fix(deps): update major dependencies

ci: remind and close issues that wait for the reporter (#977 )
Issues labelled "wait for confrim" get a reminder and the "no response" label after 15 days without activity, and are closed as not planned after 15 more. A reply from the reporter removes both labels.
2026-10-11 12:09:53 +08:00 · 2026-10-10 23:03:55 +00:00 · 2026-10-11 08:02:28 +09:00 · 2026-10-10 23:53:30 +09:00 · 2026-10-10 23:30:51 +09:00
12 changed files with 1782 additions and 1950 deletions
@@ -12,13 +12,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'

@@ -20,10 +20,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: '24'
          cache: 'npm'
@@ -26,14 +26,14 @@ jobs:
      
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Log in to GitHub Container Registry
        if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -41,7 +41,7 @@ jobs:

      - name: Extract metadata (tags, labels)
        id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
@@ -54,7 +54,7 @@ jobs:
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          push: ${{ github.event_name != 'pull_request' }}
@@ -71,7 +71,7 @@ jobs:
      # Push to AWS ECR for App Runner auto-deploy
      - name: Configure AWS credentials
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@v6
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -26,10 +26,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: "npm"
@@ -50,10 +50,10 @@ jobs:
    runs-on: windows-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: "npm"
@@ -69,7 +69,7 @@ jobs:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload unsigned artifacts for signing
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        id: upload-unsigned
        with:
          name: windows-unsigned
@@ -77,7 +77,7 @@ jobs:
          retention-days: 1

      - name: Sign with SignPath
-        uses: signpath/github-action-submit-signing-request@v2
+        uses: signpath/github-action-submit-signing-request@v3
        with:
          api-token: ${{ secrets.SIGNPATH_API_TOKEN }}
          organization-id: '880a211d-2cd3-4e7b-8d04-3d1f8eb39df5'
@@ -92,7 +92,7 @@ jobs:
          output-artifact-directory: release-signed

      - name: Upload signed artifacts to release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
        with:
          files: release-signed/*.exe
        env:
@@ -28,10 +28,10 @@ jobs:
        working-directory: packages/mcp-server
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
          node-version: 24
          cache: "npm"
@@ -11,12 +11,12 @@ jobs:
    name: Lint & Unit Tests
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
-          node-version: "20"
+          node-version: "24"
          cache: "npm"

      - name: Install dependencies
@@ -52,19 +52,19 @@ jobs:
      matrix:
        shard: [1, 2, 3, 4, 5, 6]
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7

      - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
        with:
-          node-version: "20"
+          node-version: "24"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Cache Playwright browsers
-        uses: actions/cache@v5
+        uses: actions/cache@v6
        id: playwright-cache
        with:
          path: ~/.cache/ms-playwright
@@ -87,7 +87,7 @@ jobs:
          CI: true

      - name: Upload test results
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: playwright-report-${{ matrix.shard }}
@@ -0,0 +1,55 @@
+# Issues labelled "wait for confrim" are waiting for the reporter. After 15
+# days without activity the issue gets a reminder and the "no response"
+# label; after 15 more days it is closed. A reply from the reporter removes
+# both labels, so the issue shows up as needing the maintainer again.
+name: Wait for confirmation
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+  issue_comment:
+    types: [created]
+
+permissions:
+  issues: write
+
+jobs:
+  remind-and-close:
+    if: github.event_name != 'issue_comment'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v11
+        with:
+          only-issue-labels: "wait for confrim"
+          days-before-issue-stale: 15
+          days-before-issue-close: 15
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          stale-issue-label: "no response"
+          stale-issue-message: >-
+            Still there? We asked for more information 15 days ago. A reply
+            would help; if we hear nothing in another 15 days this issue will
+            be closed. It can be reopened any time.
+          close-issue-message: >-
+            No reply in 30 days, so this issue is closed for now. If the
+            problem is still there, reply or reopen it.
+          close-issue-reason: not_planned
+          remove-stale-when-updated: true
+
+  reporter-replied:
+    if: >-
+      github.event_name == 'issue_comment' &&
+      contains(github.event.issue.labels.*.name, 'wait for confrim') &&
+      github.event.comment.user.type != 'Bot' &&
+      !contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: ubuntu-latest
+    steps:
+      - name: The reporter answered, so the issue is the maintainer's again
+        run: >-
+          gh issue edit "$NUMBER" --repo "$REPO"
+          --remove-label "wait for confrim" --remove-label "no response"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
@@ -45,11 +45,11 @@
        "@aihubmix/ai-sdk-provider": "^2.2.1",
        "@aws-sdk/client-dynamodb": "^3.957.0",
        "@aws-sdk/credential-providers": "^3.943.0",
-        "@extractus/article-extractor": "^8.0.18",
+        "@extractus/article-extractor": "^9.0.0",
        "@formatjs/intl-localematcher": "^0.9.0",
-        "@langfuse/client": "^4.4.9",
-        "@langfuse/otel": "^4.4.4",
-        "@langfuse/tracing": "^4.4.9",
+        "@langfuse/client": "^5.0.0",
+        "@langfuse/otel": "^5.0.0",
+        "@langfuse/tracing": "^5.0.0",
        "@next/third-parties": "^16.0.6",
        "@opennextjs/cloudflare": "^1.17.1",
        "@openrouter/ai-sdk-provider": "^2.10.0",
@@ -74,13 +74,13 @@
        "cmdk": "^1.1.1",
        "idb": "^8.0.3",
        "jsonrepair": "^3.13.1",
-        "lucide-react": "^0.577.0",
-        "motion": "^12.23.25",
-        "nanoid": "^5.0.0",
+        "lucide-react": "^1.0.0",
+        "motion": "^14.0.0",
+        "nanoid": "^6.0.0",
        "negotiator": "^1.0.0",
        "next": "^16.0.7",
        "ollama-ai-provider-v2": "^3.6.0",
-        "pako": "^2.1.0",
+        "pako": "^3.0.0",
        "prism-react-renderer": "^2.4.1",
        "react": "^19.1.2",
        "react-dom": "^19.1.2",
@@ -119,27 +119,27 @@
        "@testing-library/user-event": "^14.6.1",
        "@types/negotiator": "^0.6.4",
        "@types/node": "^24.0.0",
-        "@types/pako": "^2.0.3",
+        "@types/pako": "^3.0.0",
        "@types/react": "^19",
        "@types/react-dom": "^19",
        "@types/turndown": "^5.0.6",
-        "@vitejs/plugin-react": "^5.1.2",
-        "@vitest/coverage-v8": "^4.0.16",
-        "concurrently": "^9.2.1",
+        "@vitejs/plugin-react": "^6.0.0",
+        "@vitest/coverage-v8": "^5.0.0",
+        "concurrently": "^10.0.0",
        "cross-env": "^10.1.0",
        "electron": "^41.10.6",
        "electron-builder": "^26.0.12",
        "esbuild": "^0.28.0",
-        "eslint": "9.39.5",
+        "eslint": "10.12.0",
        "eslint-config-next": "16.1.6",
        "husky": "^9.1.7",
-        "jsdom": "^27.4.0",
-        "lint-staged": "^16.2.7",
+        "jsdom": "^30.0.0",
+        "lint-staged": "^17.0.0",
        "shx": "^0.4.0",
        "tailwindcss": "^4",
-        "typescript": "^5",
+        "typescript": "^7.0.0",
        "vite-tsconfig-paths": "^6.0.3",
-        "vitest": "^4.0.16",
+        "vitest": "^5.0.0",
        "wait-on": "^9.0.3",
        "wrangler": "^4.60.0"
    },
@@ -42,16 +42,16 @@
        "@modelcontextprotocol/sdk": "^1.31.0",
        "linkedom": "^0.18.0",
        "open": "^11.0.0",
-        "pako": "^2.2.0",
+        "pako": "^3.0.0",
        "saxes": "^6.0.0",
        "zod": "^4.0.0"
    },
    "devDependencies": {
        "@types/node": "^24.0.0",
-        "@types/pako": "^2.0.4",
+        "@types/pako": "^3.0.0",
        "tsx": "^4.19.0",
-        "typescript": "^5",
-        "vitest": "^4.1.8"
+        "typescript": "^7.0.0",
+        "vitest": "^5.0.0"
    },
    "engines": {
        "node": ">=18"
@@ -108,6 +108,25 @@ async function boxOf(locator: Locator) {
    return box
 }

+/**
+ * Click the canvas where no shape is, to deselect: the corner of the
+ * container farthest from the shape. A fixed spot near the top-left corner
+ * is not safe, as a click on a shape may scroll it into that corner.
+ */
+async function clickEmptyCanvas(page: Page, shape: Locator) {
+    const container = getIframeContent(page).locator(".geDiagramContainer")
+    const box = await boxOf(container)
+    const shapeBox = await boxOf(shape)
+    const shapeX = shapeBox.x + shapeBox.width / 2
+    const shapeY = shapeBox.y + shapeBox.height / 2
+    await container.click({
+        position: {
+            x: shapeX < box.x + box.width / 2 ? box.width - 20 : 20,
+            y: shapeY < box.y + box.height / 2 ? box.height - 20 : 20,
+        },
+    })
+}
+
 /** draw.io's own Undo button: draw.io sets "disabled" with nothing to undo */
 function drawioUndo(page: Page) {
    return getIframeContent(page).locator('.geSimpleMainMenu a[title="Undo"]')
@@ -4512,9 +4531,7 @@ test.describe("Edge cases", () => {
        })
        await sendMessage(page, "Make this red")
        // Deselected while the diagram exports
-        await canvas
-            .locator(".geDiagramContainer")
-            .click({ position: { x: 10, y: 10 } })
+        await clickEmptyCanvas(page, shape)
        await expect(chip).toHaveCount(0)
        await page.evaluate(() => (window as any).__releaseExports())
        await waitForCompleteCount(page, 2)
Author	SHA1	Message	Date
renovate[bot]	5e16ea564a	fix(deps): update major dependencies	2026-10-10 23:03:55 +00:00
Dayuan Jiang	a9091e96f1	ci: remind and close issues that wait for the reporter (#977 ) Issues labelled "wait for confrim" get a reminder and the "no response" label after 15 days without activity, and are closed as not planned after 15 more. A reply from the reporter removes both labels.	2026-10-11 08:02:28 +09:00
Dayuan Jiang	213b672e92	test(e2e): deselect by clicking a corner away from the shape (#975 ) The test clicked the canvas at (10, 10) to deselect. When the click on the shape before it needed retries, Playwright scrolled the shape into the container's top-left corner, so the next click landed on the shape and the selection stayed (seen on the main run of `cd5352c` and on #973). The new clickEmptyCanvas helper clicks the corner farthest from the shape. Reproduced locally by scrolling the shape into the corner: the old click keeps the selection, the helper clears it.	2026-10-10 23:53:30 +09:00
Dayuan Jiang	d1ee1594f1	fix(chat): the AI reads and draws the page the user is viewing (#974 ) * fix(chat): the AI reads and draws the page the user is viewing The model always got the first page and display_diagram replaced the whole file with one page, so drawing on page 3 of a multi-page file deleted the other pages (#241), and edits went to page 1 while the user looked at another page. Now a turn records the page the user is viewing when the message is sent. That page's model goes to the model (also as previousXml, on regenerate and in edit_diagram error messages), selected shapes are sent on any page, display_diagram and append_diagram replace only that page (a drawing that brings several pages still replaces the file), edit_diagram targets it, and the streaming preview draws on it. Compact cells and default styles take the layer and the edges of that page, in the preview and in editDiagram. The editor bridge replaces the current page in place when the other pages are unchanged, so Ctrl+Z undoes an AI change on a multi-page file in one step; when a full load is needed, the user's page is shown again afterwards. Version summaries and the compare dialog count the page the change was made on. * test: read the failed edit's output without unsafe optional chaining	2026-10-10 23:30:51 +09:00