build: bump the frontend-deps group across 1 directory with 37 updates

[dependabot]

Bumps the frontend-deps group with 37 updates in the /App/frontend-app directory:

Package	From	To
@azure/msal-browser	5.11.0	5.17.3
@azure/msal-react	5.4.2	5.5.4
@fluentui/react	8.125.6	8.125.7
@fluentui/react-components	9.74.1	9.74.4
@fluentui/react-datepicker-compat	0.6.32	0.6.34
@fluentui/react-file-type-icons	8.18.0	8.18.1
@fluentui/react-icons	2.0.328	2.0.334
@microsoft/applicationinsights-react-js	19.4.0	19.4.1
@microsoft/applicationinsights-web	3.4.1	3.4.3
i18next	26.3.0	26.3.6
i18next-http-backend	4.0.0	4.0.1
marked	18.0.4	18.0.7
pdfjs-dist	6.0.227	6.2.108
react	19.2.7	19.2.8
@types/react	19.2.16	19.2.17
react-dom	19.2.7	19.2.8
react-dropzone	15.0.0	19.1.1
react-i18next	17.0.8	17.0.11
react-router-dom	7.16.0	7.18.2
react-tiff	0.0.16	0.0.17
@testing-library/jest-dom	6.9.1	7.0.0
@typescript-eslint/eslint-plugin	8.60.1	8.65.0
@typescript-eslint/parser	8.60.1	8.65.0
@vitejs/plugin-react	6.0.2	6.0.4
autoprefixer	10.5.0	10.5.4
body-parser	2.2.2	2.3.0
concurrently	10.0.3	10.0.4
eslint	10.4.1	10.8.0
eslint-plugin-react-refresh	0.5.2	0.5.3
postcss	8.5.15	8.5.25
prettier	3.8.3	3.9.6
prettier-plugin-tailwindcss	0.8.0	0.8.1
sass	1.100.0	1.102.0
tailwindcss	4.3.0	4.3.3
ts-jest	29.4.11	29.4.12
typescript	6.0.3	7.0.2
vite	8.0.16	8.1.5

Updates @azure/msal-browser from 5.11.0 to 5.17.3

Release notes

Sourced from @​azure/msal-browser's releases.

@​azure/msal-browser v5.17.3

5.17.3

Wed, 29 Jul 2026 00:26:30 GMT

Patches

• Add single retry with 100ms backoff for token POST transport failures #8732 (thomas.norling@microsoft.com)
• Streamline the platform broker request to only include the MSAL JS acquire-token parameters defined in the platform broker contract and params required on the ESTS /token call #8714 (lalima.sharda@gmail.com)
• Fill telemetry gaps in platform brokering flow with extension #8699 (lalima.sharda@gmail.com)
• Bump @​azure/msal-common to v16.11.3 (beachball)

@​azure/msal-browser v5.17.1

5.17.1

Wed, 15 Jul 2026 22:35:35 GMT

Patches

• Add internal ES256/P-256 DPoP crypto support to BrowserCrypto #8683 (hectormmg@microsoft.com)
• Bump @​azure/msal-common to v16.11.2 (beachball)

@​azure/msal-browser v5.17.0

5.17.0

Tue, 07 Jul 2026 22:16:01 GMT

Minor changes

• Add auth.popupRelayUri: a double-popup option for apps that customize COOP/storage-partitioning, relaying acquireTokenPopup/logoutPopup through a top-level same-origin relay page (runPopupRelay) so tokens can be acquired from an untrusted cross-origin iframe. #8687 (kshabelko@microsoft.com)
• Bump @​azure/msal-common to v16.11.1 (beachball)

Patches

• Fix decode logs script for the standalone mode #8697 (kshabelko@microsoft.com)

@​azure/msal-browser v5.16.0

5.16.0

Tue, 30 Jun 2026 21:04:19 GMT

Minor changes

• Bump @​azure/msal-browser to match @​azure/msal-browser-1p (msaljsbuilds@microsoft.com)
• Bump @​azure/msal-common to v16.11.0 (beachball)

Patches

• Add previousLibraryVersion to all telemetry events #8688 (thomas.norling@microsoft.com)

... (truncated)

Commits

• 3e4b837 Fix/telemetry broker fields consistency (#8699)
• cdab897 feat(msal-browser): Add retry logic and telemetry for token POST failures (#8...
• e1fbfbf Post-release PR (#8715)
• 83ab1ca Bump next from 15.5.19 to 15.5.21 (#8727)
• 1262aaf Bump shell-quote from 1.8.4 to 1.10.0 (#8731)
• 11f7233 Bump body-parser from 1.20.5 to 1.20.6 (#8719)
• 1afc948 Bump @​azure/msal-browser to 5.17.2 to match @​azure/msal-browser-1p (#8726)
• 0e34960 Streamline platform broker request to MSAL JS acquire-token contract params (...
• 3168a46 Bump tar from 7.5.16 to 7.5.21 (#8717)
• 489de12 Bump fast-uri from 3.1.2 to 3.1.4 (#8720)
• Additional commits viewable in compare view

Updates @azure/msal-react from 5.4.2 to 5.5.4

Release notes

Sourced from @​azure/msal-react's releases.

@​azure/msal-react v5.5.4

5.5.4

Wed, 29 Jul 2026 00:26:31 GMT

Patches

• Bump @​azure/msal-browser to v5.17.3 (beachball)

@​azure/msal-react v5.5.3

5.5.3

Wed, 15 Jul 2026 22:35:35 GMT

Patches

• Bump @​azure/msal-browser to v5.17.1 (beachball)

@​azure/msal-react v5.5.2

5.5.2

Tue, 07 Jul 2026 22:16:01 GMT

Patches

• Bump @​azure/msal-browser to v5.17.0 (beachball)

@​azure/msal-react v5.5.1

5.5.1

Tue, 30 Jun 2026 21:04:20 GMT

Patches

• Bump @​azure/msal-browser to v5.16.0 (beachball)

@​azure/msal-react v5.5.0

5.5.0

Tue, 23 Jun 2026 22:19:30 GMT

Minor changes

• Match the updated msal-browser AuthError signature #8609 (sameera.gajjarapu@microsoft.com)
• Bump @​azure/msal-browser to v5.15.0 (beachball)

@​azure/msal-react v5.4.5

5.4.5

Tue, 16 Jun 2026 19:46:35 GMT

... (truncated)

Commits

• 3e4b837 Fix/telemetry broker fields consistency (#8699)
• cdab897 feat(msal-browser): Add retry logic and telemetry for token POST failures (#8...
• e1fbfbf Post-release PR (#8715)
• 83ab1ca Bump next from 15.5.19 to 15.5.21 (#8727)
• 1262aaf Bump shell-quote from 1.8.4 to 1.10.0 (#8731)
• 11f7233 Bump body-parser from 1.20.5 to 1.20.6 (#8719)
• 1afc948 Bump @​azure/msal-browser to 5.17.2 to match @​azure/msal-browser-1p (#8726)
• 0e34960 Streamline platform broker request to MSAL JS acquire-token contract params (...
• 3168a46 Bump tar from 7.5.16 to 7.5.21 (#8717)
• 489de12 Bump fast-uri from 3.1.2 to 3.1.4 (#8720)
• Additional commits viewable in compare view

Updates @fluentui/react from 8.125.6 to 8.125.7

Commits

• See full diff in compare view

Updates @fluentui/react-components from 9.74.1 to 9.74.4

Commits

• 4aa1084 release: applying package updates - react-components
• cbee28b fix(priority-overflow): avoid teardown notifications (#36401)
• 9c8dada fix(ci): scope headless experimental yarn change to release-headless config (...
• bc5035b fix(web-components): fix focusgroup in tree when focusgroup is natively suppo...
• e75edae fixed voice controll accessibility issue (#36292)
• 04c1f2d ci(monosize): upgrade to monosize 0.9 and switch bundle-size storage from Azu...
• 869622d ci: add experimental headless release pipeline (#36377)
• f095a6a chore: upgrade webpack to 5.108.4 (#36375)
• a803aa3 release: applying package updates - web-components
• 88ae4e3 docs(web-components): Update v2 to v3 migration doc (#36372)
• Additional commits viewable in compare view

Updates @fluentui/react-datepicker-compat from 0.6.32 to 0.6.34

Commits

• c771f58 release: applying package updates - react-components
• aedc345 release: applying package updates - web-components
• e6a6fa4 fix(web-components): set focus on autofocus element when a dialog is open (#3...
• 6097519 fix(fluent2-theme): high contrast focus styles for PrimaryButton (#36354)
• cb3684e chore(web-components): Upgrade Fluent Web Components to FAST Element v3 (#36351)
• 7088c40 fix: update link focus style to match latest treatment (#36352)
• 078dec1 feat(react-headless-components-preview): add headless MenuButton (#36320)
• 6bc2c66 fix(react-button): do not expose default menuIcon in useMenuButtonBase_unstab...
• 5d8f8f0 fix(Calendar): year prev/next buttons don't lose focus when they become disab...
• 131593c release: applying package updates - web-components
• Additional commits viewable in compare view

Updates @fluentui/react-file-type-icons from 8.18.0 to 8.18.1

Commits

• 0490111 applying package updates
• 2cef92d Publish docs pipeline artifact after azure upload (#17881)
• f40b8af Reassign joschect's owned items (#17880)
• df8bf99 Bump ssri from 6.0.1 to 6.0.2 (#17852)
• 58e5e19 Fix bug where adding an item from outside of UPP forces focus on the input (#...
• 222c38f DetailsList Example: removed text only menu item from CommandBar so it's no l...
• c47093e fix(makeStyles): DOM renderer should not throw in SSR (#17904)
• 0156818 Export Portal from react-components (#17870)
• 619ff0a Remove default document in useOnClickOutside (#17898)
• 10a1982 feat(Popup): add data-popup-trapfocus to differentiate beween dialog and popu...
• Additional commits viewable in compare view

Updates @fluentui/react-icons from 2.0.328 to 2.0.334

Commits

• See full diff in compare view

Updates @microsoft/applicationinsights-react-js from 19.4.0 to 19.4.1

Changelog

Sourced from @​microsoft/applicationinsights-react-js's changelog.

19.4.1 (June 22nd, 2026)

Changes

• Bump @microsoft/applicationinsights-core-js and @microsoft/applicationinsights-properties-js dependency from ^3.4.1 to ^3.4.2.
• Resolved all reported npm audit vulnerabilities (ws, @babel/core, markdown-it, and the js-yaml transitive chain) with no breaking changes to consumers.

Commits

• See full diff in compare view

Updates @microsoft/applicationinsights-web from 3.4.1 to 3.4.3

Changelog

Sourced from @​microsoft/applicationinsights-web's changelog.

3.4.3 (July 2nd, 2026)

This is a maintenance release for the 3.4.x version line adding a new SDK statistics feature, a PostChannel reliability fix, and dependency security hardening. The @microsoft/1ds-post-js channel is numbered 4.4.3 and requires v3.4.3.

Significant Changes (since 3.4.2)

• Customer SDK Stats: Added a new SdkStats feature that periodically collects internal SDK usage/health statistics. It is enabled by default and can be disabled (or explicitly configured) via the featureOptIn configuration (e.g. featureOptIn: { SdkStats: { mode: FeatureOptInMode.disable } }); the collection interval defaults to 15 minutes (sdkStats.int).

• PostChannel Auto-Flush Stall Fix: Fixed a permanent stall in @microsoft/1ds-post-js where, under sustained intermittent send failures (e.g. a load balancer returning occasional 503s), auto flush could wedge behind the flush() wait-for-idle timer and permanently stop draining the in-memory queue — causing telemetry to be silently dropped as QueueFull until the process was restarted. Auto flush is now fire-and-forget and no longer parks the scheduler waiting for the manager to become completely idle.

• Dependency Security Hardening: Pinned tar to >=7.5.16 to remediate CVE-2026-53655 and resolved the remaining npm audit findings in build tooling via dependency overrides (js-yaml, yaml, markdown-it, linkify-it). These are build/tooling changes and do not affect the published runtime packages.

Changelog

• #2746 Fix PostChannel auto-flush permanent stall under sustained intermittent send failures
• #2745 fix(security): pin tar >=7.5.16 to remediate CVE-2026-53655
• #2707 Enable Customer SDK Stats
• Resolve remaining npm audit findings via dependency overrides (js-yaml, yaml, markdown-it, linkify-it)

Full Changelog: microsoft/ApplicationInsights-JS@3.4.2...3.4.3

3.4.2 (June 18th, 2026)

This is a maintenance release for the 3.4.x version line containing security hardening, bug fixes, build tooling improvements, and CI updates. The @microsoft/1ds-post-js channel is numbered 4.4.2 and requires v3.4.2.

Commits

• See full diff in compare view

Updates i18next from 26.3.0 to 26.3.6

Release notes

Sourced from i18next's releases.

v26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

v26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

v26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). Thanks to zx (Jace) for the responsible disclosure.

v26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

v26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

v26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

Changelog

Sourced from i18next's changelog.

26.3.6

• fix: allow TypeScript 7 in the optional typescript peer dependency range (^5 || ^6 || ^7). With typescript@7.0.2 in a project, npm install failed with an ERESOLVE peer conflict. The published types are TS7-compatible as-is: every test/typescript suite produces identical results under 6.0 and 7.0.2. Reported in react-i18next#1927, thanks @​andikapradanaarif.

26.3.5

• fix: $t() nesting options blocks that span multiple lines are now parsed. nest() decided where the nested key ends by testing match[1] with /{.*}/, whose dot does not cross line breaks — so a $t(key, { ... }) options object containing a newline was treated as having no options, mis-split as formatters, and the nested lookup ran without its options (placeholders stayed unresolved). The nesting regexp itself already matches newlines inside $t(...); adding the s (dotAll) flag makes multiline options behave like the single-line form. Thanks @​spokodev (#2440).
• fix: getUsedParamsDetails (the returnDetails: true path) no longer mutates the passed replace object. It wrote count straight onto options.replace so the returned usedParams would include it — a caller reusing one replace object across t() calls then carried a stale count into later interpolations (e.g. a previous call's count: 5 rendered instead of the current call's value). The details are now built from a copy; usedParams still includes count. Thanks @​spokodev (#2441).
• fix: with the default skipOnVariables: true + escapeValue: true, a {{placeholder}} carried inside an interpolated value now stays literal even when the value contains escapable characters. The skip logic advanced the regex lastIndex by the raw value length, but the escaped text written into the string is longer, so lastIndex landed inside the inserted value and a trailing {{placeholder}} in it got interpolated — leaking another in-scope variable that should have stayed literal (values without escapable characters were already skipped correctly). The advance now uses the escaped length that is actually written, and the regex-safe $-doubling is applied only at the String.replace call so it can't distort the length arithmetic. Thanks @​spokodev (#2442).

26.3.4

• fix(security): deepExtend (used by addResourceBundle(..., deep, overwrite)) no longer recurses into inherited properties. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in (e.g. hasOwnProperty, toString) caused recursion into the shared Object.prototype function and, with overwrite: true, could overwrite e.g. Object.prototype.hasOwnProperty.call with a non-callable value — corrupting a shared built-in process-wide (DoS). Existence is now checked with Object.prototype.hasOwnProperty.call, so such keys are copied as plain own data instead. This complements the existing __proto__/constructor guard and is also strictly more correct for an own-property merge. Only affects applications that pass attacker-controlled data with deep: true and overwrite: true; no standard backend/integration does this. Distinct from CVE-2026-48713 / CVE-2026-48714 (different packages, setPath mechanism). See advisory GHSA-6jcc-5g8w-32mx, CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Thanks to zx (Jace) @​manus-use for the responsible disclosure.

26.3.3

• fix(types): selector t($ => $.arr, { returnObjects: true, context }) on a JSON array of heterogeneous objects now preserves each element's full shape (e.g. { transKey1: string; transKey2: string }[]) instead of collapsing to a union of partial element types. Two type-level causes: (1) FilterKeys evaluated the whole array element type at once, so keyof (A | B) only saw the keys common to every element — it now distributes over the object union and filters each element independently; (2) when TypeScript merges mismatched array element types it injects phantom optional undefined keys (e.g. transKey1_withContext?: undefined on elements that don't define it), which the context-detection helpers mistook for real context variants — they now skip keys typed as undefined. Also adds a dedicated context + returnObjects: true selector overload using const Fn + ReturnType<Fn>, so Target is no longer collapsed to unknown via ApplyTarget. Resolves Problem 1 of #2398 (Problem 2 was already fixed on master). Thanks @​sauravgupta-dotcom (#2438). Fixes #2398.

26.3.2

• fix: chained formatters with a parenthesised option that contains the format separator (e.g. join(separator: ', ')) now work at any position in the chain, not just first. Previously the comma-in-parens reassembly only repaired formats[0], so {{v, uppercase, join(separator: ', ')}} split the join(...) option on the inner comma and never rejoined it, producing corrupt output. Replaced the first-position-only repair with a position-independent pass that re-joins fragments until each open paren closes. Thanks @​spokodev (#2437).

26.3.1

• fix(types): t() with a keyPrefix no longer pollutes its return type with sibling keys' values. A regression in 26.3.0 — the [Res] extends [never] guards added to KeysBuilderWithReturnObjects / KeysBuilderWithoutReturnObjects turned the builders into deferred conditional types, so KeyPrefix<Ns> stopped resolving to a literal union and keyPrefix inference widened to the whole namespace. Symptom: useTranslation(ns, { keyPrefix: 'a.b' }) then t('title') would resolve to '<a.b>.title' | '<other.path>.title' | ... instead of just the scoped value. Affected every react-i18next user using keyPrefix. Restored to the eager 26.2.0 form. The same-namespace conflict handling from #2434 still works via _DropConflictKeys at the merge layer (in options.d.ts). Thanks @​aaronrosenthal (#2436).

Commits

• e1c60d4 26.3.6
• 04da43e fix: allow typescript 7 in optional peerDependencies range (react-i18next#1927)
• 8eed4ac build
• 573ae73 26.3.5
• cc54b05 docs(changelog): 26.3.5 — multiline $t() options, replace mutation, escaped-l...
• 3180d67 fix: skip interpolation of placeholders inside escaped values (#2442)
• d16f5a2 fix: stop mutating the passed replace object when returning details (#2441)
• bed56c1 fix: parse $t() nesting options block that spans multiple lines (#2440)
• c19e458 docs(changelog): link GHSA advisory for deepExtend fix
• 7bb87d0 docs(changelog): reference security advisory for deepExtend fix
• Additional commits viewable in compare view

Updates i18next-http-backend from 4.0.0 to 4.0.1

Changelog

Sourced from i18next-http-backend's changelog.

4.0.1

• fix: allow @ in ns values so scoped-package-style namespace names such as @organization/package-name fetch correctly again (#191). 3.0.6 relaxed the ns check for / but left @ in the shared denylist. In the URL path position @ is a plain RFC 3986 pchar with no structural meaning; it stays blocked for lng, where it marks the userinfo/authority boundary. Every other pattern from the 3.0.5 advisory (.., \, %, ?, #, whitespace, control chars, prototype keys, oversized inputs) remains blocked for both keys.

Commits

• 5658217 4.0.1
• 2b2e771 fix: allow @ in ns values for scoped-package-style namespaces
• 64c1105 Bump next from 16.2.6 to 16.2.11 in /example/next (#190)
• 7be00f7 Remove deprecated baseUrl from tsconfig to fix Deno CI type check
• 8eeafa2 README: mention npx i18next-cli localize as the zero-to-localized path
• 37df2ff Bump i18next-http-backend from 3.0.1 to 3.0.5 in /example/node (#187)
• 175e327 Bump next from 16.2.3 to 16.2.6 in /example/next (#186)
• b74344c Fix typo in Locize advice section ('backed' → 'backend')
• 5521246 Modernize locize.com URLs and refresh UTM tags
• See full diff in compare view

Updates marked from 18.0.4 to 18.0.7

Release notes

Sourced from marked's releases.

v18.0.7

18.0.7 (2026-07-21)

Bug Fixes

• Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexes (#4014) (f945fc5), closes #3991
• Avoid O(n^2) masked source rebuild in inline tokenizer (#4017) (9154f8f)
• keep empty list after blockquote as a sibling block (#4004) (3f144a0)
• preserve code spans adjacent to tildes (#4012) (0de7188)
• Recognize setext headings whose first line starts with # (#4015) (f056437), closes #1
• treat a line of only tabs as a blank line between paragraphs (#4007) (bc2f121)

v18.0.6

18.0.6 (2026-07-09)

Bug Fixes

• Avoid O(n^2) backtracking in inline link href regex (#4013) (a009808)
• Fix ordered lists after blockquotes (#4003) (33928d0)
• keep trailing text on HTML block close line for PI, declarations, and CDATA (#3991) (bbb84c8)

v18.0.5

18.0.5 (2026-06-04)

Bug Fixes

• parse empty list item with trailing space (#3984) (b55410f)

Commits

• a8971a1 chore(release): 18.0.7 [skip ci]
• d899c2e chore(deps): bump actions/setup-node from 6 to 7 (#4025)
• 7fbf82e chore(deps-dev): bump semantic-release from 25.0.7 to 25.0.8 (#4026)
• 738edf2 chore(deps-dev): bump brace-expansion from 5.0.2 to 5.0.6 (#4027)
• 9154f8f fix: Avoid O(n^2) masked source rebuild in inline tokenizer (#4017)
• f945fc5 fix: Avoid O(n^2) backtracking in HTML block close and tilde interrupt regexe...
• 3f144a0 fix: keep empty list after blockquote as a sibling block (#4004)
• 0de7188 fix: preserve code spans adjacent to tildes (#4012)
• f056437 fix: Recognize setext headings whose first line starts with # (#4015)
• 12bfa94 chore(deps-dev): bump semantic-release from 25.0.5 to 25.0.7 (#4020)
• Additional commits viewable in compare view

Updates pdfjs-dist from 6.0.227 to 6.2.108

Release notes

Sourced from pdfjs-dist's releases.

v6.2.108

This release contains improvements for annotation rendering, annotation editing, font conversion, image conversion, performance, SMask handling and text selection.

Changes since v6.1.200

• Bump the stable version in pdfjs.config by @​timvandermeij in mozilla/pdf.js#21510
• Add a workflow to publish the per-test coverage index by @​calixteman in mozilla/pdf.js#21507
• Add support for Sound annotations playing embedded audio by @​calixteman in mozilla/pdf.js#21501
• Remove the BOM from html files (bug 2051221) by @​calixteman in mozilla/pdf.js#21513
• Digital Signature and Certificate verification by @​beurdouche in mozilla/pdf.js#21247
• Bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in mozilla/pdf.js#21516
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in mozilla/pdf.js#21518
• Bump actions/cache/save from 5.0.5 to 6.1.0 by @​dependabot[bot] in mozilla/pdf.js#21515
• Bump actions/cache/restore from 5.0.5 to 6.1.0 by @​dependabot[bot] in mozilla/pdf.js#21517
• Take into account the current transform when getting font size for FreeText by @​calixteman in mozilla/pdf.js#20505
• Fix the version comment in the font tests GitHub Actions workflow by @​timvandermeij in mozilla/pdf.js#21519
• Fix escapePDFName producing malformed name escapes for control characters by @​spokodev in mozilla/pdf.js#21522
• A couple of SignaturePropertiesManager improvements (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21524
• Serialize GitHub Pages deployments to avoid concurrent deploy failures by @​calixteman in mozilla/pdf.js#21528
• Deduplicate the signature-properties warn/error toolbar icon by @​beurdouche in mozilla/pdf.js#21530
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in mozilla/pdf.js#21532
• [GeckoView] Add web-digital_signature_properties_manager import map (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21529
• Reduce duplication when updating undoButton/undoCloseButton in PDFThumbnailViewer.prototype.#updateStatus by @​Snuffleupagus in mozilla/pdf.js#21531
• Add basic support for non-embedded TrebuchetMS fonts (issue 21523) by @​Snuffleupagus in mozilla/pdf.js#21527
• Avoid text selection workaround in modern Chromium by @​nicolo-ribaudo in mozilla/pdf.js#21514
• Use the #getPageL10nArgs helper in the PDFThumbnailView.prototype.addPasteButton method by @​Snuffleupagus in mozilla/pdf.js#21534
• Move the bannerStateForResults helper into the SignaturePropertiesManager class (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21533
• Update to Babel 8 by @​nicolo-ribaudo in mozilla/pdf.js#21475
• Apply the appearance-stream scale factor when text is shown, not on setFont by @​calixteman in mozilla/pdf.js#21525
• Do not drop the character after U+FFFE or U+FFFF in encodeToXmlString by @​spokodev in mozilla/pdf.js#21526
• Enable the unicorn/logical-assignment-operators ESLint plugin rule by @​Snuffleupagus in mozilla/pdf.js#21511
• Remove unneeded this.#signatureData = null; lines in src/core/document.js by @​Snuffleupagus in mozilla/pdf.js#21536
• Use the MathClamp helper in the PDFImage.prototype.getComponents method by @​Snuffleupagus in mozilla/pdf.js#21537
• Update dependencies to the most recent versions by @​timvandermeij in mozilla/pdf.js#21539
• Add API unit-tests for getSignatures and getSignatureData (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21541
• Do not drop the character after U+FFFE or U+FFFF in Font.prototype.encodeString by @​mahirhir in mozilla/pdf.js#21538
• Don't needlessly wrap the marked content id-attribute in a string by @​Snuffleupagus in mozilla/pdf.js#21545
• Lookup "lenIV" inline in the Type1Parser.prototype.extractFontProgram method by @​Snuffleupagus in mozilla/pdf.js#21544
• Use Intl.Segmenter for the entire-word search matching by @​calixteman in mozilla/pdf.js#21521
• Implement a unit test for passing unsupported data types to MurmurHash3_64.update() by @​timvandermeij in mozilla/pdf.js#21546
• Add a FakeSignat...

  Description has been truncated