[dependabot]

Bumps the production-dependencies group with 3 updates: chart.js, compromise and preact.

Updates chart.js from 4.5.1 to 4.6.1

Release notes

Sourced from chart.js's releases.

v4.6.1

Essential Links

• npm
• Migration guide
• Docs
• API
• Samples

• #12355 fix: trusted publishing fix + version 4.6.1 bump

Thanks to @​etimberg

v4.6.0

Essential Links

• npm
• Migration guide
• Docs
• API
• Samples

• #12354 chore: version bump to 4.6.0 to prepare for release
• #12328 test: stabilize overlapping polar-area label fixture

Enhancements

• #12238 Corrected spacing in pie/doughnut/polarArea (Fixes #10059)
• #12130 Enable scale title stroke (12092)

Bugs Fixed

• #12283 filler plugin fill extends past line when offset: true + index scale min/max
• #12155 Fix early exit from clearStacks
• #12142 Use integer canvas dimensions

Types

• #12321 fix(types): allow scriptable and indexed grid tick widths

Documentation

• #12258 Add a note that axis labels can span lines
• #12134 docs: Add note about flexbox/grid layout responsivity issue
• #12139 Fix amount of category scales count in docs

Development

• #12306 Bump actions/setup-node from 6 to 7
• #12303 Bump actions/checkout from 6 to 7

... (truncated)

Commits

• 76d8cf8 fix: trusted publishing fix + version 4.6.1 bump (#12355)
• 4e5443d chore: version bump to 4.6.0 to prepare for release (#12354)
• 7169e65 fix(types): allow scriptable and indexed grid tick widths (#12321)
• 714b48c test: stabilize overlapping polar-area labels across browsers (#12328)
• 6a86e23 Bump actions/setup-node from 6 to 7 (#12306)
• afb3d64 Bump actions/checkout from 6 to 7 (#12303)
• 0db976c Bump pnpm/action-setup from 4.2.0 to 6.1.0 (#12307)
• d2ddcf9 Specify build script for compressed size (#12310)
• b972574 filler plugin fill extends past line when offset: true + index scale min/max ...
• 0ad783f Use node 24 for CI (#12309)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for chart.js since your current version.

Updates compromise from 14.18.0 to 14.19.0

Release notes

Sourced from compromise's releases.

14.19.0

• [change] - verbose mode/inspection
  • [new] - filter verbose mode output by word
  • [new] - verbose('hooks')
  • [new] - "debug:word", and "debug:filesize" scripts
• [new] - Numbers improvements
  • [new] - money().add() and other arithmetic methods
  • [new] - dates().add() and other arithmetic methods (in date-plugin)
  • [new] - add roundtrip decimal → fraction → percentage → decimal methods
• [change] - queued-up i18n library improvements
  • [change] - end-to-end support for tag aliases (for i18n)
  • [change] - more unicode punctuation normalization
• [new] - left-right tagging stage:
  • [fix] - tagging fixes for switches dictionary
  • [perf] - speed improvements
• [new] - spec syntax features:
  • [new] - behaviour options to fromSpec() method
  • [new] - add term-length test to .testSpec()
• [fix] - github issues - thanks dualfroz!
  • #1155 'will' ambiguity
  • #1214 hyphenated word matching
  • #1170 trailing date dashes
  • #1142 original whitespace preservation
  • #1126 'wanna' before nouns
  • #1117 possessive date parsing
  • #1114 'fortnight' date detection
  • #1113 toNumbers() return selection
  • #896 non-English parentheses tokenization
  • #888 hashtag lexicon matching
  • #858 preposition recognition
  • #855 toSingular() preserves case
  • #814 'silent' syllable splitting
  • #806 toInfinitive() preserves negation
  • #777 contraction matching whitespace
  • #753 toPositive() auxiliary removal
  • #621 possessive pronoun tagging
  • #578 title-case adjective tagging
  • #156 quantity word parsing
  • #96 contraction expansion symmetry
• [change] - plugin updates:
  • [payload:fix] - #1188 support payloads after removal
  • [dates:change] - support fractional date arithmeetic
  • [speech:change] - split syllables on text, not normalised
• [change] - allow 2nd param passthrough for .compute(name, opts?)
• [change] - mainline the grad-school dependency
• [change] - remove 'reason' from post-tagger net
• [change] - add terser unsafe_arrows compression
• [update] - dependencies

Changelog

Sourced from compromise's changelog.

14.19.0 [Oct 2026]

• [change] - verbose mode/inspection
  • [new] - filter verbose mode output by word
  • [new] - verbose('hooks')
  • [new] - "debug:word", and "debug:filesize" scripts
• [new] - Numbers improvements
  • [new] - money().add() and other arithmetic methods
  • [new] - dates().add() and other arithmetic methods (in date-plugin)
  • [new] - add roundtrip decimal → fraction → percentage → decimal methods
• [change] - queued-up i18n library improvements
  • [change] - end-to-end support for tag aliases (for i18n)
  • [change] - more unicode punctuation normalization
• [new] - left-right tagging stage:
  • [fix] - tagging fixes for switches dictionary
  • [perf] - speed improvements
• [new] - spec syntax features:
  • [new] - behaviour options to fromSpec() method
  • [new] - add term-length test to .testSpec()
• [fix] - github issues - thanks dualfroz!
  • #1155 'will' ambiguity
  • #1214 hyphenated word matching
  • #1170 trailing date dashes
  • #1142 original whitespace preservation
  • #1126 'wanna' before nouns
  • #1117 possessive date parsing
  • #1114 'fortnight' date detection
  • #1113 toNumbers() return selection
  • #896 non-English parentheses tokenization
  • #888 hashtag lexicon matching
  • #858 preposition recognition
  • #855 toSingular() preserves case
  • #814 'silent' syllable splitting
  • #806 toInfinitive() preserves negation
  • #777 contraction matching whitespace
  • #753 toPositive() auxiliary removal
  • #621 possessive pronoun tagging
  • #578 title-case adjective tagging
  • #156 quantity word parsing
  • #96 contraction expansion symmetry
• [change] - plugin updates:
  • [payload:fix] - #1188 support payloads after removal
  • [dates:change] - support fractional date arithmeetic
  • [speech:change] - split syllables on text, not normalised
• [change] - allow 2nd param passthrough for .compute(name, opts?)
• [change] - mainline the grad-school dependency
• [change] - remove 'reason' from post-tagger net
• [change] - add terser unsafe_arrows compression
• [update] - dependencies

Commits

• eae644d Merge pull request #1252 from spencermountain/dev
• 996af90 remove bench
• dc7a9a6 14.19.0rc
• 4c82cef consolidate selection helpers
• ca899f8 smaller clues
• a81b3a3 351kb
• b736c94 more attempts to shrink filesize
• 6681cf3 inline gred-school library
• 45ed161 fix types
• 7939dcc fix filesize minimums
• Additional commits viewable in compare view

Updates preact from 11.0.1 to 11.0.2

Release notes

Sourced from preact's releases.

11.0.2

Fixes

• Keep queued components updating and finish act() cleanup after an uncaught render error (#5265, thanks @​JoviDeCroock)
• Correct the browser ESM entry point for preact/compat/server (#5304, thanks @​rschristian)
• Retain deferred hydration ranges through suspension, resumption, and unmounting (#5315, thanks @​JoviDeCroock)
• Leave non-plain style objects untouched in compat, preserving string-valued signal styles (#5318, thanks @​JoviDeCroock)
• Prevent duplicate DOM after an uncaught render error (#5328, thanks @​brevin-aq and @​JoviDeCroock)

Types

• Improve accessibility discriminated unions for dynamic input and select props (#5311, thanks @​rschristian)
• Make accessible element attribute types the default (#5312, thanks @​rschristian)
• Correct createRef nullability and remove its default any type (#5326, thanks @​rschristian)

Performance

• Reduce core diff bundle size (#5316, thanks @​JoviDeCroock)
• Trim core scheduling and DOM bookkeeping (#5317, thanks @​JoviDeCroock)
• Reduce core bundle size (#5319, thanks @​JoviDeCroock)

Maintenance

• Add a Drydock badge and remove the broken Brotli badge (#5307, thanks @​JoviDeCroock)

Commits

• 7c23627 Merge pull request #5329 from preactjs/release/11.0.2
• b1fffe6 11.0.2
• 1a07083 Merge pull request #5328 from brevin-aq/fix/render-error-duplicate-children
• 8ab86ea fix: keep LIS candidacy separate from old vnode matching
• 82d8c66 fix: don't leave MATCHED on new vnodes when a child throws
• 1dde7a8 fix: correct type of createRef (#5326)
• 74df25e Merge pull request #5319 from preactjs/JoviDeCroock/golf-preact-core
• b8e0ad9 Or isHydrating into the suspended flags
• 1324976 Test newProps !== oldProps first in the cWRP guard
• ba2598a Let setStyle default removed style values
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/chart.js	4.6.1	🟢 5.9	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Maintained 🟢 10 15 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/compromise	14.19.0	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 5 Found 1/2 approved changesets -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/preact	11.0.2	🟢 5.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 7 Found 10/14 approved changesets -- score normalized to 7 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy ⚠️ 0 security policy file not detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected

Scanned Files

• package-lock.json