• Path: return last point for getPointAtLength past a closed path #2053 (Yarchik)
• Arc.getSelfRect() reports a full circle for a zero-degree clockwise arc #2054 (Alexander Kireev)
• Shape: respect imageSmoothingEnabled for fillPatternImage #2055 (MarkXian)
• Util: preserve alpha of the named color "transparent" #2056 (Yarchik)
• Util: parse rgb() components written as percentages #2057 (jaybhade)
• Util: colorToRGBA() fails to parse non-integer HSL hue #2059 (Xuepoo)
• Line: getSelfRect wrong for multi-segment bezier and degenerate-derivative segments #2061 (Xuepoo)
• Line: avoid NaN control points on closed tensioned lines with coincident points #2062 (rajanpanth)
• Line: guard the zero-distance case inside getControlPoints (Anton Lavrevov)
• Line: cover joints and near-degenerate derivatives in bezier bounds (Anton Lavrevov)
• Path: exact getSelfRect bounds for quadratic segments (Anton Lavrevov)
• Line: exact getSelfRect bounds for lines with a tension (Anton Lavrevov)

• Line: write the control point distance sum once (Anton Lavrevov)

• Text: hoist stringToArray(line) out of _setTextData binary search #2044 (Damian Frizzi)

• remove the formatting check (Anton Lavrevov)

• b5c7a83: Fix ValidatorFunc Type Mistake (foolishflyfox) #1998
• ecdf162: Improve Transformer performance with many attached nodes (Anton Lavrevov)
• 976a63a: Add Transformer perf invariant tests; widen autoDraw suspension (Anton Lavrevov)
• 7b3cf3b: Simplify a bit (Anton Lavrevov)
• a203de9: sandbox (Anton Lavrevov)
• 6e4025c: clear (Anton Lavrevov)
• b92018b: Merge branch 'master' of github.com:konvajs/konva (Anton Lavrevov)
• bc123b3: Declare canvas and skia-canvas as optional peer dependencies (Anton Lavrevov)
• ed1e0cc: Skip pattern smoothing sanity check on skia-canvas (Anton Lavrevov)
• f9bd818: Report full circle for any full-turn angle in Arc.getSelfRect (Anton Lavrevov)
• dd90ff4: Merge pull request #2054: fix Arc.getSelfRect for full-turn angles (Anton Lavrevov)
• 4f8e1a8: color parsing fixes, fix some color values. close #2063, close #2064 (Anton Lavrevov)
• 4ebadaf: Merge branch 'master' into fix/line-tension-nan (Anton Lavrevov) #2062
• Line NaN bounding rect fix (Anton Lavrevov)
• cover all unreleased changes since 10.3.0 (Anton Lavrevov)
• c7145cc: Merge branch 'master' into fix/line-bezier-selfrect (Anton Lavrevov) #2061
• d2b96f5: fix(Line,Path): share one exact solver for cubic bezier bounds (Anton Lavrevov)
• 9e8a106: update CHANGELOG with new version (Anton Lavrevov)
• fb706a2: build for 10.3.1 (Anton Lavrevov)
• fad321d: update cdn link (Anton Lavrevov)

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/create-rari-app@0.5.24...create-rari-app@0.5.25

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/rari@0.15.12...rari@0.15.13

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/@rari/use-cache@0.15.12...@rari/use-cache@0.15.13

• Adopt SelectedMetadata for metadata rendering: #97387
• fix(next/image): reject empty image on read/write to disk cache : #97278
• Turbopack: remove stale manifests for deleted routes: #97333
• Turbopack: make unreachable codegen more generic: #97385

Huge thanks to @gnoff, @styfle, @marcoshernanz, and @mischnic for helping!

• New filenameValidation option in ZipReader and getEntries(). It rejects entry names that do not map safely to a file path. It accepts "strict", "balanced" and "tolerant", and defaults to the value of the strictness option. Rejected names throw the new ERR_UNSAFE_FILENAME error, which carries the offending name in its filename property
• New normalizeFilename option in ZipReader and getEntries(). It is called with the decoded name of each entry and its result replaces that name. It runs after decoding and before validation, so repairing a name is enough to make it pass filenameValidation. Returning undefined keeps the decoded name. The filesystem API inherits the option from ZipReaderConstructorOptions
• The decodeText and encodeText options now receive the type of the text they handle, "filename" or "comment", as their last argument. Hooks declaring fewer parameters keep working
• exportFileSystemHandle() now reports what happened when an export fails. The new entryName property of EntryError holds the name of the entry that failed, relative to the exported entry. The new exportedEntryNames property lists the files that were completely written before the failure. Every other file of the export is either missing or empty, so this is the only way to tell a file the export completed from one it created but never filled
• exportFileSystemHandle() called with concurrent set to true now collects every failure instead of reporting only the first one. The other failures are listed in the new entryErrors property of EntryError. Failures raised deeper in the tree are flattened into that list
• New ERR_INVALID_LEVEL, ERR_INVALID_PASSWORD_TYPE, ERR_INVALID_STRICTNESS, ERR_INVALID_FILENAME_VALIDATION and ERR_INVALID_MAX_APPENDED_DATA_SIZE error constants

• Entry names containing a .. path component, or starting with /, with a drive letter like C:, or with \\, are now rejected when reading an archive. They throw ERR_UNSAFE_FILENAME. Set filenameValidation to "tolerant" to restore the previous behavior. This default was verified against a corpus of 572 archives holding 257,333 entries. None of them was rejected, so the new default costs nothing on real archives. A backslash is never treated as a path separator. It is legal on UNIX file systems, and it also occurs as the trail byte of double-byte filenames in Shift-JIS, Big5 and GBK, where converting it would corrupt the name
• The strictness option set to "strict" now also rejects empty and . path components, e.g. a//b.txt and ./cur.txt
• Invalid option values now throw instead of falling back silently to a default. A level outside the integers 0 to 9 throws ERR_INVALID_LEVEL, and used to disable compression entirely when it was negative or not a number. A password that is not a string, or a rawPassword that is not a Uint8Array, throws ERR_INVALID_PASSWORD_TYPE. A value of another type used to produce an unencrypted archive, and a rawPassword passed as a string used to produce an archive that its equivalent password cannot open. An unknown strictness or filenameValidation throws instead of behaving as "balanced". An invalid maxAppendedDataSize throws instead of being accepted. A non-integer encryptionStrength, uid, gid or unixMode is now rejected by the guard whose message already announced it. Values meaning "no password", i.e. undefined, null, an empty string and an empty Uint8Array, keep working as before. Numeric options also keep accepting the strings that represent them, e.g. level set to "9", because form controls, query strings and environment variables all yield strings
• The filesystem API now ignores empty and . path components when importing an archive. Names such as a//b.txt and ./cur.txt no longer create entries with an empty name or named .
• When reading an entry fails, the writable of the writer is now aborted with the error instead of being closed. A custom writer used to observe a successful close although the data was truncated

• Errors raised by addFileSystemHandle() and exportFileSystemHandle() are now rethrown unmodified instead of being wrapped. Their message is comparable to the exported ERR_* constants again, and their entryName property identifies the handle or the entry that failed
• exportFileSystemHandle() called with concurrent set to true now cancels the entries that have not started yet when an entry fails, instead of letting the rest of the export run to completion

• Web worker support is now tree-shakable. The web worker backend was moved to a separate module which registers itself when imported. Custom builds that do not import it no longer include the web worker plumbing and run codecs inline. The standard entry points import it, so the published builds are unaffected
• The most frequently used globals are destructured in the intro of the bundles, which reduces the size of the minified builds

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.8.49...v2.8.50

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/v0.15.12...v0.15.13

See CHANGELOG.md for details.

Full Changelog: https://github.com/rari-build/rari/compare/use-cache-binaries@0.15.12...use-cache-binaries@0.15.13

Release 2026-08-14 22:14

• router-core: inline buildWithMatches inside buildLocation (#8070) (bdaf73a406) by @Sheraff
• router-core: inline isFunction utility (#8069) (cf6ab178b3) by @Sheraff
• router-core: inline getOpenAndCloseBraces in parseSegment (#8071) (4c89b15dd2) by @Sheraff
• inline isCtrlKey utility inside all Link components (#8073) (0fdf9ff16f) by @Sheraff

• @tanstack/react-router@1.170.29
• @tanstack/react-start@1.168.46
• @tanstack/react-start-client@1.168.27
• @tanstack/react-start-rsc@0.1.45
• @tanstack/react-start-server@1.167.34
• @tanstack/router-cli@1.167.30
• @tanstack/router-core@1.171.24
• @tanstack/router-generator@1.167.30
• @tanstack/router-plugin@1.168.32
• @tanstack/router-vite-plugin@1.167.32
• @tanstack/solid-router@1.170.27
• @tanstack/solid-start@1.168.44
• @tanstack/solid-start-client@1.168.26
• @tanstack/solid-start-server@1.167.33
• @tanstack/start-client-core@1.170.24
• @tanstack/start-plugin-core@1.171.36
• @tanstack/start-server-core@1.169.28
• @tanstack/start-static-server-functions@1.167.29
• @tanstack/start-storage-context@1.167.26
• @tanstack/vue-router@1.170.26
• @tanstack/vue-start@1.168.43
• @tanstack/vue-start-client@1.167.29
• @tanstack/vue-start-server@1.167.33

• Updated dependencies [4c89b15, cf6ab17, 0fdf9ff, bdaf73a]:
  • @tanstack/router-core@1.171.24
  • @tanstack/vue-router@1.170.26
  • @tanstack/start-client-core@1.170.24