[dependabot]

Bumps the npm-minor-and-patch group with 7 updates in the /src/agent_env/explorer/ui directory:

Package	From	To
@dagrejs/dagre	3.1.1	3.1.2
@radix-ui/react-accordion	1.2.20	1.3.1
@xyflow/react	12.11.3	12.12.0
docx-preview	0.3.7	0.4.1
jszip	3.10.1	3.10.2
autoprefixer	10.5.4	10.6.1
postcss	8.5.28	8.5.31

Updates @dagrejs/dagre from 3.1.1 to 3.1.2

Commits

• a5ea31c Building for release
• 89b75d9 Merge pull request #526 from dagrejs/pre-commit
• 09913ac chore: add .pre-commit-config.yaml to run tests
• daa9324 Merge pull request #524 from dajiaohuang/fix/zero-width-edge-intersections-20...
• 77c6330 Merge branch 'master' into fix/zero-width-edge-intersections-20261015
• a4cfd26 chore: revert dist changes and move tests to layout-test.ts
• f9e4831 Merge pull request #523 from dajiaohuang/fix/cluster-internal-edge-routes-202...
• a87f7a2 chore: revert dist changes
• 692a58e Merge pull request #522 from rplanel/fix/sort-subgraph-parallel-edges
• dfc56fa refactor: simplify reversedPairs guard in sortSubgraph
• Additional commits viewable in compare view

Updates @radix-ui/react-accordion from 1.2.20 to 1.3.1

Changelog

Sourced from @​radix-ui/react-accordion's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-collapsible@1.2.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Migrated Accordion to an updated collection implementation. This is an implementation detail and does not affect the public API.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-collapsible@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.21

• Updated dependencies: @radix-ui/react-collapsible@1.1.21, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @xyflow/react from 12.11.3 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

@​xyflow/react@​12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

@​xyflow/react@​12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

... (truncated)

Commits

• 8716946 chore(packages): bump
• 9fd41fd chore(packages): bump
• 19f9c2a fix(react/store): reset defaultEdgeOptions
• 2acefb5 fix(react/store): reset functions #5991
• 8f0a5d6 chore(packages): bump
• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• Additional commits viewable in compare view

Updates docx-preview from 0.3.7 to 0.4.1

Release notes

Sourced from docx-preview's releases.

0.4.0

!!!BREAKING CHANGE!!!

New h({ }) hook is used in most places to create HTML nodes. It could lead to issues in some edge cases, especially if you use undocumented API.

What's Changed

• added h({ }) hook to rendering options, to intercept HTML element creation
• Add support for nested smart tags by @​freewaying in VolodymyrBaydalka/docxjs#186
• Fix typo in README by @​hjryan in VolodymyrBaydalka/docxjs#192

New Contributors

• @​freewaying made their first contribution in VolodymyrBaydalka/docxjs#186
• @​hjryan made their first contribution in VolodymyrBaydalka/docxjs#192

Full Changelog: VolodymyrBaydalka/docxjs@0.3.6...0.4.0

Commits

• See full diff in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates autoprefixer from 10.5.4 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• 7e81fff Release 10.5.5 version
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking request for a browser test of document previews.

Findings

1.  Preview changes lack browser coverage ▶

Fix with agent prompt

### Issue 1
src/agent_env/explorer/ui/package.json:23
`docx-preview` moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. `prepareSandboxDoc` warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates seven explorer UI dependencies and their locked dependencies.

• The explorer’s graph views use updated layout and flow packages.
• The trajectory viewer uses an updated Radix Accordion package.
• Document previews and artifact downloads use updated document and ZIP packages.
• The explorer’s CSS build uses updated prefixing and stylesheet tools.

_{Reviews (1) · Last reviewed commit: "chore(deps): bump the npm-minor-and-patc..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​radix-ui/​react-accordion@​1.3.1
	npm/​@​dagrejs/​dagre@​3.1.1 ⏵ 3.1.2	+1		+1	+6
	npm/​postcss@​8.5.28 ⏵ 8.5.31	+1		+1
	npm/​jszip@​3.10.1 ⏵ 3.10.2
	npm/​docx-preview@​0.3.7 ⏵ 0.4.1			+1
	npm/​autoprefixer@​10.5.4 ⏵ 10.6.1	+1		+1
	npm/​@​xyflow/​react@​12.11.3 ⏵ 12.12.0			+1	+1

View full report

[greptile-apps]

Preview changes lack browser coverage

docx-preview moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. prepareSandboxDoc warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent_env/explorer/ui/package.json
Line: 23

Comment:
**Preview changes lack browser coverage**

`docx-preview` moves to a release that changes how it creates HTML, but this PR adds no browser test for the preview. `prepareSandboxDoc` warns that safe previews depend on the renderer moving newly created elements into the iframe in the same job. The existing smoke test only checks source text and cannot catch a change to that timing.

Add a browser test that renders a crafted document with the new version, checks that no handler runs in the parent page, and confirms the preview appears.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!