xyflow/react	12.11.3	12.12.0
docx-preview	0.3.7	0.4.1
jszip	3.10.1	3.10.2
autoprefixer	10.5.4	10.6.1
postcss	8.5.28	8.5.31

Updates @dagrejs/dagre from 3.1.1 to 3.1.3

Changelog

Sourced from @​dagrejs/dagre's changelog.

v3.1.3

Fixes & Improvements

• ESM & Package Exports (PR #516): Added "type": "module" to package.json and renamed the CommonJS bundle to dist/dagre.cjs so both ESM import and CommonJS require() resolve properly. Re-exported Graph with default generic parameters for backward compatibility.
• Dynamic Layout State Isolation (PR #515): Scoped remembered dynamic layout state to the input graph rather than module-level state to prevent state leaks across layouts.
• Cluster Edge Routing (PR #523): Restored internal edge routes inside clusters with custom rankdir directions.
• Zero-Width Node Intersections (PR #524): Fixed vertical edge route intersection calculations with zero-width nodes.
• Parallel Edge Subgraph Sorting (PR #522): Fixed sortSubgraph so each parallel-edge dummy node is paired at most once when laying out three or more parallel edges.
• Flat Graph Conflict Scan Optimization (PR #520): Skipped findType2Conflicts scan when no border dummy nodes are present in flat graphs.
• Release & Tooling (PR #526, PR #527): Added a preflight release check to ensure changelog.md is updated before releasing, and added .pre-commit-config.yaml to run tests.
• Dependency Updates: Updated @dagrejs/graphlib to 4.0.6.

---

[3.1.0] - 2026

New Features

• Per-Cluster Direction Support (PR #511): Each cluster/subgraph can now specify its own rankdir, ranksep, nodesep, and align settings. The layout engine recursively applies these settings, enabling complex nested cluster hierarchies with independent flow directions. Fully backward compatible with global rankdir and legacy layouts.
• Dynamic Graph Layout Support (PR #512): Added support for dynamic graph layouts via useDynamic and corePath configuration options in LayoutConfig. Enables persistent node ordering and layout stability when modifying graph structures.

Refactoring & Fixes

• TypeScript & Type Safety Improvements: Added ClusterNodeLabel and NodeCollection types, updated NodeLabel interfaces, and eliminated any type assertions across the codebase.
• Nested Cluster Fixes: Resolved edge cases in nested cluster isolation and improved edge routing for cross-cluster edges.

---

[3.0.0] - 2026

Major Improvements: TypeScript Migration

• Full TypeScript Rewrite (PR #509): Migrated the entire core codebase from JavaScript to TypeScript for improved type safety, better IDE autocompletion, and easier maintenance.
• Native Type Definitions: Removed the need for external @types/dagre packages; high-quality types are now shipped directly with the library.
• Modern Build Pipeline: * Replaced JSHint with ESLint for stricter code quality.
  • Replaced Browserify/Karma with modern bundling and testing tools.
  • Standardized project indentation to 2 spaces (aligning .eslintrc and .editorconfig).

Refactoring & Fixes

• Dependency Cleanup: Removed deprecated dependencies including bower.json and legacy test configurations.
• Module Exports: Standardized ESM and CommonJS exports to ensure compatibility with modern bundlers like Webpack 5, Vite, and Rollup.
• Internal Logic: Refined internal graph traversal algorithms to utilize TypeScript interfaces, reducing "undefined" runtime errors.

---

[2.0.0] - Legacy Modernization

Major Changes

• Organization Transfer: Formally moved the repository to the @dagrejs GitHub organization.
• Package Renaming: Published under the @dagrejs/dagre npm scope.
• Dropped Legacy Environments: Discontinued support for extremely old Node.js versions (pre-v10) and legacy browsers that do not support ES6 features.

Fixes

... (truncated)

Commits

• a73acbf Bumping for release
• a037580 Merge pull request #527 from dagrejs/check-release-notes
• 17757d9 Adding a check on release notes to the release
• 744d6e1 Bump version and set as pre-release
• a5ea31c Building for release
• 89b75d9 Merge pull request #526 from dagrejs/pre-commit
• 09913ac chore: add .pre-commit-config.yaml to run tests
• daa9324 Merge pull request #524 from dajiaohuang/fix/zero-width-edge-intersections-20...
• 77c6330 Merge branch 'master' into fix/zero-width-edge-intersections-20261015
• a4cfd26 chore: revert dist changes and move tests to layout-test.ts
• Additional commits viewable in compare view

Updates @radix-ui/react-accordion from 1.2.20 to 1.3.1

Changelog

Sourced from @​radix-ui/react-accordion's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-collapsible@1.2.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Migrated Accordion to an updated collection implementation. This is an implementation detail and does not affect the public API.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-collapsible@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.21

• Updated dependencies: @radix-ui/react-collapsible@1.1.21, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @xyflow/react from 12.11.3 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

@​xyflow/react@​12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

@​xyflow/react@​12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

... (truncated)

Commits

• 8716946 chore(packages): bump
• 9fd41fd chore(packages): bump
• 19f9c2a fix(react/store): reset defaultEdgeOptions
• 2acefb5 fix(react/store): reset functions #5991
• 8f0a5d6 chore(packages): bump
• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• Additional commits viewable in compare view

Updates docx-preview from 0.3.7 to 0.4.1

Release notes

Sourced from docx-preview's releases.

0.4.0

!!!BREAKING CHANGE!!!

New h({ }) hook is used in most places to create HTML nodes. It could lead to issues in some edge cases, especially if you use undocumented API.

What's Changed

• added h({ }) hook to rendering options, to intercept HTML element creation
• Add support for nested smart tags by @​freewaying in VolodymyrBaydalka/docxjs#186
• Fix typo in README by @​hjryan in VolodymyrBaydalka/docxjs#192

New Contributors

• @​freewaying made their first contribution in VolodymyrBaydalka/docxjs#186
• @​hjryan made their first contribution in VolodymyrBaydalka/docxjs#192

Full Changelog: VolodymyrBaydalka/docxjs@0.3.6...0.4.0

Commits

• See full diff in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates autoprefixer from 10.5.4 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• 7e81fff Release 10.5.5 version
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• Additional commits viewable in compare view

Confidence Score: 5/5

The PR appears safe to merge, with the earlier browser-test suggestion still outstanding.

Findings

1.  Preview changes lack browser coverage ▶

Fix with agent prompt

### Issue 1
src/agent_env/explorer/ui/package.json:undefined-23
`docx-preview` moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. `prepareSandboxDoc` warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates seven dependencies in the explorer UI and refreshes their locked dependencies.

• The explorer UI installs newer graph, preview, and CSS packages.

_{Reviews (2) · Last reviewed commit: "chore(deps): bump the npm-minor-and-patc..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​radix-ui/​react-accordion@​1.3.1
	npm/​@​dagrejs/​dagre@​3.1.1 ⏵ 3.1.3	+1		+1	+8
	npm/​postcss@​8.5.28 ⏵ 8.5.31	+1		+1	-1
	npm/​jszip@​3.10.1 ⏵ 3.10.2
	npm/​docx-preview@​0.3.7 ⏵ 0.4.1			+1
	npm/​autoprefixer@​10.5.4 ⏵ 10.6.1	+1		+1	-3
	npm/​@​xyflow/​react@​12.11.3 ⏵ 12.12.0			+1

View full report

[greptile-apps]

Preview changes lack browser coverage

docx-preview moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. prepareSandboxDoc warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent_env/explorer/ui/package.json
Line: 23

Comment:
**Preview changes lack browser coverage**

`docx-preview` moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. `prepareSandboxDoc` warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!