build(deps): bump the npm_and_yarn group across 1 directory with 5 updates by dependabot[bot] · Pull Request #9 · akiojin/unity-cli

dependabot · 2026-02-17T03:16:30Z

Bumps the npm_and_yarn group with 4 updates in the / directory: @isaacs/brace-expansion, @modelcontextprotocol/sdk, markdown-it and qs.

Updates @isaacs/brace-expansion from 5.0.0 to 5.0.1

Updates @modelcontextprotocol/sdk from 1.25.3 to 1.26.0

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

v1.26.0

Addresses "Sharing server/transport instances can leak cross-client response data" in this GHSA GHSA-345p-7cg4-v4c7

What's Changed

chore: bump v1.25.3 for backport fixes by @pcarleton in modelcontextprotocol/typescript-sdk#1412

fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x backport) by @samuv in modelcontextprotocol/typescript-sdk#1382

Fix #1430: Client Credentials providers scopes support (backported) by @NSeydoux in modelcontextprotocol/typescript-sdk#1442

chore: bump version to 1.26.0 by @pcarleton in modelcontextprotocol/typescript-sdk#1479

New Contributors

@samuv made their first contribution in modelcontextprotocol/typescript-sdk#1382

@NSeydoux made their first contribution in modelcontextprotocol/typescript-sdk#1442

Full Changelog: modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0

Commits

fe9c07b chore: bump version to 1.26.0 (#1479)
4f01e7e fix: add non-null assertions for optional setupServer fields in stateful test
a05be17 Merge commit from fork
50d9fa3 Fix #1430: Client Credentials providers scopes support (backported) (#1442)
aa81a66 fix(deps): resolve npm audit vulnerabilities and bump dependencies (v1.x back...
6aba065 chore: bump v1.25.3 for backport fixes (#1412)
See full diff in compare view

Updates hono from 4.11.3 to 4.11.9

Release notes

Sourced from hono's releases.

v4.11.9

What's Changed

fix(url): ignore fragment identifiers in getPath() by @sano-suguru in honojs/hono#4627

fix: determine if rendered or not by node.vC[0] instead of referring to node.pP by @usualoma in honojs/hono#4663

Full Changelog: honojs/hono@v4.11.8...v4.11.9

v4.11.8

What's Changed

fix(jsx): preserve context when using await before html helper by @kaigritun in honojs/hono#4662

fix(bearer-auth): make auth-scheme case-insensitive by @bytaesu in honojs/hono#4659

New Contributors

@kaigritun made their first contribution in honojs/hono#4662

Full Changelog: honojs/hono@v4.11.7...v4.11.8

v4.11.7

Security Release

This release includes security fixes for multiple vulnerabilities in Hono and related middleware. We recommend upgrading if you are using any of the affected components.

Components

IP Restriction Middleware

Fixed an IPv4 address validation bypass that could allow IP-based access control to be bypassed under certain configurations.

Cache Middleware

Fixed an issue where responses marked with Cache-Control: private or no-store could be cached, potentially leading to information disclosure on some runtimes.

Serve Static Middleware (Cloudflare Workers adapter)

Fixed an issue that could allow unintended access to internal asset keys when serving static files with user-controlled paths.

hono/jsx ErrorBoundary

Fixed a reflected Cross-Site Scripting (XSS) issue in the ErrorBoundary component that could occur when untrusted strings were rendered without proper escaping.

Recommendation

Users are encouraged to upgrade to this release, especially if they:

Use IP Restriction Middleware

Use Cache Middleware on Deno, Bun, or Node.js

Use Serve Static Middleware with user-controlled paths on Cloudflare Workers

Render untrusted data inside ErrorBoundary components

... (truncated)

Commits

69ad885 4.11.9
3d536ff fix: determine if rendered or not by node.vC[0] instead of referring to `no...
0c1d4c7 fix(url): ignore fragment identifiers in getPath() (#4627)
5ca5c3e 4.11.8
3aa2f9a fix(bearer-auth): make auth-scheme case-insensitive (#4659)
cea7b7b fix(jsx): preserve context when using await before html helper (#4662)
f7d272a 4.11.7
2cf6004 Merge commit from fork
cf9a78d Merge commit from fork
edbf6ee Merge commit from fork
Additional commits viewable in compare view

Updates markdown-it from 14.1.0 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
See full diff in compare view

Updates qs from 6.14.1 to 6.15.0

Changelog

Sourced from qs's changelog.

6.15.0

[New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)

[Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

[Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)

[Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue

[Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)

[Fix] parse: enforce arrayLimit on comma-parsed values

[Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)

[Robustness] avoid .push, use void

[readme] document that addQueryPrefix does not add ? to empty output (#418)

[readme] clarify parseArrays and arrayLimit documentation (#543)

[readme] replace runkit CI badge with shields.io check-runs badge

[meta] fix changelog typo (arrayLength → arrayLimit)

[actions] fix rebase workflow permissions

Commits

d9b4c66 v6.15.0
cb41a54 [New] parse: add strictMerge option to wrap object/primitive conflicts in...
88e1563 [Fix] duplicates option should not apply to bracket notation keys
9d441d2 Merge backport release tags v6.0.6–v6.13.3 into main
85cc8ca v6.12.5
ffc12aa v6.11.4
0506b11 [actions] update reusable workflows
6a37faf [actions] update reusable workflows
8e8df5a [Fix] fix regressions from robustness refactor
d60bab3 v6.10.7
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 4 updates in the / directory: @isaacs/brace-expansion, [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk), [markdown-it](https://github.com/markdown-it/markdown-it) and [qs](https://github.com/ljharb/qs). Updates `@isaacs/brace-expansion` from 5.0.0 to 5.0.1 Updates `@modelcontextprotocol/sdk` from 1.25.3 to 1.26.0 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@v1.25.3...v1.26.0) Updates `hono` from 4.11.3 to 4.11.9 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.11.3...v4.11.9) Updates `markdown-it` from 14.1.0 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.0...14.1.1) Updates `qs` from 6.14.1 to 6.15.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.1...v6.15.0) --- updated-dependencies: - dependency-name: "@isaacs/brace-expansion" dependency-version: 5.0.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.26.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.11.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.0 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

…rn-c04e81bdb5 build(deps): bump the npm_and_yarn group across 1 directory with 5 updates

…ontexts (akiojin#1/akiojin#2/akiojin#4/akiojin#9) Four new `vfx_apply` ops sharing the "locate by address → unlink → RemoveChild → persist" shape: - remove_block — {contextType, blockIndex} → context.RemoveChild - remove_operator — {operatorIndex} → graph.RemoveChild - remove_parameter — {parameterIndex} → graph.RemoveChild - remove_context — {contextType} or {index} → graph.RemoveChild Cascade contract (investigated against the 17.3 package source): VFXModel. RemoveChild does NOT unlink a removed node's data slots, and VFXContext. OnRemoved does NOT drop flow edges — both would leave dangling links in the nodes on the other end. So every op explicitly unlinks first via a shared UnlinkContainerSlots helper (UnlinkAll on each top-level slot), and remove_context additionally calls VFXContext.UnlinkAll() for flow edges. Each response reports remaining* counts. Verified live + EditMode: add-then-remove each kind; removing a linked operator leaves the survivor's output link-free; removing the Output context clears Update's downstream flow edge; all recompile with zero Error-tier (no dangling refs). Required-arg checks precede LoadGraph (contract tests use a fake path). Catalog: added operatorIndex/parameterIndex/index top-level params (also retroactively completes set_operator_setting's first-class schema) + description. 5-layer vertical: 4 behavioral + 2 contract EditMode tests (70 passed / 0 failed / 0 skipped); skill examples + prose; docs/tools.md row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…/max (akiojin#9) Round out add_parameter so an agent can declare the full exposed-parameter palette, not just Float: - Full type matrix verified end-to-end: Bool/Int/Uint/Float/Vector2/3/4/Color/ Texture2D/Texture3D/Cubemap/Gradient/Animation Curve/Mesh. - Value coercion fixed per type: routed through a new ParamCoerce helper that uses CoerceToType for the math structs Newtonsoft can't build ([x,y,z] vectors, [r,g,b,a] color) and loads UnityEngine.Object types (Texture/Mesh) from an asset-path string. Previously only Newtonsoft-buildable primitives worked. - Descriptor names carry spaces ("Vector 3", "Texture 2D"); added a space-insensitive match so "Vector3"/"Texture2D" resolve too. - Constant (non-exposed) params via exposed:false. - min/max numeric Range: sets VFXParameter.valueFilter=Range (enum parsed off the property's own type) then min/max via the public properties. Oracle: describe's parameters[] now emits valueFilter/min/max alongside the existing fields, so ranges round-trip. Verified live (all 13 types + Int/Float ranges + non-exposed constant + "Texture 2D" spaced form) and recompiles clean (0 Error-tier). 5-layer vertical: handler + ParamCoerce helper + oracle; catalog min/max params; skill examples + prose; 1 behavioral EditMode test (74 passed / 0 failed / 0 skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…params (akiojin#9) Five new parameter-management ops (all by parameterIndex): - rename_parameter — sets m_ExposedName ([VFXSetting]); the node and its slot links survive (same VFXParameter); rejects duplicate names. - set_parameter_category — sets the category string (new string creates that category). - rename_category — moves every parameter from one category to another (categories are derived from the params' category strings). - reorder_parameter — sets the parameter's order (position in category). - duplicate_parameter — VFXParameter.Duplicate (type/default/category, order+1, "<name> (1)") + AddChild. Describe parameters[] gained `order`. Verified live + EditMode (2 behavioral incl. rename-preserves-link + 3 contract; 108 passed, 0 failed/skipped; 0 Error-tier). Catalog gains order/newCategory/exposedName params; docs/skill updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…state oracle Add set_texture to vfx_runtime — binds a Texture asset (by path) into an exposed Texture2D property via the public VisualEffect.SetTexture(string, Texture); resolves that overload explicitly to avoid the int-indexed sibling. get_state now reports hasTexture/textureName alongside hasFloat/floatValue. 5-layer vertical: handler op + get_state fields, Rust catalog + docs/tools.md, unity-vfx-graph skill, and a PlayMode test that authors an exposed Texture2D param WIRED into the Output mainTexture slot (exposed params only survive into the runtime sheet when used), binds it live, sets DiceTexture, and confirms the round-trip. TearDown also clears the authored temp folder. Advances the akiojin#9 runtime SetTexture/SetMesh tail (SetMesh remains). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…t_state oracle Add set_mesh to vfx_runtime — binds a Mesh asset (by path) into an exposed Mesh property via the public VisualEffect.SetMesh(string, Mesh) (explicit overload resolution, as with set_texture). get_state now reports hasMesh/meshName. 5-layer vertical: handler op + get_state fields, Rust catalog + docs/tools.md, unity-vfx-graph skill, and a PlayMode test that swaps the Quad output for an Unlit Mesh output (so contextType "Output" is unambiguous), wires an exposed Mesh param into its slot-0 mesh, creates a Mesh asset in a temp folder, binds it live, and confirms the round-trip. Completes the akiojin#9 runtime SetTexture/SetMesh tail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… PlayMode-verified (akiojin#16 runtime tail) Describe oracle gains instancing.disabledReason, recomputed from live context types (VFXOutputEvent -> "OutputEvent", VFXStaticMeshOutput -> "MeshOutput", else "None") — mirrors VFXGraphCompiledData.ValidateInstancing without touching the editor compiler's internal compiled-data state. This is the graph-level force-disable gate. PlayMode test Runtime_Instancing_MultiInstanceSharedAsset_ResolvesThreeGates: builds 3 VisualEffects bound to ONE shared asset (each its own position) + a camera, Simulates all per frame, and asserts each independently holds its full Single Burst — the headless stand-in for "N instances render with the same asset" (instancing batching is a C++ optimization with no public per-component observable). Reconciles the 3 instancing gates' resolved state: preference master (vfx_settings preferences instancingEnabled) + asset mode (describe instancing.mode) + force-disable validation (describe instancing.disabledReason, "None" for a Quad system, "OutputEvent" for an Output-Event variant). Gotcha proven: the instancingMode enum is Auto/Custom/Disabled, NOT "ForceOn" (the older docs were wrong) — Custom = explicit force-enable. HANDOFF §6b + the akiojin#16 checklist corrected. This flips the akiojin#16 runtime tail — Instancing (akiojin#16) is now fully complete, and the runtime play-mode verification vertical (the project's last new verification mode) is COMPLETE: 7 PlayMode tests green, akiojin#6/akiojin#9/akiojin#16 all fully done. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

reorder_category moves a whole blackboard category within VFXUI.categories (list position = display order). VFXView's MoveCategory is controller- coupled, so the op replicates it at model level: it lazily syncs the categories list from the params (mirroring VFXViewController) before moving, since headless set_parameter_category only writes the param's category string. Describe gains a top-level categories[] oracle (name/collapsed/order). akiojin#9 Blackboard now complete bar deferred cross-graph copy-paste. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add exposed blackboard parameters (VFXParameter) via vfx_apply add_parameter (name/type/default value/tooltip/category/exposed), extend vfx_describe_graph with a parameters array, support linking a parameter's output slot into a block/operator input via link_slots (node kind "parameter"), and add kind=parameter to vfx_list_library. Covers authoring half of Blackboard (akiojin#9). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

New first-class vfx_runtime tool drives a scene VisualEffect via its public UnityEngine.VFX API (reflection): set_asset, set_float/int/bool/vector2-4, send_event, reinit, get_state. Completes the runtime-verification machinery for Blackboard (akiojin#9) — an exposed float can be created, linked into a slot, and changed at runtime with the value round-tripping through HasFloat/GetFloat. Reused later by Events/Instancing. Includes EditMode round-trip test, contract test, Rust catalog entry + schema, skill + docs. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…ontexts (akiojin#1/akiojin#2/akiojin#4/akiojin#9) Four new `vfx_apply` ops sharing the "locate by address → unlink → RemoveChild → persist" shape: - remove_block — {contextType, blockIndex} → context.RemoveChild - remove_operator — {operatorIndex} → graph.RemoveChild - remove_parameter — {parameterIndex} → graph.RemoveChild - remove_context — {contextType} or {index} → graph.RemoveChild Cascade contract (investigated against the 17.3 package source): VFXModel. RemoveChild does NOT unlink a removed node's data slots, and VFXContext. OnRemoved does NOT drop flow edges — both would leave dangling links in the nodes on the other end. So every op explicitly unlinks first via a shared UnlinkContainerSlots helper (UnlinkAll on each top-level slot), and remove_context additionally calls VFXContext.UnlinkAll() for flow edges. Each response reports remaining* counts. Verified live + EditMode: add-then-remove each kind; removing a linked operator leaves the survivor's output link-free; removing the Output context clears Update's downstream flow edge; all recompile with zero Error-tier (no dangling refs). Required-arg checks precede LoadGraph (contract tests use a fake path). Catalog: added operatorIndex/parameterIndex/index top-level params (also retroactively completes set_operator_setting's first-class schema) + description. 5-layer vertical: 4 behavioral + 2 contract EditMode tests (70 passed / 0 failed / 0 skipped); skill examples + prose; docs/tools.md row. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…/max (akiojin#9) Round out add_parameter so an agent can declare the full exposed-parameter palette, not just Float: - Full type matrix verified end-to-end: Bool/Int/Uint/Float/Vector2/3/4/Color/ Texture2D/Texture3D/Cubemap/Gradient/Animation Curve/Mesh. - Value coercion fixed per type: routed through a new ParamCoerce helper that uses CoerceToType for the math structs Newtonsoft can't build ([x,y,z] vectors, [r,g,b,a] color) and loads UnityEngine.Object types (Texture/Mesh) from an asset-path string. Previously only Newtonsoft-buildable primitives worked. - Descriptor names carry spaces ("Vector 3", "Texture 2D"); added a space-insensitive match so "Vector3"/"Texture2D" resolve too. - Constant (non-exposed) params via exposed:false. - min/max numeric Range: sets VFXParameter.valueFilter=Range (enum parsed off the property's own type) then min/max via the public properties. Oracle: describe's parameters[] now emits valueFilter/min/max alongside the existing fields, so ranges round-trip. Verified live (all 13 types + Int/Float ranges + non-exposed constant + "Texture 2D" spaced form) and recompiles clean (0 Error-tier). 5-layer vertical: handler + ParamCoerce helper + oracle; catalog min/max params; skill examples + prose; 1 behavioral EditMode test (74 passed / 0 failed / 0 skipped). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…params (akiojin#9) Five new parameter-management ops (all by parameterIndex): - rename_parameter — sets m_ExposedName ([VFXSetting]); the node and its slot links survive (same VFXParameter); rejects duplicate names. - set_parameter_category — sets the category string (new string creates that category). - rename_category — moves every parameter from one category to another (categories are derived from the params' category strings). - reorder_parameter — sets the parameter's order (position in category). - duplicate_parameter — VFXParameter.Duplicate (type/default/category, order+1, "<name> (1)") + AddChild. Describe parameters[] gained `order`. Verified live + EditMode (2 behavioral incl. rename-preserves-link + 3 contract; 108 passed, 0 failed/skipped; 0 Error-tier). Catalog gains order/newCategory/exposedName params; docs/skill updated. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…state oracle Add set_texture to vfx_runtime — binds a Texture asset (by path) into an exposed Texture2D property via the public VisualEffect.SetTexture(string, Texture); resolves that overload explicitly to avoid the int-indexed sibling. get_state now reports hasTexture/textureName alongside hasFloat/floatValue. 5-layer vertical: handler op + get_state fields, Rust catalog + docs/tools.md, unity-vfx-graph skill, and a PlayMode test that authors an exposed Texture2D param WIRED into the Output mainTexture slot (exposed params only survive into the runtime sheet when used), binds it live, sets DiceTexture, and confirms the round-trip. TearDown also clears the authored temp folder. Advances the akiojin#9 runtime SetTexture/SetMesh tail (SetMesh remains). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…t_state oracle Add set_mesh to vfx_runtime — binds a Mesh asset (by path) into an exposed Mesh property via the public VisualEffect.SetMesh(string, Mesh) (explicit overload resolution, as with set_texture). get_state now reports hasMesh/meshName. 5-layer vertical: handler op + get_state fields, Rust catalog + docs/tools.md, unity-vfx-graph skill, and a PlayMode test that swaps the Quad output for an Unlit Mesh output (so contextType "Output" is unambiguous), wires an exposed Mesh param into its slot-0 mesh, creates a Mesh asset in a temp folder, binds it live, and confirms the round-trip. Completes the akiojin#9 runtime SetTexture/SetMesh tail. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…kiojin#16 runtime tail) Describe oracle gains instancing.disabledReason, recomputed from live context types (VFXOutputEvent -> "OutputEvent", VFXStaticMeshOutput -> "MeshOutput", else "None") — mirrors VFXGraphCompiledData.ValidateInstancing without touching the editor compiler's internal compiled-data state. This is the graph-level force-disable gate. PlayMode test Runtime_Instancing_MultiInstanceSharedAsset_ResolvesThreeGates: builds 3 VisualEffects bound to ONE shared asset (each its own position) + a camera, Simulates all per frame, and asserts each independently holds its full Single Burst — the headless stand-in for "N instances render with the same asset" (instancing batching is a C++ optimization with no public per-component observable). Reconciles the 3 instancing gates' resolved state: preference master (vfx_settings preferences instancingEnabled) + asset mode (describe instancing.mode) + force-disable validation (describe instancing.disabledReason, "None" for a Quad system, "OutputEvent" for an Output-Event variant). Gotcha proven: the instancingMode enum is Auto/Custom/Disabled, NOT "ForceOn" (the older docs were wrong) — Custom = explicit force-enable. HANDOFF §6b + the akiojin#16 checklist corrected. This flips the akiojin#16 runtime tail — Instancing (akiojin#16) is now fully complete, and the runtime play-mode verification vertical (the project's last new verification mode) is COMPLETE: 7 PlayMode tests green, akiojin#6/akiojin#9/akiojin#16 all fully done. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

reorder_category moves a whole blackboard category within VFXUI.categories (list position = display order). VFXView's MoveCategory is controller- coupled, so the op replicates it at model level: it lazily syncs the categories list from the params (mirroring VFXViewController) before moving, since headless set_parameter_category only writes the param's category string. Describe gains a top-level categories[] oracle (name/collapsed/order). akiojin#9 Blackboard now complete bar deferred cross-graph copy-paste. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 17, 2026

akiojin changed the base branch from main to develop February 17, 2026 05:13

github-actions Bot enabled auto-merge February 17, 2026 05:13

akiojin force-pushed the dependabot/npm_and_yarn/npm_and_yarn-c04e81bdb5 branch from a734202 to e450649 Compare February 17, 2026 05:17

github-actions Bot merged commit fb6da25 into develop Feb 17, 2026
7 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-c04e81bdb5 branch February 17, 2026 05:18

akiojin pushed a commit that referenced this pull request Mar 3, 2026

Merge pull request #9 from akiojin/dependabot/npm_and_yarn/npm_and_ya…

c2b2c57

…rn-c04e81bdb5 build(deps): bump the npm_and_yarn group across 1 directory with 5 updates

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#9

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates#9
github-actions[bot] merged 1 commit into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-c04e81bdb5

dependabot Bot commented on behalf of github Feb 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Feb 17, 2026

v1.26.0

What's Changed

New Contributors

v4.11.9

What's Changed

v4.11.8

What's Changed

New Contributors

v4.11.7

Security Release

Components

IP Restriction Middleware

Cache Middleware

Serve Static Middleware (Cloudflare Workers adapter)

hono/jsx ErrorBoundary

Recommendation

[14.1.1] - 2026-01-11

Security

6.15.0

6.14.2

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

hono/jsx `ErrorBoundary`