Dependency maintenance

Routine Dependabot version PRs are paused with open-pull-requests-limit: 0 in each configured package location. Maintainers can review compatible updates as one batch, validate the combined tree locally, and squash it into one commit. Security alerts and security-update PRs are separate repository settings; this configuration does not enable them. Check those settings before public launch.

October 2026 consolidation

The batch incorporates these Dependabot PRs. The numbers refer to PRs from before the public snapshot and are not linked, because those PRs are not in this repository.

• Requests 2.34.2 (#7), MarkupSafe 3.0.4 (#10), and python-dotenv 1.2.4 (#13): maintained backend fixes, including dotenv parsing of empty values, BOMs, and Windows backslashes. The project and standalone minimums include the dotenv fix.
• Mocha 12.0.3 in both hosts (#12, #22) and openapi-typescript 7.13.0 (#14): remove vulnerable development dependency chains reported by npm audit. Both OpenAPI generator installations stay aligned. The generator now prints the returned TypeScript AST and preserves Python's required/optional fields with defaultNonNullable: false. Generated type files are regenerated; the wire schemas and runtime validation policy are unchanged.
• VSCE 4.0.0 (#15) and the native plugin packager 6.24.0 (#20): refresh packaging dependencies while retaining the documented Node 22 runtime.
• MCP extensions 0.2.1 (#25): current plugin extension SDK fixes. The separate MCP Apps protocol remains on its existing version in both Canvas and plugin.
• YAML 2.9.1 (#27): fixes recursive merge-alias handling. Its lockfile retains the existing Canvas overrides and clean-install dependency tree.

The following upgrades are deferred rather than combined into the launch tree:

• CI action major versions (#4–#6): the existing CI pins remain usable.
• A platform-specific torchvision +cpu pin (#8): macOS wheels have no +cpu suffix; the current CPU-index setup already selects the appropriate wheel.
• Raising the ONNX minimum (#9): fresh installs already resolve the current version; no feature here requires dropping the older supported minimum.
• Node 26 type packages (#11, #19, #24) and newer VS Code declarations (#16): declaration versions must follow supported hosts, not the newest package.
• Testing Library major migrations (#17, #23), MCP Apps 2 (#18), TypeScript 7 (#21), tldraw 5.5 (#26), and Playwright 1.64 (#28): these require separate compatibility work or provide no required launch fix. In particular, the renderer and its assets must move together, and TypeScript 7 breaks the existing compiler-API boundary checks.

The consolidation does not add model profiling, GPU optimization, or new product features. Remaining legacy development dependency advisories are not a claim that this entire tree has a clean security audit.

The cache changelog example uses inline code so its <time> placeholder does not become an unterminated HTML tag in the newly merged documentation site.

Validation

Use the checks in local setup, including generated contract checks, both host suites, Canvas tests/build, backend tests, and local package verification. Run npm ci against every changed lockfile; do not accept an incremental install as proof that a clean checkout can install.

Canvas agent transport dependencies

The source sync adds the ACP SDK to the editor host and AI SDK transport packages to Canvas. Destination security overrides and existing release identities remain. AI SDK upstream notice metadata is retained under plugin/licenses/ for archive notice generation; notices are still assembled from the actual bundle. The local VSIX is a development artifact and does not establish renderer distribution permission.