build(deps): bump @rive-app/canvas-single from 2.37.5 to 2.37.6#2692
build(deps): bump @rive-app/canvas-single from 2.37.5 to 2.37.6#2692dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@rive-app/canvas-single](https://github.com/rive-app/rive-wasm) from 2.37.5 to 2.37.6. - [Changelog](https://github.com/rive-app/rive-wasm/blob/master/CHANGELOG.md) - [Commits](rive-app/rive-wasm@2.37.5...2.37.6) --- updated-dependencies: - dependency-name: "@rive-app/canvas-single" dependency-version: 2.37.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Suggested comment for Cursor review (copy and paste as a new comment): Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review. |
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.6")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.6
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.6Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "8cd2ad2345861c28f475a5187750f905233ec515")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.6
git -C submodules/content-scope-scripts checkout 8cd2ad2345861c28f475a5187750f905233ec515 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Web Compatibility Assessment
No findings.
special-pages/package.json and package-lock.json only bump @rive-app/canvas-single from 2.37.5 to 2.37.6. The diff does not touch injected/src, wrapper utilities, captured globals, message bridge/transports, API overrides, config-gated feature code, DOM patching, or platform entry points. The package is only imported by special-pages/pages/onboarding/app/shared/components/RiveAnimation.js, so the practical compat surface is onboarding Rive animation rendering rather than arbitrary-page injected behavior.
Security Assessment
No findings.
The npm package metadata still reports no dependencies, peer dependencies, or optional dependencies, and the lockfile churn is limited to the expected version/resolved/integrity changes. Upstream package contents changed in rive.js, rive.js.map, runtimeLoader.d.ts, and package.json; the notable API typing change is an optional onError callback for runtime loading, which this repo does not call. Existing local usage keeps enableRiveAssetCDN: false, so this PR does not introduce a new repo-level network/CDN path.
Risk Level
Low Risk: semver-patch dependency-only update in special-pages; no injected runtime, wrapper, messaging, origin-validation, or security-sensitive code changes.
Recommendations
Merge if CI passes. As a product smoke check, verify the onboarding Rive animation still loads/renders on at least one WebKit-based target and one Chromium/WebView target, since upstream includes renderer/runtime fixes.
Validation run:
npm cisucceeded, with existing ESLint peer/audit warnings unrelated to this bump.npm run build --workspace=special-pagespassed.npm run test-unit --workspace=special-pagespassed: 104 tests, 0 failures.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency Risk Review
No blocking findings.
Confirmed evidence:
- PR only changes
special-pages/package.jsonandpackage-lock.json, bumping direct production dependency@rive-app/canvas-singlefrom2.37.5to2.37.6. - Current repo usage is limited to
special-pages/pages/onboarding/app/shared/components/RiveAnimation.js, reached from onboarding v3 Duck Player. No injected-page privacy feature code is touched. - Upstream
2.37.6changelog includes renderer/runtime/layout fixes plusfix(js): ensure onLoadError is invoked for any part of the initialization process; package diff changesrive.js,rive.js.map,runtimeLoader.d.ts, andpackage.json. - npm metadata still shows MIT license, zero dependencies, same file count, and unpacked size increasing from
5,785,261to5,887,306bytes. - Local usage keeps
enableRiveAssetCDN: false, so this does not introduce a new CDN/network asset path.
Uncertain/residual concern:
- The most relevant regression surface is visual/runtime behavior of the Rive canvas. Existing onboarding screenshot coverage explicitly masks the canvas, so it will not catch visual changes inside the animation. Functional onboarding tests cover the Duck Player step/toggle, and my focused local validation passed on both Chromium-like (
windows) and WebKit-like (macos) projects.
Validation run:
npm cipassed, with existing peer/audit warnings unrelated to this package.npm run build --workspace=special-pagespassed.npm run test-int --workspace=special-pages -- pages/onboarding/integration-tests/onboarding.v3.spec.js --project windows --project macos --grep "duck player" --reporter listpassed: 6/6.- PR CI relevant status when checked: release
build, special-pages unit tests, and special-pages Chromium integration passed; special-pages WebKit integration was still running.
Dependency still needed:
- It is still required while onboarding v3 Duck Player uses
RiveAnimation/Onboarding.riv. If v3 onboarding can be retired or migrated to the v4-style video/static asset path, that would be the cleaner way to remove this WASM runtime dependency, but that is outside the scope of this patch bump.
No separate fix PR drafted because I did not find a concrete code issue to fix.
Sent by Cursor Automation: Review dependabot
|
Superseded by #2708. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.6
branch
Bumps @rive-app/canvas-single from 2.37.5 to 2.37.6.
Changelog
Sourced from @rive-app/canvas-single's changelog.
Commits
219bd99chore: tag 2.37.62833de3Fix/render bc7 images (#12344) 3b74a521481a46ed8fix(browserstack): Fix the browserstack run for vk gms (#12473) b70b191146f59f28bfix(glmsaa): Fix MSAA artifacts with dstBlend barriers and no KHR (#12413) 82...381df50chore: drop D3D11/D3D12 pre-compiled DXBC ingestion path (#12475) 1de58d297cdcb1ecbfeature: track ShaderAsset assetId on ShaderModule (TRACK_RIVE_SHADER_ID) (#1...7ae4825chore(runtime): improve initialization performance of clipping shapes… (#1247...4c3a7c8fix(tests): gate render_canvas GMs behind with_rive_canvas (#12441) 1aab0beb603e32f3ffix: Absolute layout fill behavior (#12471) 6cce514679775e004fix(runtime): Fix top level artboard hug behavior (#12462) 0e91142f40Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Low risk dependency-only change; main impact is potential rendering/wasm behavior differences from the upstream Rive update.
Overview
Updates
@rive-app/canvas-singlefrom2.37.5to2.37.6forspecial-pages, including the correspondingpackage-lock.jsonresolution/integrity changes.Reviewed by Cursor Bugbot for commit df57475. Bugbot is set up for automated code reviews on this repo. Configure here.