You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
chore: Guard from calling markNeedsUpdate in update (#12525) fab85a4fd5 ea0ff90
fix(editor): reset scripted objects initialization when data context is cleared (#12523) 9faec1e36e 4d5c72c
validate inputs for logging (#12521) 8e58f305c1 9d804e3
Update profiler to fix build (#12515) 687a80a7a8 87f8275
chore(js): force js/npm/** changes through downstream push with up-to-date versions. add rive_fallback.wasm to webgl2 package files to actually publish with that file (#12502) d3ee0f9e01 a64cc66
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Note
Low Risk
Low risk dependency-only bump; main risk is potential rendering/runtime regressions in pages that use Rive due to updated WASM/canvas code.
Overview
Updates the special-pages dependency on @rive-app/canvas-single from 2.37.5 to 2.37.7, with corresponding package-lock.json resolution/integrity updates.
Reviewed by Cursor Bugbot for commit e468ced. Bugbot is set up for automated code reviews on this repo. Configure here.
The reason will be displayed to describe this comment to others. Learn more.
Web Compatibility Assessment
No findings. The diff only updates @rive-app/canvas-single from 2.37.5 to 2.37.7 in special-pages/package.json and package-lock.json; it does not touch injected runtime code, API wrappers/shims, DOM mutation logic, feature config, or platform entry points.
Security Assessment
No findings. The package has no npm dependencies/peerDependencies, the lockfile is aligned with the declared version, and the changed files do not affect captured globals, messaging transports, message bridge validation, origin checks, or iframe handling.
Risk Level
Low Risk: dependency metadata-only update for a special-pages Rive canvas runtime, with no injected/src or security-sensitive code changes.
Recommendations
No blocking recommendations. I verified npm ci --ignore-scripts and npm run test-unit --workspace=special-pages locally; both completed successfully.
Suggested comment for Cursor review (copy and paste as a new comment):
@cursoragent can you review against the current code and outline potential impacts based on the changelogs of the update?
Can you check the test coverage and ensure that the new code is covered?
Can you think through if this dependency is still needed or if there's better practices used elsewhere.
Can you draft a separate PR with any fixes that might be needed?
Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review.
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Dependency review for @rive-app/canvas-single2.37.5 -> 2.37.7: no blocking concerns found.
Confirmed evidence:
The PR only updates special-pages/package.json and package-lock.json for this package.
npm metadata is stable across the bump: MIT license, 0 dependencies, 12 packaged files. The unpacked bundle grows from ~5.79 MB to ~5.90 MB, expected for the bundled JS/WASM runtime.
Local usage is limited to special-pages/pages/onboarding/app/shared/components/RiveAnimation.js, used by the v3 Duck Player onboarding flow. That code sets enableRiveAssetCDN: false and loads a local .riv asset, so the Rive asset-CDN path remains disabled.
Upstream changelog entries for 2.37.6 and 2.37.7 are mostly renderer/runtime changes: compressed texture/KTX2 support, canvas/GL rendering fixes, init/load-error handling, and runtime safety fixes such as overflow/list-size validation and memory pressure fixes.
npm audit --workspace=special-pages --omit=dev reported 0 production vulnerabilities.
Residual validation risk:
Existing automated coverage exercises the v3 Duck Player step and toggle telemetry, but the screenshot test masks the Rive <canvas>, so it does not directly assert rendered pixels or state-machine visual output. I ran the targeted v3 Duck Player integration tests and they passed, but a visual check of the v3 Duck Player animation is the remaining confidence gap for this renderer bump.
Still needed:
The dependency is still needed while v3 onboarding remains supported/tested. Since v4 appears to use video/static assets instead, removing Rive can be revisited when v3 onboarding is retired.
Verification run:
npm ci
npm run build --workspace=special-pages
npm run test-int --workspace=special-pages -- pages/onboarding/integration-tests/onboarding.v3.spec.js --grep "duck player step" --reporter list
npm audit --workspace=special-pages --omit=dev
No separate fix PR drafted because I did not find a required code change for this update.
The reason will be displayed to describe this comment to others. Learn more.
Dependency review for @rive-app/canvas-single2.37.5 -> 2.37.7: no blocking concerns found.
Confirmed evidence:
The PR only changes special-pages/package.json and package-lock.json for this direct production dependency.
Local usage is limited to special-pages/pages/onboarding/app/shared/components/RiveAnimation.js, reached by the v3 onboarding Duck Player step. The wrapper sets enableRiveAssetCDN: false and loads the local bundled .riv asset, so this bump does not introduce a new runtime network fetch path.
Package metadata is stable across 2.37.5 and 2.37.7: MIT license, 0 npm dependencies, 12 published files, no bundled deps. The unpacked package grows from ~5.79 MB to ~5.90 MB, consistent with an inline JS/WASM runtime update.
Upstream changelog entries for 2.37.6/2.37.7 are renderer/runtime oriented: compressed texture/KTX2 support, canvas/GL rendering fixes, JS load-error handling, runtime validation/safety fixes, and memory-pressure fixes. I did not see changelog evidence of a new browser permission, dependency, or CDN requirement relevant to this repo’s current usage.
npm audit --workspace=special-pages --omit=dev reported 0 production vulnerabilities.
Coverage and residual risk:
Existing onboarding integration coverage exercises the v3 Duck Player step and toggle telemetry. I also ran targeted v3 Duck Player tests after the bump and they passed.
Remaining validation gap is visual fidelity of the Rive-rendered <canvas> itself: the automated tests assert page behavior around the step, not pixel-level state-machine output. A quick manual visual check of the v3 Duck Player animation would be the only extra confidence I’d ask for, not a blocker.
Dependency need:
The dependency is still needed while v3 onboarding remains supported. Since v4 appears to avoid Rive for this flow, removing @rive-app/canvas-single can be revisited when v3 onboarding is retired.
The reason will be displayed to describe this comment to others. Learn more.
Dependency update review for @rive-app/canvas-single2.37.5 -> 2.37.7:
No confirmed blocking concerns found.
Confirmed evidence:
Diff only updates special-pages/package.json and package-lock.json; the package still has 0 npm dependencies and the lockfile integrity matches npm metadata for 2.37.7.
Local usage is limited to special-pages/pages/onboarding/app/shared/components/RiveAnimation.js, reached by onboarding v3’s Duck Player step.
Upstream changelog for 2.37.6/2.37.7 includes renderer/runtime fixes, compressed texture/ktx2 support, and JS load-error handling changes. These could affect Rive canvas rendering/load behavior, but no repo API usage change was required.
npm audit --omit=dev --workspace=special-pages reports 0 production vulnerabilities.
Validation run:
npm ci
npm run build --workspace=special-pages
npm run test-int --workspace=special-pages -- pages/onboarding/integration-tests/onboarding.v3.spec.js --grep "shows v3 flow" --reporter list -> 12 passed
Residual risk / test coverage:
Existing v3 flow tests exercise the Duck Player page path and toggles, but screenshots mask the Rive canvas to avoid animation flake, so they do not prove pixel-for-pixel rendering equivalence. Given this is a patch bump with no new transitive deps and runtime smoke coverage passed, I do not think this needs a blocking fix.
Dependency need / alternative:
The dependency is still needed for onboarding v3. Onboarding v4 appears to use video for the Duck Player animation path, so a future cleanup could remove Rive only if/when v3 and RiveAnimation are retired or ported.
I did not draft a separate fixes PR because I did not find a concrete issue requiring code changes.
Sent by Cursor Automation: Review dependabot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesUpdate one or more dependencies versionpatchIncrement the patch version when mergedsemver-patchBug fix / internal — no release needed
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Bumps @rive-app/canvas-single from 2.37.5 to 2.37.7.
Changelog
Sourced from @rive-app/canvas-single's changelog.
... (truncated)
Commits
3984a8achore: tag 2.37.795048a9fix: Make ViewModelInstanceTrigger keyable for Stateful Components (#12556) c...3ad1efaSupport ktx2 (#12385) f454e3170eb313226fix(js): catch errors when creating the renderer and send to Rive LoadError e...575568eFix render_canvas_prepass_multi GL flip pivot (#12488) db997822be1603626chore(runtime): resolve build error after merge conflicts (#12545) 320eff3f97b3c62c7feat(scripting_workspace): HLSLStructLayout v2 with per-resource stageMask (#...8a3046cchore(rive_native): build microprofiler behind a flag (#12514) 44ba1a605ecce3914fix: memory pressure during dart allocations from luau trampoline cal… (#1254...6d75a6dfix(scripting_workspace): HLSL export cleanup (#12512) 60b685278cDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Low risk dependency-only bump; main risk is potential rendering/runtime regressions in pages that use Rive due to updated WASM/canvas code.
Overview
Updates the
special-pagesdependency on@rive-app/canvas-singlefrom2.37.5to2.37.7, with correspondingpackage-lock.jsonresolution/integrity updates.Reviewed by Cursor Bugbot for commit e468ced. Bugbot is set up for automated code reviews on this repo. Configure here.