• Atmosphere: only attach the PBR material plugin to materials in the atmosphere's scene - by increasinglyHuman (#18934)

• StandardMaterial: depth pre-pass honours every alpha source, and alphaCutOff is bound for all alpha-tested materials - by increasinglyHuman (#18936)
• Complete cube / prefiltered texture load contract - [Bug Fix] by bkaradzic-microsoft (#18874)
• Add root motion for animation groups: RootMotionClip and RootMotionController - by Pryme8 (#18908)
• Use nearest sampling for Gaussian Splatting data textures - by luokn (#18933)
• Fix WGSL vPartIndex redefinition when combining Gaussian Splatting material plugins - by raymondyfei (#18931)

• OBJFileLoader: Fix AssetContainer handling and add opt-in texture loading waits - by noname0310 (#18895)

• fix(jsx): replace Suspense and ErrorBoundary content across newlines in https://github.com/honojs/hono/pull/5380
• fix(accepts): match media types and language tags case-insensitively in https://github.com/honojs/hono/pull/5376
• fix(linear-router): don't match an empty path segment as a param in https://github.com/honojs/hono/pull/5373
• fix(pretty-json): don't break responses with unparseable JSON bodies in https://github.com/honojs/hono/pull/5377
• fix(jwt): throw JwtTokenInvalid when the signature is not valid base64url in https://github.com/honojs/hono/pull/5379
• fix(aws-lambda): treat binary +xml archive media types as binary in https://github.com/honojs/hono/pull/5424
• fix(aws-lambda): preserve empty query parameters in https://github.com/honojs/hono/pull/5292
• fix(lambda-edge): sync content type detection with aws-lambda in https://github.com/honojs/hono/pull/5426
• fix(lambda-edge): fail with a descriptive error on a malformed event in https://github.com/honojs/hono/pull/5358

Full Changelog: https://github.com/honojs/hono/compare/v4.13.8...v4.13.9

• [ci] Skip preview tarball upload when the artifact is missing: #98713
• [cd] Retry preview tarball uploads with backoff and richer diagnostics: #99060
• Promote next analyze command: #99074
• [ai-upgrade] Remind the agent to report the nudge: #99127

Huge thanks to @eps1lon, @wbinnssmith, and @devjiwonchoi for helping!

• With checkOverlappingEntry set, a data descriptor whose CRC-32 disagrees with the central directory, a corrupt CRC-32 for instance, is now reported in localDirectory.dataDescriptor with its own fields, its CRC-32 differing from entry.crc32 as LocalDataDescriptor#crc32 documents. Until now the signed layout was kept only when its CRC-32 and sizes agreed with the central directory, since 2.18.1 among 4- or 8-byte sizes, and otherwise the record was read at the width the Zip64 extra field of either record announces without the signature, i.e. at a layout known not to match, so a signed descriptor with a corrupt CRC-32 came back with signature false, the signature bytes as crc32 and its sizes shifted by four bytes. The layout is now the one whose sizes agree with the central directory, its CRC-32 breaking ties when the central directory stores one; when no layout agrees, the record is read at the announced width as before, with the signature when it starts with one. The tie-break applies to AES entries that store a CRC-32 (AE-1, what WinZip writes for most files) like to any other entry; the CRC-32 of an AES entry used to be ignored. Reading the data of the entry is unchanged, and reading without checkOverlappingEntry never consulted the descriptor

• The remarks of LocalDataDescriptor#signature and LocalDataDescriptor#zip64 describe how the layout is chosen

• The data descriptor width test now reads a signed descriptor whose CRC-32 alone is corrupt and one whose compressed size is corrupt, and a new test writes an AE-2 entry with a signed data descriptor, patches it into an AE-1 entry with a disagreeing and then an agreeing descriptor CRC-32, and checks the layout reported for each and for the AE-2 entry

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.18.1...v2.18.2

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

• LocalDataDescriptor has a zip64 property, true when the sizes of the data descriptor read with checkOverlappingEntry are stored as 8-byte values

• With checkOverlappingEntry set, an entry placed past 4 GB whose data descriptor stores 4-byte sizes now reads; getData() used to fail with ERR_UNSUPPORTED_UINT64. The width of the sizes was taken from the presence of a Zip64 extra field in either record, but neither record tells it reliably: the local file header is written before a streaming writer knows the sizes, and the Zip64 extra field of the central directory record, written last, describes that record, not the descriptor. Go's archive/zip, for instance, gives a small entry placed past 4 GB a Zip64 extra field in its central directory record for the offset alone and a 4-byte descriptor, while its large streamed entries get an 8-byte descriptor with no local Zip64 extra field, which is why the central directory record was consulted; the descriptor of the small entry was therefore read as 8 bytes wide, across the next record. The descriptor is now read with the layout, among the two widths with and without the signature, whose CRC-32, when the entry stores one, and sizes agree with the central directory; when none does, it is read at the width the Zip64 extra field of either record announces, without the signature, as before. Reading without checkOverlappingEntry never depended on the descriptor and is unchanged

• A new test builds the archives by hand, behind a reader that fakes a 4 GB prefix so the offsets are real, and reads a 4-byte descriptor below and past 4 GB, signed and unsigned, and an 8-byte descriptor whose Zip64 extra field is in the central directory only or in neither record, each in both read orders, and a descriptor agreeing with no layout

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.18.0...v2.18.1

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

• Add experimental custom webpack support: #98862
• Default agentic upgrades to a separate worktree: #99111
• Improve agent upgrade failure message for missing app: #99117
• Preserve error boundaries in on-demand partial prerenders: #99051
• Preserve error boundaries during on-demand prerendering: #99037
• docs: clarify Turbopack ModulePart export examples: #99104
• Add some more verification and safety rules around custom distDir: #98997
• Preserve closed-route admission across cache misses: #98964
• Move suspension into operation guard: #99053
• [agent-feedback] Shorten managed agent instructions: #99065
• docs: clarify Cache Components build output: #98274
• Update Rust namespace re-export snapshots: #99106

Huge thanks to @sokra, @devjiwonchoi, @unstubbable, @lukesandberg, @gnoff, @jimmyhmiller, and @aurorascharff for helping!

• A Zip64 extra field of a local file header that is too short for the 0xFFFFFFFF sentinels of the header or holds a value above Number.MAX_SAFE_INTEGER no longer fails getData() with ERR_EXTRAFIELD_ZIP64_NOT_FOUND or ERR_UNSUPPORTED_UINT64: the sizes of an entry come from the central directory, so the field is reported as WARNING_MALFORMED_EXTRA_FIELD on entry.warnings and the entry is read. A local file header whose sizes hold the sentinels with no Zip64 extra field behind them, which used to pass silently, is reported the same way. In the three cases an entry without a data descriptor keeps the sentinels as its local sizes, which the local file header check reports as WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES, i.e. ERR_AMBIGUOUS_ARCHIVE under the default strictness and a warning with strictness: "tolerant". Both errors are still raised by getEntries() for a central directory record whose field is too short or holds such a value, where the sizes and the offset have no other source, and a record whose sizes, offset or disk number hold the sentinel with no Zip64 extra field behind it now fails getEntries() with ERR_EXTRAFIELD_ZIP64_NOT_FOUND too, at every strictness, so none of the entries is listed: it used to be listed with sizes of 4 GB and fail later, with a local file header mismatch or ERR_ENTRY_DATA_OUT_OF_BOUNDS, or with ERR_LOCAL_FILE_HEADER_NOT_FOUND for an offset
• An AES extra field on a record that is not encrypted and whose compression method is not 99 is ignored and reported as WARNING_MALFORMED_EXTRA_FIELD, on ZipReader#warnings with the filename for the central directory record and on entry.warnings for the local file header, and the entry is read with the method its record declares; the field used to override the method and getData() failed with ERR_UNSUPPORTED_COMPRESSION. An AES extra field shorter than 7 bytes, which was ignored silently, is reported the same way. On an encrypted record the field still overrides the method and the conflict is still rejected with ERR_UNSUPPORTED_COMPRESSION, since the data may be AES behind a wrong method
• The encrypted flag of an entry follows its central directory record. A local file header whose bit 0 is cleared is still ERR_AMBIGUOUS_ARCHIVE under the default strictness, and a reader with strictness: "tolerant" now decrypts the entry and deposits WARNING_MISMATCHED_LOCAL_FILE_HEADER_BIT_FLAG, where it used to follow the local file header, read the ciphertext as plaintext and fail
• An entry whose strong encryption bit (bit 6 of the general purpose bit flag) differs between the two records is ERR_AMBIGUOUS_ARCHIVE under the default strictness, like the encrypted bit, and the ERR_UNSUPPORTED_ENCRYPTION check reads the central directory record. A bit set in the local file header only used to reject an encrypted entry, AES or ZipCrypto, as unsupported, and a bit set in the central directory only was ignored; a reader with strictness: "tolerant" now decrypts the first with WARNING_MISMATCHED_LOCAL_FILE_HEADER_BIT_FLAG and reports the second as ERR_UNSUPPORTED_ENCRYPTION
• The cause of an error raised in a worker keeps its code property, e.g. "Z_MEM_ERROR" on the cause of ERR_CODEC_OUT_OF_MEMORY. A structured clone never copies that property, so it was undefined with workers on every host, while the code of the error itself was already carried by the message posted by the worker

• ERR_EXTRAFIELD_ZIP64_NOT_FOUND, ERR_UNSUPPORTED_UINT64, WARNING_MALFORMED_EXTRA_FIELD and WARNING_MISMATCHED_LOCAL_FILE_HEADER_BIT_FLAG document the cases above, and ERR_INVALID_COMPRESSED_DATA, ERR_INVALID_CRC32, ERR_INVALID_UNCOMPRESSED_SIZE and ERR_CODEC_OUT_OF_MEMORY state more precisely the routes on which they are raised: the ERR_INVALID_CRC32 case of Node.js for bytes trailing the deflate stream with checkCrc32, the gzip route of an AE-2 entry running only on a host without "deflate-raw" whose bundled codec cannot take over either, e.g. because the WebAssembly module failed to load, and, on a host without "deflate-raw", a bundled codec that cannot allocate its state when the entry starts not being reported as ERR_CODEC_OUT_OF_MEMORY, since the native codec takes over through a gzip container unless useCompressionStream is false

• New tests cover the three ways a Zip64 extra field of a local file header is unreadable, and their central directory counterparts, the stray AES extra field on a deflated and on an encrypted entry, the encrypted bit and the strong encryption bit disagreeing between the two records, and a worker whose codec cannot allocate its state, a test that runs on the browsers with module workers, Deno and Bun

Full Changelog: https://github.com/gildas-lormeau/zip.js/compare/v2.17.0...v2.18.0

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

[!IMPORTANT] Vuetify Needs Your Support! The OpenCollective funds are running low. The team needed to scale down and is barely able to compensate the contributors for their work on the framework and the ecosystem tools.

If Vuetify is part of your stack, please consider sponsoring the project so we can continue delivering updates and fixes.

Sponsor via Open Collective

Every contribution helps us keep Vuetify alive and signals to maintainers that their effort is appreciated.

Thank you.

• VAutocomplete/VCombobox: prevent menu icon from toggling twice (#23200) (c8b9d6a), closes #23197
• VPullToRefresh: wrap styles in the components cascade layer (#23207) (9453f06), closes #23206
• VSelect/VAutocomplete: match autofill against item values (#23063) (b6c9f5c), closes #20560
• VSelect/VAutocomplete/VCombobox: apply menu-elevation to the content div (#23193) (8d1d985), closes #23192
• VSwitch: rotate icon for vertical direction (6b090a0)
• VTab: restore overflow for correct slider animation (1c5545c)
• VTabs: apply inset-radius to tab for ripple and focus ring (bf6abfc)

• VCommandPalette: render the list.prepend slot (#23204) (7cd8c57), closes #23202
• VHighlight: correct foreground color in forced-colors mode (c00064f)
• VMonthPicker: !important not needed in trumps layer (fdc76e5)
• VVideo: !important for thumb label no longer needed (b3d8bb1)

• types: add contrib module declarations (#4250) (aafa187)

• button: sync aria attributes between host and native button (#31264) (e771519), closes #30626
• datetime: tear down ready state only when the host is hidden (#31460) (bf0607e), closes #30933
• popover: account for CSS zoom in positioning and sizing (#31426) (96ff7df), closes #30919 #31047
• vue: respect config log level (#31452) (edb3e48)