[dependabot]

Bumps the npm-minor-and-patch group with 6 updates in the /src/agent_env/explorer/ui directory:

Package	From	To
@radix-ui/react-accordion	1.2.20	1.3.1
@xyflow/react	12.11.3	12.12.0
docx-preview	0.3.7	0.4.1
jszip	3.10.1	3.10.2
autoprefixer	10.5.4	10.6.1
postcss	8.5.28	8.5.31

Updates @radix-ui/react-accordion from 1.2.20 to 1.3.1

Changelog

Sourced from @​radix-ui/react-accordion's changelog.

1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-collapsible@1.2.1

1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Migrated Accordion to an updated collection implementation. This is an implementation detail and does not affect the public API.
• Updated dependencies: @radix-ui/react-collection@1.2.0, @radix-ui/primitive@1.2.0, @radix-ui/react-collapsible@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-direction@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

1.2.21

• Updated dependencies: @radix-ui/react-collapsible@1.1.21, @radix-ui/react-direction@1.1.5, @radix-ui/react-primitive@2.1.11, @radix-ui/react-collection@1.1.16

Commits

• See full diff in compare view

Updates @xyflow/react from 12.11.3 to 12.12.0

Release notes

Sourced from @​xyflow/react's releases.

@​xyflow/react@​12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

@​xyflow/react@​12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

@​xyflow/react@​12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

@​xyflow/react@​12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

• #5976 3319ef4 - Fix the MiniMap zooming out to include the origin when every node is hidden.

• #5955 965ca70 - Fix MiniMap calling useCallback conditionally for onNodeClick.

Changelog

Sourced from @​xyflow/react's changelog.

12.12.0

Minor Changes

• #5998 91a4adf - Always fire onResizeEnd after onResizeStart

Patch Changes

• #5998 91a4adf - Fix incorrect values during resize when shouldResize returns false

• Updated dependencies [91a4adf, 91a4adf]:

  • @​xyflow/system@​0.0.83

12.11.6

Patch Changes

• #5994 2350158 - Reset all properties in provider store when unmounting flow

• #5997 0117cc9 - Prevent attribution warning when pane is not rendered either

• Updated dependencies [0117cc9]:

  • @​xyflow/system@​0.0.82

12.11.5

Patch Changes

• Updated dependencies [22e0be2]:
  • @​xyflow/system@​0.0.81

12.11.4

Patch Changes

• #5974 8c42922 - Minimap still works after ReactFlow remounts

• #5962 cbf40b9 - Show log if user hides attribution in development

... (truncated)

Commits

• 8716946 chore(packages): bump
• 9fd41fd chore(packages): bump
• 19f9c2a fix(react/store): reset defaultEdgeOptions
• 2acefb5 fix(react/store): reset functions #5991
• 8f0a5d6 chore(packages): bump
• 286816c chore(packages): bump
• 3319ef4 fix(react): keep minimap bounds at the viewport when all nodes are hidden
• b7186f3 fix(react): minimap still works after reactflow remounts #5971
• d8edc77 Merge pull request #5955 from Jian-Zhang08/fix/minimap-onnodeclick-conditiona...
• 59b1a60 Simplify node click handling in MiniMap component
• Additional commits viewable in compare view

Updates docx-preview from 0.3.7 to 0.4.1

Release notes

Sourced from docx-preview's releases.

0.4.0

!!!BREAKING CHANGE!!!

New h({ }) hook is used in most places to create HTML nodes. It could lead to issues in some edge cases, especially if you use undocumented API.

What's Changed

• added h({ }) hook to rendering options, to intercept HTML element creation
• Add support for nested smart tags by @​freewaying in VolodymyrBaydalka/docxjs#186
• Fix typo in README by @​hjryan in VolodymyrBaydalka/docxjs#192

New Contributors

• @​freewaying made their first contribution in VolodymyrBaydalka/docxjs#186
• @​hjryan made their first contribution in VolodymyrBaydalka/docxjs#192

Full Changelog: VolodymyrBaydalka/docxjs@0.3.6...0.4.0

Commits

• See full diff in compare view

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates autoprefixer from 10.5.4 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

10.5.6

• Fixed producing wrong old -webkit- gradients (by @​ryanchou1994).

10.5.5

• Fixed resolution media query parsing performance (by @​NotAFlightRisk).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• b031690 Release 10.5.6 version
• da65c36 Add warning when Autoprefixer can cover CSS for old Safari
• 604f8d9 Update dependencies
• 54608ca Fix old WebKit gradients with color hints (#1554)
• 7e81fff Release 10.5.5 version
• Additional commits viewable in compare view

Updates postcss from 8.5.28 to 8.5.31

Release notes

Sourced from postcss's releases.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Changelog

Sourced from postcss's changelog.

8.5.31

• Fix better source map on </style> escaping (by @​firefoxic).

8.5.30

• Fix broken map on </style> escaping (by @​Rufflet).

8.5.29

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

Commits

• d190857 Release 8.5.31 version
• 4ef6d8c Update dependencies
• 6abd674 Call the builder with every node when the output is escaped (#2175)
• f1aca7e Release 8.5.30 version
• 9d83445 Update dependencies
• 6c9bc73 Fix invalid source map mapping on escaping before new line (#2169)
• 1fd8f88 Add missed changes in changelog
• a7a1f34 Release 8.5.29 version
• b55a36d Update dependencies
• 7647a81 Escape </style> in output of non-Root nodes (#2163)
• Additional commits viewable in compare view

Confidence Score: 5/5

The PR appears safe to merge, with the two previous non-blocking requests still open.

Findings

1.  Renderer changes go unchecked ▶
2.  Shipped dependency list is outdated ▶

Fix with agent prompt

### Issue 1
src/agent_env/explorer/ui/package.json:undefined-23
`docx-preview` is pinned because preview safety depends on when it creates and moves HTML into the iframe. This upgrade changes that renderer, but `preview-sandbox.smoke.ts` only checks iframe attributes and cannot catch changes to that timing. Add a browser test that renders a crafted document through `ArtifactDocxPreview` and checks that no handler runs in the parent page.

### Issue 2
src/agent_env/explorer/ui/package.json:21-24
These upgrades leave `THIRD_PARTY_NOTICES.md` listing the old shipped versions, including `docx-preview` 0.3.7 and `@xyflow/react` 12.11.3. Refresh the affected entries against the new lockfile so the notice list describes the packages included in the built UI.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Updates six dependencies used by the explorer UI and refreshes their locked dependencies.

• The explorer UI now uses newer package releases.

_{Reviews (7) · Last reviewed commit: "chore(deps): bump the npm-minor-and-patc..." · Reviewed by Greptile}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​radix-ui/​react-accordion@​1.3.1
	npm/​postcss@​8.5.28 ⏵ 8.5.31	+1		+1
	npm/​jszip@​3.10.1 ⏵ 3.10.2
	npm/​docx-preview@​0.3.7 ⏵ 0.4.1			+1
	npm/​autoprefixer@​10.5.4 ⏵ 10.6.1	+1		+1
	npm/​@​xyflow/​react@​12.11.3 ⏵ 12.12.0			+1	+1

View full report

[greptile-apps]

Renderer changes go unchecked

docx-preview is pinned because preview safety depends on when it creates and moves HTML into the iframe. This upgrade changes that renderer, but preview-sandbox.smoke.ts only checks iframe attributes and cannot catch changes to that timing. Add a browser test that renders a crafted document through ArtifactDocxPreview and checks that no handler runs in the parent page.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent_env/explorer/ui/package.json
Line: 23

Comment:
**Renderer changes go unchecked**

`docx-preview` is pinned because preview safety depends on when it creates and moves HTML into the iframe. This upgrade changes that renderer, but `preview-sandbox.smoke.ts` only checks iframe attributes and cannot catch changes to that timing. Add a browser test that renders a crafted document through `ArtifactDocxPreview` and checks that no handler runs in the parent page.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Shipped dependency list is outdated

These upgrades leave THIRD_PARTY_NOTICES.md listing the old shipped versions, including docx-preview 0.3.7 and @xyflow/react 12.11.3. Refresh the affected entries against the new lockfile so the notice list describes the packages included in the built UI.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/agent_env/explorer/ui/package.json
Line: 21-24

Comment:
**Shipped dependency list is outdated**

These upgrades leave `THIRD_PARTY_NOTICES.md` listing the old shipped versions, including `docx-preview` 0.3.7 and `@xyflow/react` 12.11.3. Refresh the affected entries against the new lockfile so the notice list describes the packages included in the built UI.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.