Chore(deps): bump the npm-production group with 8 updates

Merged
DE
1mo ago
+265-387

Bumps the npm-production group with 8 updates:

PackageFromTo
@next/env16.3.816.4.0
@sentry/nextjs11.4.011.6.0
@sentry/node11.4.011.6.0
@supabase/supabase-js2.117.22.117.3
lucide-react1.49.01.53.0
next16.3.816.4.0
openai7.27.07.30.1
pdfjs-dist6.3.2896.4.299

Updates @next/env from 16.3.8 to 16.4.0

Release notes

Sourced from @​next/env's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Turbopack: terminate failed plugin worker threads: #96592
  • Fix HTML-limited bot matching in prerender bypass rules: #96584
  • [ci] Fix create_release_branch for new repo permissions: #96641
  • test: skip action module instance deploy test: #96629
  • docs: quote the dynamicParams build error in a blockquote: #96633
  • [react-sync] Open pull requests as the bot that authors the commits: #96682
  • [Bench] Fixes for pure Fizz bench: #96771
  • Derive foreground cache revalidation from the consumer: #96731
  • Fix race when navigating Back before hydration: #96252
  • docs: present each Skill as steps in the AI agents guide: #96751
  • Reuse completed cache entries for the rest of a request: #96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
  • Remove WorkStore execution mode: #96674
  • Remove cache revalidation execution mode reads: #96670
  • Separate App Route render and prerender pipelines: #96662
  • Remove App Page execution mode reads: #96660
  • test: fix missing await in css-chunking test: #96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
  • Use Tailwind Turbopack loader in create-next-app: #96606
  • docs: instant navigation quick start with an adoption prompt: #96663
  • Separate App Page render and prerender pipelines: #96659
  • Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits

Updates @sentry/nextjs from 11.4.0 to 11.6.0

Release notes

Sourced from @​sentry/nextjs's releases.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';

    export default Sentry.withSentry(
    
env => ({
    
dsn: env.SENTRY_DSN,
    
tracesSampleRate: 1.0,
    
}),
    
handler,
    
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)
  • feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';

    export default Sentry.withSentry(
    
env => ({
    
dsn: env.SENTRY_DSN,
    
tracesSampleRate: 1.0,
    
}),
    
handler,
    
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits
  • 3c0c830 release: 11.6.0
  • 13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
  • 3605c50 chore(size-limit): Bump @​sentry/node size limits
  • 53ae996 meta(changelog): Update changelog for 11.6.0
  • e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • 2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
  • 5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
  • 221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
  • 966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
  • Additional commits viewable in compare view

Updates @sentry/node from 11.4.0 to 11.6.0

Release notes

Sourced from @​sentry/node's releases.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';

    export default Sentry.withSentry(
    
env => ({
    
dsn: env.SENTRY_DSN,
    
tracesSampleRate: 1.0,
    
}),
    
handler,
    
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)
  • feat(cloudflare): Wrap vinext Worker entries with @sentry/nextjs/cloudflare (#25000)

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

11.6.0

Important Changes

  • feat(nextjs): Add @sentry/nextjs/cloudflare (#24998)

    The new @sentry/nextjs/cloudflare entry point exports withSentry for the Worker entry of a Next.js app on Cloudflare Workers, for example .open-next/worker.js of OpenNext. It is withSentry of @sentry/cloudflare with the Next.js server handling added, so a Next.js app on Workers gets the same spans as on Node.js.

    import * as Sentry from '@sentry/nextjs/cloudflare';
import handler from './.open-next/worker.js';

    export default Sentry.withSentry(
    
env => ({
    
dsn: env.SENTRY_DSN,
    
tracesSampleRate: 1.0,
    
}),
    
handler,
    
);

  • feat(server-utils): Add instrumentation for pi-durable (#24993)

    The new piDurableIntegration traces agents built with pi-durable: each run, with its model requests and tool calls.

  • fix(core): Correct sleep clock drift on telemetry timestamps (#23054)

    When a device sleeps, the performance.now() clock of the browser stops. Before this change, timestamps of spans and other telemetry recorded after the sleep could be too early. The SDK now detects this drift and corrects its time origin, also for spans created from performance entries. Span end times are now computed from the performance.now() duration since the span start, like in OpenTelemetry (#24903).

Other Changes

  • feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate spans (#25044)
  • feat(server-utils): Record LangChain TypeSafeClassifier runs as gen_ai.evaluate spans (#25120)
  • fix(browser): Check for clock drift on page lifecycle events (#25091)
  • fix(core): Exclude attachments from internal exception events (#25160)
  • fix(effect): Convert Effect span times to the Sentry clock (#24972)
  • fix(effect): Detect HTTP spans named after the request method (#25159)
  • fix(node): Register Vercel keep-alive listeners once (#25146)
  • fix(replay): Place CLS and INP web vitals at the right time (#24990)
  • fix(server-utils): Record LangGraph span I/O for non-MessagesAnnotation state (#23315)
  • fix(sveltekit): Upload source maps with SvelteKit 3 (#25139)
  • chore: Add external contributor to CHANGELOG.md (#25136)
  • chore(deps-dev): Bump next from 15.5.24 to 15.5.27 (#25171)
  • chore(nitro): Remove stale bundler-plugin-core rollup external (#25149)

... (truncated)

Commits
  • 3c0c830 release: 11.6.0
  • 13743e9 Merge pull request #25184 from getsentry/prepare-release/11.6.0
  • 3605c50 chore(size-limit): Bump @​sentry/node size limits
  • 53ae996 meta(changelog): Update changelog for 11.6.0
  • e99e6e1 feat(remix): Propagate the server trace to Remix 3 page loads (#25145)
  • 2fdcb23 test(e2e): Add Mastra Jev classifier test to node-mastra (#25115)
  • 5bb9a68 feat(server-utils): Map Mastra classifier evaluations to gen_ai.evaluate span...
  • 221dd86 test(e2e): Add a cloudflare-pi-durable end-to-end application (#25022)
  • 966e1ff feat(cloudflare): Skip spans for the pi_ tables of PiHarness (#25028)
  • b70f6bb test(e2e): Add a node-pi-durable end-to-end application (#24994)
  • Additional commits viewable in compare view

Updates @supabase/supabase-js from 2.117.2 to 2.117.3

Release notes

Sourced from @​supabase/supabase-js's releases.

v2.117.3

2.117.3 (2026-10-07)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)
  • postgrest: treat TimeoutError as an abort in retry guard (#2732)
  • storage: send multipart fields before files (#2736)

❤️ Thank You

v2.117.3-canary.1

2.117.3-canary.1 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

v2.117.3-canary.0

2.117.3-canary.0 (2026-10-02)

🩹 Fixes

  • deps: bump next to patch RCE in realtime-js example (#2733)
  • functions: send a Blob or File with its own content type (#2714)
  • postgrest: treat TimeoutError as an abort in retry guard (#2732)

❤️ Thank You

Changelog

Sourced from @​supabase/supabase-js's changelog.

2.117.3 (2026-10-07)

🩹 Fixes

  • storage: send multipart fields before files (#2736)

❤️ Thank You

Commits

Updates lucide-react from 1.49.0 to 1.53.0

Release notes

Sourced from lucide-react's releases.

Version 1.53.0

What's Changed

New Contributors

Full Changelog: https://github.com/lucide-icons/lucide/compare/1.52.0...1.53.0

Version 1.52.0

What's Changed

Full Changelog: https://github.com/lucide-icons/lucide/compare/1.51.0...1.52.0

Version 1.51.0

What's Changed

New Contributors

... (truncated)

Commits

Updates next from 16.3.8 to 16.4.0

Release notes

Sourced from next's releases.

v16.4.0

Check out the 16.4 announcement post to get an overview of the changes.

Core Changes

  • Show compiler plugin warning in more situations: #75682
  • fix(scripts): correct typo in rm.mjs error message: #87015
  • docs: improve clarity and punctuation in README: #86096
  • Fix debug build paths Pages Router support entries: #93529
  • bundle-analyzer: record historical snapshots on each analyze run: #93520
  • fix: detect proxy.ts correctly with compound pageExtensions: #93246
  • feat(turbopack): support false values for resolveAlias config: #93331

Misc Changes

  • docs: correction to dynamicParams migration: #96624
  • docs: proxy event argument: #96435
  • docs: remove experimental note from runtime prefetching: #96615
  • Preserve per-segment prefetching after dynamic navigation: #96583
  • Rename static generation stream option to waitForAllReady: #96564
  • Remove obsolete static generation plumbing: #96563
  • [turbopack] Drop dead writes to exports: #96381
  • [turbopack] Ignore writes to exports after a module.exports = {} writes: #96380
  • [turbopack] Add test for sideEffects with optimizePackageImports: #96549
  • [turbopack] Strip leading BOM before parsing CSS: #96678
  • Upgrade React from cbb046ab-20260731 to 7dfc7ccd-20260803: #96550
  • docs: use relative doc links in instant-navigation error pages: #96672
  • Turbopack: terminate failed plugin worker threads: #96592
  • Fix HTML-limited bot matching in prerender bypass rules: #96584
  • [ci] Fix create_release_branch for new repo permissions: #96641
  • test: skip action module instance deploy test: #96629
  • docs: quote the dynamicParams build error in a blockquote: #96633
  • [react-sync] Open pull requests as the bot that authors the commits: #96682
  • [Bench] Fixes for pure Fizz bench: #96771
  • Derive foreground cache revalidation from the consumer: #96731
  • Fix race when navigating Back before hydration: #96252
  • docs: present each Skill as steps in the AI agents guide: #96751
  • Reuse completed cache entries for the rest of a request: #96727
  • Upgrade React from 7dfc7ccd-20260803 to 11eddecd-20260805: #96735
  • Remove WorkStore execution mode: #96674
  • Remove cache revalidation execution mode reads: #96670
  • Separate App Route render and prerender pipelines: #96662
  • Remove App Page execution mode reads: #96660
  • test: fix missing await in css-chunking test: #96725
  • docs (Skills): stop assuming app/ at the root and port 3000: #96696
  • Implement next/font BeforeResolvePlugins as ImportMappingReplacement: #95808
  • Use Tailwind Turbopack loader in create-next-app: #96606
  • docs: instant navigation quick start with an adoption prompt: #96663
  • Separate App Page render and prerender pipelines: #96659
  • Move App Router execution intent to entrypoints: #96640

... (truncated)

Commits
  • e273d5b v16.4.0
  • fdf41d6 [ai-upgrade] discover upgrade models and reasoning efforts from agent CLIs (#...
  • c3e76ad v16.4.0-canary.63
  • 47c6cc8 Document next analyze export in the package bundling guide (#99735)
  • 5b10604 Revert stabilization of forbidden() and unauthorized() (#99734)
  • f3a6f97 Preserve configured output directories during static export (#99507)
  • b22e5a2 Rename skill to next-bundle-optimizer and document its usage (#99731)
  • 74dc549 [turbo-tasks-backend] Clean up task state before publishing execution complet...
  • ccf8c15 v16.4.0-canary.62
  • b8c7c7f Improve static route error guidance (#99724)
  • Additional commits viewable in compare view

Updates openai from 7.27.0 to 7.30.1

Release notes

Sourced from openai's releases.

v7.30.1

7.30.1 (2026-10-08)

Bug Fixes

  • api: correct custom voice creation parameters (#2895) (3edaf0f)
  • deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.83 to 3.972.84 (#2877) (0878349)
  • deps-dev: bump @​smithy/signature-v4 from 5.7.3 to 5.7.4 (#2870) (12ce5f2)
  • deps-dev: bump jest from 30.5.1 to 30.5.2 (#2867) (48b5c2a)
  • deps-dev: bump oxfmt from 0.67.0 to 0.70.0 (#2864) (91a226d)
  • deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/browser-direct-import (#2863) (89ded6b)
  • deps-dev: bump puppeteer from 25.11.0 to 25.12.0 in /ecosystem-tests/ts-browser-webpack (#2876) (6ef1b6e)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/cloudflare-worker (#2865) (ef61ce0)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs (#2869) (5aab61c)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-cjs-web (#2871) (285f879)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm (#2872) (3ea3374)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-auto (#2873) (34e0877)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/node-ts-esm-web (#2875) (03342c5)
  • deps-dev: bump ts-jest from 29.4.12 to 29.4.14 in /ecosystem-tests/vercel-edge (#2878) (1149531)
  • deps-dev: bump yargs from 18.1.0 to 18.2.0 (#2874) (b1916d4)
  • deps: refresh development and ecosystem dependencies (#2889) (68d22b9)
  • responses: parse structured text only in final message phases (#2893) (534e691)
  • uploads: decode inferred URL filenames safely (#2892) (30d50ab)

v7.30.0

7.30.0 (2026-10-06)

Features

v7.29.0

7.29.0 (2026-10-05)

Features

  • agents: observe local tool failures (#2861) (3808241)
  • agents: run local tools during session creation streams (#2862) (7423ac3)
  • tools: support tool search (defer_loading=true) in typed function helpers (#2880) (3fb01eb)

v7.28.0

7.28.0 (2026-10-02)

Features

  • api: add custom voice creation and agent session events (#2858) (11b9283)
Changelog

Sourced from openai's changelog.

7.30.1 (2026-10-08)

Bug Fixes

  • api: correct custom voice creation parameters (#2895) (3edaf0f)
  • deps-dev: bump @​aws-sdk/credential-provider-node from 3.972.83 to 3.972.84 (#2877) (0878349)
  • deps-dev: bump @​smithy/signature-v4 from 5.7.3 to 5.7.4 (#2870) (12ce5f2)
  • deps-dev: bump jest from 30.5.1 to 30.5.2 (#2867) (

    Description has been truncated

    Summary by cubic

    Bumps eight production dependencies: Next.js 16.4.0, Sentry 11.7.0, OpenAI 7.32.0, pdfjs-dist 6.4.299, @supabase/supabase-js 2.117.3, and lucide-react 1.56.0. Also pins the clock in the roster give-away test, which started failing on 14 Oct 2026 because the fixture shift became urgent within 24 hours.

    • next 16.4.0 renames the static generation stream option to waitForAllReady and upgrades the bundled React.
    • @sentry/nextjs changes are limited to telemetry accuracy fixes and new optional Cloudflare/pi-durable integrations; no config changes required.
    • openai 7.32.0 adds standalone Decisions support and corrects custom voice creation parameters.
    • pdfjs-dist 6.4.299 raises the optional @napi-rs/canvas dependency to ^1.0.10.

    Bug Fixes

    • Pins Date to two days before the fixture shift in the give-away test so it exercises the ordinary path instead of the urgent "I can't make it" variant.