build(deps): bump @rive-app/canvas-single from 2.37.5 to 2.37.8#2719
build(deps): bump @rive-app/canvas-single from 2.37.5 to 2.37.8#2719dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [@rive-app/canvas-single](https://github.com/rive-app/rive-wasm) from 2.37.5 to 2.37.8. - [Changelog](https://github.com/rive-app/rive-wasm/blob/master/CHANGELOG.md) - [Commits](rive-app/rive-wasm@2.37.5...2.37.8) --- updated-dependencies: - dependency-name: "@rive-app/canvas-single" dependency-version: 2.37.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
Suggested comment for Cursor review (copy and paste as a new comment): Note: GitHub Actions bot cannot trigger Cursor agent directly. Please copy the above comment to invoke the review. |
Build Branch
Static preview entry points
QR codes (mobile preview)
Integration commandsnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.8")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.8
git -C submodules/content-scope-scripts checkout origin/pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.8Pin to exact commitnpm (Android / Extension): Swift Package Manager (Apple): .package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "58bca14358391f522272fb9606fbed56617096b6")git submodule (Windows): git -C submodules/content-scope-scripts fetch origin pr-releases/dependabot/npm_and_yarn/main/rive-app/canvas-single-2.37.8
git -C submodules/content-scope-scripts checkout 58bca14358391f522272fb9606fbed56617096b6 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Web Compatibility Assessment
No findings.
The PR only bumps @rive-app/canvas-single in special-pages/package.json and the matching package-lock.json entry. It does not touch injected runtime code, browser API wrappers/shims, captured globals, messaging transports, message bridge checks, DOM manipulation code, or platform entry points.
Relevant upstream changes between 2.37.5 and 2.37.8 include JS/WASM runtime fixes around load-error reporting, restarting the rAF loop on document.visibilitychange, renderer creation errors, focus/keyboard interaction helpers, and assorted renderer/runtime fixes. The package remains dependency-free. Current repo usage is limited to onboarding’s RiveAnimation component, which does not opt into the new keyboard/focus helpers.
Security Assessment
No findings.
No new network requests, postMessage, dynamic code execution, native messaging payload changes, iframe access, origin checks, or injected page-world global reads were introduced by this diff.
Risk Level
Low Risk: dependency-only special-pages update with aligned lockfile changes and no injected web-page runtime surface changes.
Recommendations
No blocking recommendations.
Validated locally:
npm run build --workspace=special-pagesnpm run test-unit --workspace=special-pages
Optional release confidence: smoke-test the onboarding Duck Player Rive animation/before-after toggle on at least one WebKit-based target, since upstream changed runtime rAF/visibility handling and renderer error propagation.
Sent by Cursor Automation: Web compat and sec
There was a problem hiding this comment.
Dependency risk review for @rive-app/canvas-single 2.37.5 -> 2.37.8
Confirmed issues: none found.
Evidence reviewed:
- PR only changes
special-pages/package.jsonandpackage-lock.json; no app code changes. - Current repo usage is limited to onboarding v3’s
RiveAnimationwrapper, which instantiatesRivefor the Duck Player animation withenableRiveAssetCDN: false. - Upstream changelog for 2.37.6-2.37.8 includes runtime-visible changes: canvas focus/keyboard handling,
visibilitychangerender-loop handling, stricterLoadErrorpaths, renderer creation error handling, compressed texture/runtime fixes, and WebGPU/GPU/backend work. These are broader than a metadata-only patch, but the local usage stays oncanvas-singlewith inline WASM and local.rivassets. - Supply chain: npm metadata still reports MIT license, zero package dependencies, same maintainers, registry signature plus SLSA provenance attestation for 2.37.8.
npm audit --omit=dev --workspace special-pagesreported 0 vulnerabilities. - Tests: GitHub checks show special-pages integration and snapshots passing. I also ran
npm run test-int --workspace=special-pages -- pages/onboarding/integration-tests/onboarding.v3.spec.js --grep "shows v3 flow" --reporter list, which passed (12 passed) and covers navigation through the onboarding v3 Duck Player step that creates the Rive canvas.
Uncertain/residual risk:
- Existing screenshot coverage masks the Rive canvas, so it will not catch visual rendering regressions inside the animation. Manual/native smoke validation of the onboarding v3 Duck Player step is still useful if this dependency is high-risk for release.
- The new upstream focus handling can set
tabIndexand intercept Tab when a Rive file has focus nodes. I did not see focus-related strings in the checked-in onboarding.rivasset, so this is not a confirmed issue, but keyboard tab order would be the specific behavior to validate if the asset changes. - The dependency still appears needed while onboarding v3 is supported. Once v3 is retired,
@rive-app/canvas-singleshould be removable since v4 appears to use non-Rive media for this step.
No separate fix PR drafted: I did not find a concrete defect needing a code change, and I did not push changes to this PR.
Sent by Cursor Automation: Review dependabot
Bumps @rive-app/canvas-single from 2.37.5 to 2.37.8.
Changelog
Sourced from @rive-app/canvas-single's changelog.
... (truncated)
Commits
bf02dc7chore: tag 2.37.8bc56011fix(unity): add missing neon palette png symbols to fix iOS crash (#12620) 46...eaac76echore(focus): expose focus polling API (#12617) fdb053672359b7301refactor(ore): convert ore classes to be virtual with per backend implementat...bc0cc5ffix: Scroll to hidden layouts using scrollIndex (#12598) 679b808585745bf11fix: PropertyRecorder UB calling &front() on empty buffers (#12607) 623d5fe7a35d3f1fbfix(js): restart rAF loop on document visibilitychange event to ensure we pau...21585e3feat(wgpu): Use wgsl (finally) in the WebGPU backend (#12541) d779307982cc214a0fix(runtime): Incorrect modulo in scroll using snap and carousel (#12586) 308...002ab0afix(tests): Update gms & goldens to support 16K page sizes (#12584) 4440cf2decDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Lockfile-only dependency patch bump with no repo code changes; main risk is regressions in Rive canvas animations used on special pages.
Overview
Bumps
@rive-app/canvas-singlein thespecial-pagespackage from 2.37.5 to 2.37.8, with the matchingpackage-lock.jsonresolution updates. There are no application source changes—only dependency version pins.Onboarding and related UI still load Rive through the existing
RiveAnimationwrapper; this PR only picks up upstream runtime fixes and behavior changes in the 2.37.6–2.37.8 release line (for example JS visibility/requestAnimationFramehandling, scroll/layout fixes, and renderer error handling noted in the upstream changelog).Reviewed by Cursor Bugbot for commit 4cdceaf. Bugbot is set up for automated code reviews on this repo. Configure here.